[wp] 攻防世界-web2

进来就是代码审计:

<?php 
$miwen="a1zLbgQsCESEIqRLwuQAyMwLyq2L5VwBxqGA3RQAyumZ0tmMvSGM2ZwB4tws"; 

function encode($str){ 
    $_o=strrev($str); 
    // echo $_o; 
         
    for($_0=0;$_0<strlen($_o);$_0++){ 
        
        $_c=substr($_o,$_0,1); 
        $__=ord($_c)+1; 
        $_c=chr($__); 
        $_=$_.$_c;    
    }  
    return str_rot13(strrev(base64_encode($_))); 
} 

highlight_file(__FILE__); 
/* 
   逆向加密算法，解密$miwen就是flag 
*/ 
?> 

写了个脚本就出来了2333:

<?php 
$miwen = "a1zLbgQsCESEIqRLwuQAyMwLyq2L5VwBxqGA3RQAyumZ0tmMvSGM2ZwB4tws";
function decode($str){ 
    $_ = base64_decode(strrev(str_rot13($str)));
    
    for($_0=0;$_0<strlen($_);$_0++){ 
        
        $_c = substr($_,$_0,1); 
        $__ = ord($_c)-1; 
        $_c = chr($__); 
        $_o = $_o.$_c;    
    } 
    
    return strrev($_o);
}
$flag = decode($miwen);
echo $flag;
// flag:{NSCTF_b73d5adfb819c64603d7237fa0d52977
?>

没啥好说的emmm,算签到吧