DDCTF-web1

CTF

发布日期: 2019-08-20

DDCTF-WEB1

首先观察链接发现可能存在文件包含，且jpg参数是经过一次base16，两次base64加密后的，所以构造payload读取index.php

base64解码后得到index.php

<?php
/*
 * https://blog.csdn.net/FengBanLiuYun/article/details/80616607
 * Date: July 4,2018
 */
error_reporting(E_ALL || ~E_NOTICE);


header('content-type:text/html;charset=utf-8');
if(! isset($_GET['jpg']))
    header('Refresh:0;url=./index.php?jpg=TmpZMlF6WXhOamN5UlRaQk56QTJOdz09');
$file = hex2bin(base64_decode(base64_decode($_GET['jpg'])));
echo '<title>'.$_GET['jpg'].'</title>';
$file = preg_replace("/[^a-zA-Z0-9.]+/","", $file);
echo $file.'</br>';
$file = str_replace("config","!", $file);
echo $file.'</br>';
$txt = base64_encode(file_get_contents($file));

echo "<img src='data:image/gif;base64,".$txt."'></img>";
/*
 * Can you find the flag file?
 *
 */

?>

在index.php源码中博客发现存在practice.txt.swp文件

然后继续使用文件包含读取f1ag!ddctf.php文件，（读取时要将!换成config，因为index.php替换了)

base64解码得到f1ag!ddctf.php文件源码

<?php
include('config.php');
$k = 'hello';
extract($_GET);
if(isset($uid))
{
    $content=trim(file_get_contents($k));
    if($uid==$content)
    {
        echo $flag;
    }
    else
    {
        echo'hello';
    }
}

?>

很明显变量覆盖，构造payload，得到flag.