From fd8f253a8f7b3191ba3390954fbd6da164609b23 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ufuk=20S=C3=BCng=C3=BC?=
 <32815429+ufuksungu@users.noreply.github.com>
Date: Fri, 30 Nov 2018 02:49:47 +0300
Subject: [PATCH] Add files via upload

---
 CommandExecution/CommandExec-4.php | 46 ++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 CommandExecution/CommandExec-4.php
diff --git a/CommandExecution/CommandExec-4.php b/CommandExecution/CommandExec-4.php
new file mode 100644
index 0000000..64eb71a
--- /dev/null
+++ b/CommandExecution/CommandExec-4.php
@@ -0,0 +1,46 @@
+<html>
+  <head>
+    <link rel="shortcut icon" href="../Resources/hmbct.png" />
+    <title>CommandExec-4</title>
+  </head>
+  <body>
+    <div style="background-color:#afafaf;padding:15px;border-radius:20px 20px 0px 0px">
+      <button type="button" name="homeButton" onclick="location.href='../homepage.html';">Home Page</button>
+      <button type="button" name="mainButton" onclick="location.href='commandexec.html';">Main Page</button>
+    </div>
+    <div style="background-color:#c9c9c9;padding:20px;">
+      <h1 align="center"></h1>
+    <form align="center" action="CommandExec-4.php" method="$_GET">
+      <input type="text" name="typeBox" value=""><br>
+      <input type="submit">
+    </form>
+  </div>
+  <div style="background-color:#ecf2d0;padding:20px;border-radius:0px 0px 20px 20px" align="center">
+    <?php
+    if(isset($_GET["typeBox"])){
+      $target =$_GET["typeBox"];
+      $substitutions = array(
+        '&&'=>'',
+        '& ' => '',
+        '&& ' => '',
+        ';'  => '',
+        '|' => '',
+        '-'  => '',
+        '$'  => '',
+        '('  => '',
+        ')'  => '',
+        '`'  => '',
+        '||' => '',
+        '/' => '',
+        '\\' => '',
+      );
+      $target = str_replace(array_keys($substitutions),$substitutions,$target);
+      echo shell_exec($target);
+      if($_GET["typeBox"] == "flag")
+        echo "You did again! Impressive.";
+    }
+
+    ?>
+  </div>
+  </body>
+</html>
