HSCCTF 2024（WEB方向），万字长文总结网络安全多进程

文章目录

• 1. PWD
• 2. SHIROSHORTMENSHELL
• 3. TMPL
• 4. LOG
• 5. DESERIALIZATION
• 6. checkin

文笔有限，大佬轻喷。

1. PWD

<?php error\_reporting(0); highlight\_file(\_\_FILE\_\_); $con = mysqli\_connect("localhost","root","root","ccut"); function waffff($sql) { if (preg\_match("/infor|sys|sql|thread|case|when|if|like|left|right|mid|cmp|sub|locate|position|match|find|field|sleep|repeat|lock|bench|process|<|>|=|xor|and|&&|\\\\/i", $sql)) { die("hacker"); } } if (isset($\_POST['password'])) { $password = $\_POST['password']; waffff($password); $sql = "SELECT password FROM users WHERE username='admin' and password='$password'"; $user\_result = mysqli\_query($con,$sql); $row = mysqli\_fetch\_array($user\_result); if ($row['password'] === $password) { include "/flag"; } else { echo "error"; } } ?>

关键代码如下：

$password = $_POST[‘password’];
s q l = " S E L E C T p a s s w o r d F R O M u s e r s W H E R E u