shell bypass 403

GrazzMean Shell

Uname: Linux yisu-647059427c03a 3.10.0-862.14.4.el7.x86_64 #1 SMP Wed Sep 26 15:12:11 UTC 2018 x86_64
Software: nginx/1.22.1
PHP version: 7.3.31 [ PHP INFO ] PHP os: Linux
Server Ip: 103.146.158.90
Your Ip: 216.73.216.141
User: www (1000) | Group: www (1000)
Safe Mode: OFF
Disable Function:
passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv

name : Index.php
<?php
// +----------------------------------------------------------------------
// | Copyright (c) 2020-08-10 http://myucms.com All rights reserved.
// +----------------------------------------------------------------------
// | Author: 梦雨 <50361804@qq.com>
// +----------------------------------------------------------------------
namespace app\index\controller;
use think\Controller;
use think\Db;
open_ts(); 
class Index extends Controller
{
    //首页
    public function index()
    {

		return view(PATH.'/index/'.set('tpl').'/index/index.html');
		
    }
    //单页管理
    public function dan()
    {
        $c = Db::name('dan')->where(array('alias' => get('html')))->find();
        if (!$c['template']) {
            $this->error('页面不存在');
        } 
        $this->assign('c',$c);
        return view(PATH.'/index/view/dan/'.$c['template'].'.html');
    }
    //我的收藏
    public function shoucang()
    {
        if (cookie('uid')!=user('uid')) {
            $this->error('请先登录','/');
        } 
        return view(PATH.'/index/'.set('tpl').'/index/shoucang.html');
    }
    //分类列表
    public function cate()
    {
        if (fun_c('cate',array('id'=>get('html')))) {
            $t = Db::name('cate')->find(get('html'));
            $m = Db::name('model')->where(array('id' => $t['m']))->find();
            if (!input('id')) {
                $c = Db::name($m['alias'])->where(array('tid' => $t['id']))->find();
            } else {
                $c = Db::name($m['alias'])->where(array('tid' => $t['id'],'id'=>get('id')))->find();
            }
        } else {
            $m = Db::name('model')->where(array('alias' => get('html')))->find();
            $t = Db::name('cate')->where(array('m' => $m['id']))->order('px desc')->find();
            $c = Db::name($m['alias'])->where(array('tid' => $t['id']))->find();
        }

        $this->assign('c',$c);
        $this->assign('m',$m);
        $this->assign('t',$t);
        //自增加1
        Db::name($m['alias'])->where('id', $c['id'])->setInc('view', 1);
        return view(PATH.'/index/'.set('tpl').'/index/'.$m['template'].'.html');
    }
    //分类列表——保留
    public function web()
    {
        if (fun_c('cate',array('id'=>get('html')))) {
            $t = Db::name('cate')->find(get('html'));
            $m = Db::name('model')->where(array('id' => $t['m']))->find();
            if (!input('id')) {
                $c = Db::name($m['alias'])->where(array('tid' => $t['id']))->find();
            } else {
                $c = Db::name($m['alias'])->where(array('tid' => $t['id'],'id'=>get('id')))->find();
            }
        } else {
            $m = Db::name('model')->where(array('alias' => get('html')))->find();
            $t = Db::name('cate')->where(array('m' => $m['id']))->order('px desc')->find();
            $c = Db::name($m['alias'])->where(array('tid' => $t['id']))->find();
        }

        $this->assign('c',$c);
        $this->assign('m',$m);
        $this->assign('t',$t);
        //自增加1
        Db::name($m['alias'])->where('id', $c['id'])->setInc('view', 1);
        return view(PATH.'/index/'.set('tpl').'/index/'.$m['template'].'.html');
    }
    //搜索
    public function soso()
    {
        // 每次搜索的关键词我们入库
        $c = Db::name('soso')->where(array('title' => get('ks')))->find();
        if ($c['title']==get('ks')) {
            $data['view'] = $c['view']+1;
            Db::name(soso)->where(array('id' => $c['id']))->update($data);
        } else {
            $data['open'] = 1;
            $data['time'] = time();
            $data['title'] = get('ks');
            $data['uid'] = dingyi(user('id'),0);
            Db::name('soso')->where($data)->insert($data);
        }
        return view(PATH.'/index/'.set('tpl').'/index/soso.html');
    }
    //最近更新
    public function update()
    {
        return view(PATH.'/index/'.set('tpl').'/index/update.html');
    }
}
© 2026 GrazzMean