\u4f7f<\/mi><\/math><\/mjx-assistive-mml><\/mjx-container>_SERVER[‘PHP_SELF’]\u4e3a******\/utils.php\uff0c\u6700\u540ebasename\u8fd9\u4e2a\u503c\u5c31\u4f1a\u4e3autils.php\u518d\u7136\u540e\u5c31highlight_file\u8bfb\u53d6\u5230\u6587\u4ef6\u3002<\/p>\n\u6240\u4ee5\u6211\u4eec\u8981\u60f3\u529e\u6cd5\u7ed5\/utils.php\/*$\/i \u4ee5\u53ca\/show_source\/\u8fd9\u4e2a\u6b63\u5219\u5339\u914d\uff0c
\n\u53ea\u8981\u5728\u540e\u9762\u52a0\u4e2a\u975eASCII\u7801\u7684\u4e1c\u897f\u5c31\u53ef\u4ee5\u7ed5\u8fc7\u3002<\/p>\n
\u6240\u4ee5\u6211\u4eec\u7528%88\u6216\u8005\u53ea\u8981\u662f\u53ef\u4ee5\u9020\u6210\u4e71\u7801\u7684url\u7f16\u7801\u5c31\u53ef\u4ee5\u7ed5\u8fc7**\/utils.php\/*$\/i**\u00a0\u6b63\u5219\u5339\u914d\u3002<\/p>\n
\/show_source\/\u7528show[source\u6216\u8005show.source\u7ed5\u8fc7\uff0c\u8fd9\u4e2a\u8bb0\u4f4f\u5373\u53ef\u3002<\/p>\n
paload\uff1a<\/p>\n
\/index.php\/utils.php\/%88?show[source=1\n<\/code><\/pre>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/01\/Pasted-image-20241208104308.png\")
<\/p>\n
\u603b\u7ed3<\/h3>\n\n- \n
\u6587\u4ef6\u5305\u542b<\/p>\n<\/li>\n
- \n
\u6b63\u5219\u7ed5\u8fc7<\/p>\n<\/li>\n
- \n
$_SERVE[\u2018PHP_SELF\u2019]\u00a0\u8bfb\u53d6\u7684\u662f\u5f53\u524d\u6267\u884c\u811a\u672c\u7684\u6587\u4ef6\u540d\uff0c\u610f\u601d\u5c31\u662f\u8bfb\u53d6\u6587\u4ef6\u5939\u4e0b\u7684\u4e00\u4e2a\u6587\u4ef6<\/p>\n<\/li>\n
- \n
$_SERVER[‘REQUEST_URI’]\u662f\u53d6\u5f97\u5f53\u524dURL\u7684 \u8def\u5f84\u5730\u5740<\/p>\n<\/li>\n
- \n
basename()\u51fd\u6570\u8fd4\u56de\u8def\u5f84\u4e2d\u7684\u6587\u4ef6\u540d\u90e8\u5206
\n\u8bed\u6cd5\uff1abasename(path,suffix)
\npath \u5fc5\u987b\uff0c\u8def\u5f84
\nsuffix \u53ef\u9009\uff0c\u6587\u4ef6\u6269\u5c55\u540d\uff0c\u5982\u679c\u6587\u4ef6\u6709\u5c31\u4e0d\u4f1a\u663e\u793a\u6269\u5c55\u540d<\/p>\n<\/li>\n
- \n
\/show_source\/\u7528show[source\u6216\u8005show.source\u7ed5\u8fc7<\/p>\n<\/li>\n
- \n
\u6211\u4eec\u7528\u975eASCII\u7801\u7684\u4e1c\u897f\u5982%88\u6216\u8005\u53ea\u8981\u662f\u53ef\u4ee5\u9020\u6210\u4e71\u7801\u7684url\u7f16\u7801\u5c31\u53ef\u4ee5\u7ed5\u8fc7**\/utils.php\/*$\/i**\u00a0\u6b63\u5219\u5339\u914d\u3002<\/p>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
1.\u4ee3\u7801\u5ba1\u8ba1 2.\u524d\u9762\u7684\u4ee3\u7801\u6ca1\u6709\u7528\uff0c\u4e3b\u8981\u770b\u540e\u9762\u7684\u4ee3\u7801 $_SERVE[\u2018PHP_SELF\u2019]\u00a0\u8bfb\u53d6\u7684\u662f\u5f53\u524d\u6267\u884c […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,22,23],"tags":[27,29],"class_list":["post-947","post","type-post","status-publish","format-standard","hentry","category-ctf","category-ctf-web","category-nssctf","tag-27","tag-29"],"_links":{"self":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/947","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=947"}],"version-history":[{"count":1,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/947\/revisions"}],"predecessor-version":[{"id":948,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/947\/revisions\/948"}],"wp:attachment":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=947"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=947"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=947"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/01\/Pasted-image-20241208091515.png\")
<\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/01\/Pasted-image-20241208091451.png\")
<\/p>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/01\/Pasted-image-20241208103741.png\")
<\/p>\n<\/li>\n<\/ul>\n![\"Pasted](\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/01\/Pasted-image-20241208103851.png\")
<\/div>