【BUUCTF】[Zer0pts2020]Can you guess it?

最新推荐文章于 2024-07-08 12:02:00 发布

aoao今晚吃什么

最新推荐文章于 2024-07-08 12:02:00 发布

阅读量447

点赞数

分类专栏： php

本文链接：https://blog.csdn.net/aoao331198/article/details/125192049

版权

PHP 源码安全文件访问控制 highlight_file 安全校验

关键词由CSDN通过智能技术生成

php 专栏收录该内容

22 篇文章 2 订阅

订阅专栏

源码

<?php
include 'config.php'; // FLAG is defined in config.php

if (preg_match('/config\.php\/*$/i', $_SERVER['PHP_SELF'])) {
  exit("I don't know what you are thinking, but I won't let you read it :)");
}

if (isset($_GET['source'])) {
  highlight_file(basename($_SERVER['PHP_SELF']));
  exit();
}

$secret = bin2hex(random_bytes(64));
if (isset($_POST['guess'])) {
  $guess = (string) $_POST['guess'];
  if (hash_equals($secret, $guess)) {
    $message = 'Congratulations! The flag is: ' . FLAG;
  } else {
    $message = 'Wrong.';
  }
}
?>
<!doctype html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <title>Can you guess it?</title>
  </head>
  <body>
    <h1>Can you guess it?</h1>
    <p>If your guess is correct, I'll give you the flag.</p>
    <p><a href="?source">Source</a></p>
    <hr>
<?php if (isset($message)) { ?>
    <p><?= $message ?></p>
<?php } ?>
    <form action="index.php" method="POST">
      <input type="text" name="guess">
      <input type="submit">
    </form>
  </body>
</html>

想要读取文件只能从这段入手（不知道另外一处有没有办法），正则表达式是表示不能以config.php为结尾

if (preg_match('/config\.php\/*$/i', $_SERVER['PHP_SELF'])) {
  exit("I don't know what you are thinking, but I won't let you read it :)");
}

if (isset($_GET['source'])) {
  highlight_file(basename($_SERVER['PHP_SELF']));
  exit();
}

这里学习一个新知识$_SERVER['PHP_SELF']

$_SERVER[‘PHP_SELF’] 表示当前 php 文件相对于网站根目录的位置地址
http://www.5idev.com/php/index.php/test/foo -->/php/index.php/test/foo

接下来是basename
basename
它有个小问题，它会去掉文件名开头的非ASCII值。

With the default locale setting “C”, basename() drops non-ASCII-chars at the beginning of a filename.

/index.php/config.php/%80?source

aoao今晚吃什么

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
【BUUCTF】[Zer0pts2020]Can you guess it?

源码想要读取文件只能从这段入手（不知道另外一处有没有办法），正则表达式是表示不能以config.php为结尾这里学习一个新知识接下来是basename它有个小问题，它会去掉文件名开头的非ASCII值。PL...
复制链接

扫一扫

专栏目录