2021第五届强网杯部分writewp

第五届强网杯部分题解

web-最后两道是师弟做得
pwn-by-RGDZ

菜鸡简单记录一下本次比赛。持续更新

---

前言

提示：这里不是我一个人打出来的，一个团队，然后可能有些写得不是很清楚，望见谅。

---

提示：以下是本篇文章正文内容，下面案例可供参考

一、Web

1.1Web1 [强网先锋]寻宝

操作过程

看到题目

点击信息1看看

<?php
header('Content-type:text/html;charset=utf-8');
error_reporting(0);
highlight_file(__file__);


function filter($string){
   
        $filter_word = array('php','flag','index','KeY1lhv','source','key','eval','echo','\$','\(','\.','num','html','\/','\,','\'','0000000');
        $filter_phrase= '/'.implode('|',$filter_word).'/';
        return preg_replace($filter_phrase,'',$string);
    }


if($ppp){
   
    unset($ppp);
}
$ppp['number1'] = "1";
$ppp['number2'] = "1";
$ppp['nunber3'] = "1";
$ppp['number4'] = '1';
$ppp['number5'] = '1';

extract($_POST);

$num1 = filter($ppp['number1']);        
$num2 = filter($ppp['number2']);        
$num3 = filter($ppp['number3']);        
$num4 = filter($ppp['number4']);
$num5 = filter($ppp['number5']);    


if(isset($num1) && is_numeric($num1)){
   
    die("非数字");
}

else{
   
  
    if($num1 > 1024){
   
    echo "第一层";
        if(isset($num2) && strlen($num2) <= 4 && intval($num2 + 1) > 500000){
   
            echo "第二层";
            if(isset($num3) && '4bf21cd' === substr(md5($num3),0,7)){
   
                echo "第三层";
                if(!($num4 < 0)&&($num4 == 0)&&($num4 <= 0)&&(strlen($num4) > 6)&&(strlen($num4) < 8)&&isset($num4) ){
   
                    echo "第四层";
                    if(!isset($num5)||(strlen($num5)==0)) die("no");
                    $b=json_decode(@$num5);
                        if($y = $b === NULL){
   
                                if($y === true){
   
                                    echo "第五层";
                                    include 'KeY1lhv.php';
                                    echo $KEY1;
                                }
                        }else{
   
                            die("no");
                        }
                }else{
   
                    die("no");
                }
            }else{
   
                die("no");
            }
        }else{
   
            die("no");
        }
    }else{
   
        die("no111");
    <