{"id":2001,"date":"2025-02-27T22:57:17","date_gmt":"2025-02-27T14:57:17","guid":{"rendered":"http:\/\/gzxingyu.cloud\/?p=2001"},"modified":"2025-02-27T22:57:18","modified_gmt":"2025-02-27T14:57:18","slug":"nssctf-2022-spring-recruitbabyphp","status":"publish","type":"post","link":"http:\/\/gzxingyu.cloud\/index.php\/2025\/02\/27\/nssctf-2022-spring-recruitbabyphp\/","title":{"rendered":"NSSCTF 2022 Spring Recruitbabyphp"},"content":{"rendered":"

\"Pasted<\/p>\n

\u4e00\u3001\u67e5\u770b\u7f51\u9875<\/h1>\n

\"Pasted<\/p>\n

\u4e8c\u3001\u5206\u6790\u4ee3\u7801<\/h1>\n
<?php   highlight_file(__FILE__);\ninclude_once('flag.php');\nif(isset($_POST['a'])&&!preg_match('\/[0-9]\/',$_POST['a'])&&intval($_POST['a'])){   \u00a0\u00a0\u00a0\u00a0if(isset($_POST['b1'])&&$_POST['b2']){   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if($_POST['b1']!=$_POST['b2']&&md5($_POST['b1'])===md5($_POST['b2'])){   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if($_POST['c1']!=$_POST['c2']&&is_string($_POST['c1'])&&is_string($_POST['c2'])&&md5($_POST['c1'])==md5($_POST['c2'])){\necho\u00a0$flag;   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\n}else{\necho\u00a0"yee";\n}\n}else{\necho\u00a0"nop";\n}\n}else{\necho\u00a0"go\u00a0on";\n}\n}else{\necho\u00a0"let's\u00a0get\u00a0some\u00a0php";\n}\n?>\u00a0let's get some php\n<\/code><\/pre>\n
1.\u7b2c\u4e00\u4e2a\u6761\u4ef6<\/h2>\n
if(isset($_POST['a'])&&!preg_match('\/[0-9]\/',$_POST['a'])&&intval($_POST['a']))<\/code><\/p>\n
    \n
  • POST\u4f20\u53c2a\u4e0d\u4e3a\u7a7a<\/li>\n
  • \u6b63\u5219\u5339\u914d\uff0c\u53c2\u6570a\u4e2d\u4e0d\u80fd\u6709\u6570\u5b57\uff0c\u53ef\u4ee5\u4f7f\u7528\u6570\u7ec4<\/li>\n
  • intval\u8f6c\u6362\u540e\u5fc5\u987b\u662f\u975e\u96f6\u503c<\/li>\n
  • \u7ed5\u8fc7\u65b9\u6cd5\uff1a\u53ef\u4ee5\u4f7f\u7528\u5341\u516d\u8fdb\u5236\uff08\u5982’0xf’\uff09\u6216\u79d1\u5b66\u8ba1\u6570\u6cd5\uff08\u5982’1e3’\uff09<\/li>\n<\/ul>\n
    2.\u7b2c\u4e8c\u4e2a\u6761\u4ef6<\/h2>\n
    if(isset($_POST['b1'])&&$_POST['b2'])<\/code><\/p>\n
      \n
    • b1\u548cb2\u503c\u5b58\u5728<\/li>\n<\/ul>\n
      3.\u7b2c\u4e09\u4e2a\u6761\u4ef6<\/h2>\n
      if($_POST['b1']!=$_POST['b2']&&md5($_POST['b1'])===md5($_POST['b2']))<\/code><\/p>\n
        \n
      • \u9700\u8981\u4e24\u4e2a\u4e0d\u76f8\u7b49\u7684\u53c2\u6570b1\u548cb2<\/li>\n
      • \u5b83\u4eec\u7684MD5\u503c\u5fc5\u987b\u5b8c\u5168\u76f8\u7b49\uff08\u6ce8\u610f\u8fd9\u91cc\u7528\u7684\u662f===<\/code>\uff09\uff0c\u53ef\u4ee5\u6570\u7ec4\u7ed5\u8fc7\uff0c0e\u7ed5\u8fc7<\/li>\n<\/ul>\n
        4.\u7b2c\u56db\u4e2a\u6761\u4ef6<\/h2>\n
        if($_POST['c1']!=$_POST['c2']&&is_string($_POST['c1'])&&is_string($_POST['c2'])&&md5($_POST['c1'])==md5($_POST['c2']))<\/code><\/p>\n
          \n
        • \u9700\u8981\u4e24\u4e2a\u4e0d\u540c\u7684\u5b57\u7b26\u4e32\u53c2\u6570c1\u548cc2<\/li>\n
        • \u5fc5\u987b\u662f\u5b57\u7b26\u4e32\u7c7b\u578b<\/li>\n
        • MD5\u503c\u5fc5\u987b\u76f8\u7b49\uff08\u6ce8\u610f\u8fd9\u91cc\u7528\u7684\u662f==<\/code>\uff09<\/li>\n<\/ul>\n
          \u5f97\u51fa\u7ed3\u679c\uff1a<\/p>\n
          a[]=1&b1[]=1&b2[]=2&c1=QNKCDZO&c2=s878926199a\n<\/code><\/pre>\n
          \u4e09\u3001\u83b7\u53d6flag<\/h1>\n
          \"Pasted<\/p>\n
          \u56db\u3001\u603b\u7ed3<\/h1>\n
            \n
          • \u6570\u7ec4\u7ed5\u8fc7<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
            \u4e00\u3001\u67e5\u770b\u7f51\u9875 \u4e8c\u3001\u5206\u6790\u4ee3\u7801 <?php highlight_file(__FILE__); includ […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,22,23],"tags":[31,33],"class_list":["post-2001","post","type-post","status-publish","format-standard","hentry","category-ctf","category-ctf-web","category-nssctf","tag-php","tag-33"],"_links":{"self":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2001","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=2001"}],"version-history":[{"count":1,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2001\/revisions"}],"predecessor-version":[{"id":2002,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2001\/revisions\/2002"}],"wp:attachment":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=2001"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=2001"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=2001"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}