每日作业

最新推荐文章于 2022-08-29 11:20:00 发布

摊煎饼

最新推荐文章于 2022-08-29 11:20:00 发布

阅读量353

点赞数

本文链接：https://blog.csdn.net/qq_39936993/article/details/79230697

版权

Getshell

后缀名黑名单检测和类型检测
php别名：php2, php3, php4, php5, phps, pht, phtm, phtml

Content-Type的值大小写绕过

Flag.php

根据提示 http://120.24.86.145:8002/flagphp/?hint=0可以看到源码

<?php
error_reporting(0);
include_once("flag.php");
$cookie = $_COOKIE['ISecer'];
if(isset($_GET['hint'])){
    show_source(__FILE__);
}
elseif (unserialize($cookie) === "$KEY")
{
    echo "$flag";
}
else {
?>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Login</title>
<link rel="stylesheet" href="admin.css" type="text/css">
</head>
<body>
<br>
<div class="container" align="center">
  <form method="POST" action="#">
    <p><input name="user" type="text" placeholder="Username"></p>
    <p><input name="password" type="password" placeholder="Password"></p>
    <p><input value="Login" type="button"/></p>
  </form>
</div>
</body>
</html>

<?php
}
$KEY='ISecer:www.isecer.com';
?>