{"id":475,"date":"2024-01-15T19:59:19","date_gmt":"2024-01-15T11:59:19","guid":{"rendered":"https:\/\/blog.taiyang.space\/?p=475"},"modified":"2024-01-17T20:00:51","modified_gmt":"2024-01-17T12:00:51","slug":"ctfshow-web-web3","status":"publish","type":"post","link":"https:\/\/blog.taiyang.space\/?p=475","title":{"rendered":"CTFSHOW-Web-web3"},"content":{"rendered":"

<\/p>\n

1. \u9898\u76ee\u63cf\u8ff0<\/h1>\n

\u9898\u76ee\u94fe\u63a5\uff1a\u6233\u6211\ud83d\udc8b<\/a><\/p>\n

2. \u89e3\u9898\u8fc7\u7a0b<\/h1>\n

\u6253\u5f00\u5bb9\u5668\u770b\u5230\u754c\u9762\u5982\u4e0b\uff1a<\/p>\n

\"img\"<\/p>\n

\u770b\u51fa\u6765\u662f php \u4f2a\u534f\u8bae<\/p>\n

\u6d4b\u8bd5\u4e0b\uff1a\u5728\u6d4f\u89c8\u5668\u8f93\u5165\uff1ahttp:\/\/b612a756-a075-4f33-ae9a-004b5f8ab4ce.challenge.ctf.show\/?url=\/etc\/passwd<\/code><\/p>\n

\"img\"<\/p>\n

\u679c\u7136\u662f php \u4f2a\u534f\u8bae<\/p>\n

\u6253\u5f00 burp\uff0c\u8bbe\u7f6e\u597d\u4ee3\u7406\uff0c\u51c6\u5907\u6293\u5305<\/p>\n

GET \u8bf7\u6c42\uff1a?url=php:\/\/input<\/code><\/p>\n

\u5728\u8bf7\u6c42\u4f53\u52a0\u4e0a\uff1a<?php system ("ls");?><\/code><\/p>\n

\"img\"<\/p>\n

\u53ef\u4ee5\u770b\u5230\u6709\u4e00\u4e2a cat_go_go index.php \u7684\u6587\u4ef6<\/p>\n

\u518d\u6b21\u6293\u5305<\/p>\n

\"img\"<\/p>\n

\u83b7\u5f97 flag\uff1actfshow{56daa016-cf60-4a53-a0c7-89e49aba5772}<\/code><\/p>\n

3. \u6240\u9700\u5de5\u5177<\/h1>\n