Lab 5: Advanced Filter Bypass RCE

// Multiple filter implementations
function applyFilter($input, $type) {
    switch ($type) {
        case 'basic':
            return str_replace([';', '&', '|', '`', '$', '(', ')', '<', '>'], '', $input);
        case 'command_filter':
            $commands = ['cat', 'ls', 'whoami', 'id', 'uname'];
            foreach ($commands as $cmd) {
                $input = str_ireplace($cmd, '', $input);
            }
            return $input;
        case 'space_filter':
            return str_replace(' ', '', $input);
        case 'quote_filter':
            return str_replace(['"', "'", '`'], '', $input);
        default:
            return $input;
    }
}

// Bypass functions
function applyBypass($input, $technique) {
    switch ($technique) {
        case 'double_encoding':
            return str_replace(['%2f', '%3a'], ['%252f', '%253a'], $input);
        case 'unicode_encoding':
            return str_replace(['/', ':'], ['%c0%af', '%c0%ae'], $input);
        case 'command_substitution':
            return str_replace(['ls', 'cat'], ['`ls`', '`cat`'], $input);
        default:
            return $input;
    }
}

// Vulnerable processing
if (isset($_GET['cmd'])) {
    $command = $_GET['cmd'];
    $filtered_command = applyFilter($command, $filter_type);
    $bypassed_command = applyBypass($filtered_command, $bypass_technique);
    $output = shell_exec($bypassed_command . ' 2>&1');
}