Download~!

利用burpsuite抓包看看，点击两个下载比对一下，发现它的url是可变的，而且是base64编码

这样的话构造一下download.php的base64编码，放置url运行，得到源码

<?php
error_reporting(0);
include("hereiskey.php");
$url=base64_decode($_GET[url]); if( $url=="hereiskey.php" || $url=="buxiangzhangda.mp3" || $url=="xingxingdiandeng.mp3" || $url=="download.php"){ $file_size = filesize($url); header ( "Pragma: public" ); header ( "Cache-Control: must-revalidate, post-check=0, pre-check=0" ); header ( "Cache-Control: private", false ); header ( "Content-Transfer-Encoding: binary" ); header ( "Content-Type:audio/mpeg MP3"); header ( "Content-Length: " . $file_size); header ( "Content-Disposition: attachment; filename=".$url); echo(file_get_contents($url)); exit; } else { echo "Access Forbidden!"; } ?>

分析源码可知有一个hereiskey.php，构造url提交可得flag

 

转载于:https://www.cnblogs.com/maodun/p/6915736.html