[web][buuoj]Ez_bypass

题目

https://buuoj.cn/challenges#[MRCTF2020]Ez_bypass

I put something in F12 for you include 'flag.php'; 
$flag='MRCTF{xxxxxxxxxxxxxxxxxxxxxxxxx}'; 
if(isset($_GET['gg'])&&isset($_GET['id']))
 {
 	 $id=$_GET['id'];
 	  $gg=$_GET['gg'];
 	   if (md5($id) === md5($gg) && $id !== $gg)
 	    {
 	    	 echo 'You got the first step';
 	    	  if(isset($_POST['passwd']))
 	    	   {
 	    	   	 $passwd=$_POST['passwd']; 
 	    	   	 if (!is_numeric($passwd)) 
 	    	   	 {
 	    	   	 	 if($passwd==1234567)
 	    	   	 	  {
 	    	   	 	  	 echo 'Good Job!'; 
 	    	   	 	  	 highlight_file('flag.php'); 
 	    	   	 	  	 die('By Retr_0'); 
 	    	   	 	  }
 	    	   	 	  else 
 	    	   	 	  { 
 	    	   	 	  	echo "can you think twice??"; 
 	    	   	 	  }
 	    	   	} 
 	    	   	else
 	    	   	{ 
 	    	   		echo 'You can not get it !'; 
 	    	   	} 
 	    	} 
 	    	else
 	    	{ 
 	    		die('only one way to get the flag'); 
 	    	} 
 	    } 
 	    else 
 	    { 
 	    	echo "You are not a real hacker!"; 
 	    } 
	} 
	else
	{ 
		die('Please input first'); 
	}	 
}
Please input first

过程

1.MD5()漏洞
md5只不能加密数组，加密数组就会返回空值，空值与空值相等
payload是

?id[]=1&gg[]=2

2.is_numeric漏洞
php编译自动去掉空格
空格%20放在数值后面
payload是

passwd=1234567%20

3.使用火狐浏览器的插件 HackBar Quantum 发送POST

4.回显flag