二、BMZCTF-[easy_php]-[本地复现]-[简单的代码审计]

qwsn

于 2022-01-01 14:26:05 发布

阅读量2.2k

点赞数 1

分类专栏： # 2.PHP代码审计文章标签： php代码审计 BMZCTF-WEB题 addslashes转义绕过 BMZCTF-easy_php

clqwsn

本文链接：https://blog.csdn.net/qq_45555226/article/details/122267354

版权

BMZCTF-easy_php

BMZCTF-[easy_php]-[本地复现]-[简单的代码审计]

1.题目描述

<?php
highlight_file(__FILE__);
error_reporting(0);

function new_addslashes($string) {
   
     if(!is_array($string)) return addslashes($string);
     foreach($string as $key => $val) $string[$key] = new_addslashes($val);
     return $string;
 }
if(!get_magic_quotes_gpc()) {
   
    $_POST = new_addslashes($_POST);
    $_GET = new_addslashes($_GET);
    $_REQUEST = new_addslashes($_REQUEST);
    $_COOKIE = new_addslashes($_COOKIE);
}
if(isset($_POST['sudo'])) {
   
    $file = __DIR__ .'/config.php';
    require $file;
    $key = $_POST['info']['name'];
    if(!isset($LANG[$key])) {
   
        $content = file_get_contents($file);
        $content = substr($content,0,-3);
        $data = $content."\n\$LANG['$key'] = '$_POST[no1]';\n?>";
        file_put_contents($file,$data);
    } elseif(isset($LANG[$key]) && $LANG[$key]!=$_POST['no1']) {
   
        $content = file_get_contents($file);