buuctf-Ez_bypass

 把代码整理一下，以便更好分析

I put something in F12 for you include 'flag.php'; 
$flag='MRCTF{xxxxxxxxxxxxxxxxxxxxxxxxx}'; 
if(isset($_GET['gg'])&&isset($_GET['id'])) {
     $id=$_GET['id']; $gg=$_GET['gg']; 
    if (md5($id) === md5($gg) && $id !== $gg) { 
        echo 'You got the first step'; 
        if(isset($_POST['passwd'])) { 
            $passwd=$_POST['passwd']; 
            if (!is_numeric($passwd)) {
                if($passwd==1234567) { 
                    echo 'Good Job!'; 
                    highlight_file('flag.php'); 
                    die('By Retr_0'); 
                } 
                else {
                    echo "can you think twice??"; 
                } 
            } 
        else{ echo 'You can not get it !'; } 
        } else{ 
            die('only one way to get the flag'); } 
    } else { 
        echo "You are not a real hacker!"; } 
} 
else{ die('Please input first'); } 
Please input first

需要传入三个参数，gg,id,passwd

md5($id) === md5($gg) && $id !== $gg

可以利用md5的漏洞用数组绕过

passwd弱比较为1234567，但是不能是数字，加个a就行

?gg[]=1a&id[]=2b
POST:passwd=1234567a