拐弯抹角

来源：互联网发布：dem软件编辑：程序博客网时间：2024/04/29 07:13

http://www.shiyanbar.com/ctf/1846
拐弯抹角
如何欺骗服务器，才能拿到Flag？
格式：CTF{}
解题链接： http://ctf5.shiyanbar.com/10/indirection/
解：

<?php // code by SEC@USTC echo '<html><head><meta http-equiv="charset" content="gbk"></head><body>'; $URL = $_SERVER['REQUEST_URI']; //echo 'URL: '.$URL.'<br/>'; $flag = "CTF{???}"; $code = str_replace($flag, 'CTF{???}', file_get_contents('./index.php')); $stop = 0; //ÕâµÀÌâÄ¿±¾ÉíÒ²ÓÐ½ÌÑ§µÄÄ¿µÄ //µÚÒ»£¬ÎÒÃÇ¿ÉÒÔ¹¹Ôì /indirection/a/../ /indirection/./ µÈµÈÕâÒ»ÀàµÄ //ËùÒÔ£¬µÚÒ»¸öÒªÇó¾ÍÊÇ²»µÃ³öÏÖ ./ if($flag && strpos($URL, './') !== FALSE){     $flag = "";     $stop = 1;        //Pass } //µÚ¶þ£¬ÎÒÃÇ¿ÉÒÔ¹¹Ôì \ À´´úÌæ±»¹ýÂËµÄ / //ËùÒÔ£¬µÚ¶þ¸öÒªÇó¾ÍÊÇ²»µÃ³öÏÖ ../ if($flag && strpos($URL, '\\') !== FALSE){     $flag = "";     $stop = 2;        //Pass } //µÚÈý£¬ÓÐµÄÏµÍ³´óÐ¡Ð´Í¨ÓÃ£¬ÀýÈç indirectioN/ //ÄãÒ²¿ÉÒÔÓÃ?ºÍ#µÈµÈµÄ×Ö·ûÈÆ¹ý£¬ÕâÐèÒªÍ³Ò»½â¾ö //ËùÒÔ£¬µÚÈý¸öÒªÇó¶Ô¿ÉÒÔÓÃµÄ×Ö·û×öÁËÏÞÖÆ£¬a-z / ºÍ . $matches = array(); preg_match('/^([0-9a-z\/.]+)$/', $URL, $matches); if($flag && empty($matches) || $matches[1] != $URL){     $flag = "";     $stop = 3;        //Pass } //µÚËÄ£¬¶à¸ö / Ò²ÊÇ¿ÉÒÔµÄ //ËùÒÔ£¬µÚËÄ¸öÒªÇóÊÇ²»µÃ³öÏÖ // if($flag && strpos($URL, '//') !== FALSE){     $flag = "";     $stop = 4;        //Pass } //µÚÎå£¬ÏÔÈ»¼ÓÉÏindex.php»òÕß¼õÈ¥index.php¶¼ÊÇ¿ÉÒÔµÄ //ËùÒÔÎÒÃÇÏÂÒ»¸öÒªÇó¾ÍÊÇ±ØÐë°üº¬/index.php£¬²¢ÇÒÒÔ´Ë½áÎ² if($flag && substr($URL, -10) !== '/index.php'){     $flag = "";     $stop = 5;        //Not Pass } //µÚÁù£¬ÎÒÃÇÖªµÀÔÚindex.phpºóÃæ¼Ó.Ò²ÊÇ¿ÉÒÔµÄ //ËùÒÔÎÒÃÇ½ûÖ¹pºóÃæ³öÏÖ.Õâ¸ö·ûºÅ if($flag && strpos($URL, 'p.') !== FALSE){     $flag = "";     $stop = 6;        //Not Pass } //µÚÆß£¬ÏÖÔÚÊÇ×î¹Ø¼üµÄÊ±¿Ì //ÄãµÄ$URL±ØÐëÓë/indirection/index.phpÓÐËù²»Í¬ if($flag && $URL == '/indirection/index.php'){     $flag = "";     $stop = 7;        //Not Pass } if(!$stop) $stop = 8; echo 'Flag: '.$flag; echo '<hr />'; for($i = 1; $i < $stop; $i++)     $code = str_replace('//Pass '.$i, '//Pass', $code); for(; $i < 8; $i++)     $code = str_replace('//Pass '.$i, '//Not Pass', $code); echo highlight_string($code, TRUE); echo '</body></html>';

mixed str_replace ( mixed $search , mixed $replace , mixed $subject [, int &$count ] )
该函数返回一个字符串或者数组。该字符串或数组是将 subject 中全部的 search 都被 replace 替换之后的结果。

$code = str_replace($flag, 'CTF{???}', file_get_contents('./index.php'));所以从这句话就知道结果
在url后面添加/index.php
得到Flag: CTF{PSEDUO_STATIC_DO_YOU_KNOW}

阅读全文

1 0