命令执行

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>简单 RCE 漏洞示例</title>
</head>
<body>
    <h2>远程代码执行示例</h2>
    <form action="" method="post">
        <label for="command">输入命令：</label>
        <input type="text" id="command" name="command" required><br><br>
        <input type="submit" value="执行命令">
    </form>

    <h3>执行结果：</h3>
    <pre>
    <?php
    if (isset($_POST['command'])) {
        // 获取用户输入的命令
        $command = $_POST['command'];
        
        // 执行命令并输出结果
        // 注意：以下代码存在RCE漏洞
        $output = shell_exec($command);
        echo htmlspecialchars($output);
    }
    ?>
    </pre>
</body>
</html>

flag

查看当前目录

1
cd

查看flag

1
2

type flag.txt