http://rstashbrabv5ezel76m2vdzet4szdzncwvgd2q5y3kbsdw3q6spcglid.onion/products/021e9130-1932-476c-87b3-1d2e03cf82d3
Very quick and dirty exploit, written to test out some new ideas I had for writing more streamlined PHP RCE exploits, in this case, using the cookie to set the connectback host/port at runtime when doing a filedropper type thing. I ended up storing the payload itself in a POST variable, as storing it in the cookie lead to some strange encoding issues.