shell bypass 403

GrazzMean Shell

Uname: Linux yisu-647059427c03a 3.10.0-862.14.4.el7.x86_64 #1 SMP Wed Sep 26 15:12:11 UTC 2018 x86_64
Software: nginx/1.22.1
PHP version: 7.3.31 [ PHP INFO ] PHP os: Linux
Server Ip: 103.146.158.90
Your Ip: 216.73.216.141
User: www (1000) | Group: www (1000)
Safe Mode: OFF
Disable Function:
passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv

name : index.php
<?php
/**
 * 安装向导
 */
header('Content-type:text/html;charset=utf-8');
// 检测是否安装过
if (file_exists('./install.lock')) {
    echo '你已经安装过该系统,请删除./data/install/文件';
    die;
}
// 同意协议页面
if (@(!isset($_GET['c'])) || @$_GET['c'] == 'agreement') {
    require './agreement.html';
}
// 获取试用
if (@$_GET['c'] == 'test') {
    require './test.html';
}
function json($array = [])
{
    echo json_encode($array);
}
if (@$_GET['c'] == 'sq') {
    $path = '../config/sq.php';
    $paths = '../config/sq.php';
    $file = (include $paths);
    $config = array('APP_MYU' => $_POST['sq']);
    $config = preg_replace("/[?><?]/", '', $config);
    $res = array_merge($file, $config);
    $str = '<?php return [';
    foreach ($res as $key => $value) {
        $str .= '\'' . $key . '\'' . '=>' . '\'' . $value . '\'' . ',';
    }
    $str .= ']; ';
    if (file_put_contents($path, $str)) {
        return json(array('code' => 1, 'msg' => '创建成功'));
    } else {
        return json(array('code' => 0, 'msg' => '创建失败'));
    }
}
// 创建数据库页面
if (@$_GET['c'] == 'create') {
    $url = preg_replace('|[0-9]+|', '', 'h0t1t2p0:3/4/5w6w7w0.1m2y5u4c5m6s3.c2o1m');
    require './create.html';
}
// 安装成功页面
if (@$_GET['c'] == 'success') {
    // 判断是否为post
    if ($_SERVER['REQUEST_METHOD'] == 'POST') {
        $data = $_POST;
        // 连接数据库
        $link = @new mysqli("{$data['DB_HOST']}:{$data['DB_PORT']}", $data['DB_USER'], $data['DB_PWD']);
        // 获取错误信息
        $error = $link->connect_error;
        if (!is_null($error)) {
            // 转义防止和alert中的引号冲突
            $error = addslashes($error);
            die("<script>alert('数据库链接失败:{$error}');history.go(-1)</script>");
        }
        // 设置字符集
        $link->query("SET NAMES 'utf8'");
        $link->server_info > 5.0 or die("<script>alert('请将您的mysql升级到5.0以上');history.go(-1)</script>");
        // 创建数据库并选中
        if (!$link->select_db($data['DB_NAME'])) {
            $create_sql = 'CREATE DATABASE IF NOT EXISTS ' . $data['DB_NAME'] . ' DEFAULT CHARACTER SET utf8;';
            $link->query($create_sql) or die('创建数据库失败');
            $link->select_db($data['DB_NAME']);
        }
        // 导入sql数据并创建表
        $shujuku_str = file_get_contents('./shujuku.sql');
        $sql_array = preg_split("/;[\r\n]+/", str_replace('tpt_', $data['DB_PREFIX'], $shujuku_str));
        foreach ($sql_array as $k => $v) {
            if (!empty($v)) {
                $link->query($v);
            }
        }
        $link->close();
        $db_str = <<<php
<?php
return [
    'type'            => 'mysql',
    'hostname'        => '{$data['DB_HOST']}',
    'database'        => '{$data['DB_NAME']}',
    'username'        => '{$data['DB_USER']}',
    'password'        => '{$data['DB_PWD']}',
    'hostport'        => '3306',
    'prefix'          => '{$data['DB_PREFIX']}',
];
php;
        // 创建数据库链接配置文件
        file_put_contents('../../app/Database.php', $db_str);
        @touch('./install.lock');
    }
    require './success.html';
}
© 2026 GrazzMean