I spring web upload

According to the prompt , Visit directly first flag.php file

  Looking at the source code, I didn't find anything , So it can only be accessed through file upload flag.php file

Upload the file

Click on the uploaded file , Find out <? and php Filtered , You can't use it directly

  hold php Switch to PHP Continue to upload , Find out PHP Not filtered out ,

So it can be used strtolower Function Dodge php The filter , Change species PHP How to write the code

There is the following code

  Upload again , Open the uploaded file and find flag

 

Try another method , In one sentence

Upload files

Open the Chinese ant sword , Right mouse button , Add data , Copy file location URL, Input password abc

Click Add

Then go in and check, and you'll find flag La