<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[A86445的博客]]></title><description><![CDATA[]]></description><link>https://blog.youkuaiyun.com/A86445</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; A86445]]></copyright><item><title><![CDATA[解决在Nignx下Thinkphp路由不生效问题]]></title><link>https://blog.youkuaiyun.com/A86445/article/details/142427866</link><guid>https://blog.youkuaiyun.com/A86445/article/details/142427866</guid><author>A86445</author><pubDate>Sun, 22 Sep 2024 01:41:17 +0800</pubDate><description><![CDATA[apache。]]></description><category></category></item><item><title><![CDATA[phpenv apache报错AH00526解决方法]]></title><link>https://blog.youkuaiyun.com/A86445/article/details/142427678</link><guid>https://blog.youkuaiyun.com/A86445/article/details/142427678</guid><author>A86445</author><pubDate>Sun, 22 Sep 2024 01:03:04 +0800</pubDate><description><![CDATA[原因是第一次设置端口我那该死的手设置成了88888，后面设置貌似没生效就一直弹打开apache端口配置文件删了留一个正常文件就ok。]]></description><category></category></item><item><title><![CDATA[Php_Code_challenge18]]></title><link>https://blog.youkuaiyun.com/A86445/article/details/137150337</link><guid>https://blog.youkuaiyun.com/A86445/article/details/137150337</guid><author>A86445</author><pubDate>Fri, 29 Mar 2024 16:50:17 +0800</pubDate><description><![CDATA[strcmp遇到特殊类型数据返回0，MD5函数遇到特殊数据类型会返回0，弱类型可用16进制绕过。]]></description><category></category></item><item><title><![CDATA[Php_Code_challenge17]]></title><link>https://blog.youkuaiyun.com/A86445/article/details/137143533</link><guid>https://blog.youkuaiyun.com/A86445/article/details/137143533</guid><author>A86445</author><pubDate>Fri, 29 Mar 2024 14:11:25 +0800</pubDate><description><![CDATA[get参数名 '_' 用  '[' 绕过几个 下面的使用php伪协议 php://input绕过即可请求内容处写入要求的颜表情。]]></description><category></category></item><item><title><![CDATA[Php_Code_challenge16]]></title><link>https://blog.youkuaiyun.com/A86445/article/details/137139456</link><guid>https://blog.youkuaiyun.com/A86445/article/details/137139456</guid><author>A86445</author><pubDate>Fri, 29 Mar 2024 12:27:45 +0800</pubDate><description><![CDATA[所以科学计数法绕过即可。]]></description><category></category></item><item><title><![CDATA[Php_Code_challenge15]]></title><link>https://blog.youkuaiyun.com/A86445/article/details/137124030</link><guid>https://blog.youkuaiyun.com/A86445/article/details/137124030</guid><author>A86445</author><pubDate>Fri, 29 Mar 2024 10:32:43 +0800</pubDate><description><![CDATA[对'..'进行限制禁止我们包含其他目录下的内容，也就不能对服务器日志及SESSION进行利用，我们对分析代码分析出题人贴心的给我们输出了上传后的文件名及路径，并且利用file_put_contents和file_get_contents进行文件的写入，这是很危险的输出上传文件名加上file_put_contents和file_get_contents的嵌套利用我们可以利用file_get_contents再次读取index.php,并在path写入一句话木马，并包含一句话木马写入path。]]></description><category></category></item><item><title><![CDATA[Php_Code_challenge14]]></title><link>https://blog.youkuaiyun.com/A86445/article/details/137120686</link><guid>https://blog.youkuaiyun.com/A86445/article/details/137120686</guid><author>A86445</author><pubDate>Thu, 28 Mar 2024 18:41:34 +0800</pubDate><description><![CDATA[一道简单的文件包含漏洞，对请求的参数进行文件包含，无任何过滤，我们直接使用php伪协议即可获得flag。里面的转换方式是有很多的不止base64，详细参考大佬博客。]]></description><category></category></item><item><title><![CDATA[Php_Code_challenge13]]></title><link>https://blog.youkuaiyun.com/A86445/article/details/137117554</link><guid>https://blog.youkuaiyun.com/A86445/article/details/137117554</guid><author>A86445</author><pubDate>Thu, 28 Mar 2024 18:24:45 +0800</pubDate><description><![CDATA[并把$str_rands生成的随机数赋值给$_SESSION['whoami'],并，当$_SESSION['nums']的值大于10时输出flag。我们要做的就是让$_SESSION['nums']>10,出题人已经贴心的对随机数进行输出，在这部分我们只需要进行数组绕过就好了。MD5加密会随机生成字母和数字 如果数字开头就寄，所以我们用数组绕过。反复进行十一次就ok。php支持字符串用下标表示字符位置。]]></description><category></category></item><item><title><![CDATA[Php_Code_challenge12]]></title><link>https://blog.youkuaiyun.com/A86445/article/details/137105267</link><guid>https://blog.youkuaiyun.com/A86445/article/details/137105267</guid><author>A86445</author><pubDate>Thu, 28 Mar 2024 11:11:01 +0800</pubDate><description><![CDATA[题目：答案：解析：字符串拼接。]]></description><category></category></item><item><title><![CDATA[Php_Code_challenge11]]></title><link>https://blog.youkuaiyun.com/A86445/article/details/137103717</link><guid>https://blog.youkuaiyun.com/A86445/article/details/137103717</guid><author>A86445</author><pubDate>Thu, 28 Mar 2024 10:37:42 +0800</pubDate><description><![CDATA[匹配到字符数字返回真，没有则返回假，但是前面加了取反，$$代表全局变量。]]></description><category></category></item><item><title><![CDATA[Php_Code_challenge10]]></title><link>https://blog.youkuaiyun.com/A86445/article/details/137098693</link><guid>https://blog.youkuaiyun.com/A86445/article/details/137098693</guid><author>A86445</author><pubDate>Thu, 28 Mar 2024 09:33:11 +0800</pubDate><description><![CDATA[自己出了点问题我在第三行加上了echo post参数（content-type请求体自己给写错了）对传入参数进行过滤，要求不能在1-9中，最后如果弱等于3735929054就echo flag。构造16进制数据进行传参。]]></description><category></category></item><item><title><![CDATA[Php_Code_challenge9]]></title><link>https://blog.youkuaiyun.com/A86445/article/details/137067900</link><guid>https://blog.youkuaiyun.com/A86445/article/details/137067900</guid><author>A86445</author><pubDate>Wed, 27 Mar 2024 16:48:12 +0800</pubDate><description><![CDATA[使用URL编码%0a绕过.]]></description><category></category></item><item><title><![CDATA[Php_Code_challenge8]]></title><link>https://blog.youkuaiyun.com/A86445/article/details/137056871</link><guid>https://blog.youkuaiyun.com/A86445/article/details/137056871</guid><author>A86445</author><pubDate>Tue, 26 Mar 2024 20:42:58 +0800</pubDate><description><![CDATA[过滤了字母数字但是 '$'  、 '_'、  '='、';'、'+'、'{} '、'()'都没过滤可以用webshell自增绕过。]]></description><category></category></item><item><title><![CDATA[Php_Code_challenge7]]></title><link>https://blog.youkuaiyun.com/A86445/article/details/137039292</link><guid>https://blog.youkuaiyun.com/A86445/article/details/137039292</guid><author>A86445</author><pubDate>Tue, 26 Mar 2024 11:02:45 +0800</pubDate><description><![CDATA[第一个if要求我们请求头必须为POST请求第二个if要求POST不为空第三、第四个对GET、POST环境变量名与值进行遍历由于使用的是$$可使用全局变量进行构造GET请求为$$_200=$$flag  与 POST请求构造为 flag=123（任意字符串）访问challenge.txt获得进行构造获得。]]></description><category></category></item><item><title><![CDATA[Php_Code_challenge6]]></title><link>https://blog.youkuaiyun.com/A86445/article/details/137034418</link><guid>https://blog.youkuaiyun.com/A86445/article/details/137034418</guid><author>A86445</author><pubDate>Tue, 26 Mar 2024 09:47:03 +0800</pubDate><description><![CDATA[第一个判断，连接数据库接收POST参数user and  pass,SQL查询有注入漏洞，查询数据库数据库内容放入$row获得该数组pwd参数，参数为true and $pass ==$row[pwd] ,利用SQL注入联合查询返回我们需要的MD5加密密码，user构造为  -1'union select md5(123)#    pass参数构造为123。]]></description><category></category></item><item><title><![CDATA[Php_Code_challenge5]]></title><link>https://blog.youkuaiyun.com/A86445/article/details/137028100</link><guid>https://blog.youkuaiyun.com/A86445/article/details/137028100</guid><author>A86445</author><pubDate>Mon, 25 Mar 2024 22:25:18 +0800</pubDate><description><![CDATA[sha1函数不能加密数组所以返回0，0===0为真。]]></description><category></category></item><item><title><![CDATA[Php_Code_challenge4]]></title><link>https://blog.youkuaiyun.com/A86445/article/details/137027524</link><guid>https://blog.youkuaiyun.com/A86445/article/details/137027524</guid><author>A86445</author><pubDate>Mon, 25 Mar 2024 22:10:16 +0800</pubDate><description><![CDATA[由于eval里面是字符串使用可以使用字符串拼接构造。]]></description><category></category></item><item><title><![CDATA[Php_Code_challenge3]]></title><link>https://blog.youkuaiyun.com/A86445/article/details/137024251</link><guid>https://blog.youkuaiyun.com/A86445/article/details/137024251</guid><author>A86445</author><pubDate>Mon, 25 Mar 2024 21:53:04 +0800</pubDate><description><![CDATA[本题的重点在于substr截取字符串可以被%00截断绕过但是strlen不会，和php伪协议的利用，字符串和整型对比的转换。]]></description><category></category></item><item><title><![CDATA[Php_Code_challenge2]]></title><link>https://blog.youkuaiyun.com/A86445/article/details/137021616</link><guid>https://blog.youkuaiyun.com/A86445/article/details/137021616</guid><author>A86445</author><pubDate>Mon, 25 Mar 2024 19:52:46 +0800</pubDate><description><![CDATA[php中当字符串与整型做比较时会把字符串转为整型0x4f1a00会作为16进制整形符合第一个和第二个if绕过，第三个if犯了一个错误就是用int把参数转为整型，这样会使字符串为0(请参考字符串转整形规则，在php官方文档可以看到，比如 (int)'123a',转为整型为123，a123转为整型为0)所以我们会直接的到flag。]]></description><category></category></item><item><title><![CDATA[DC-2靶机练习]]></title><link>https://blog.youkuaiyun.com/A86445/article/details/136673524</link><guid>https://blog.youkuaiyun.com/A86445/article/details/136673524</guid><author>A86445</author><pubDate>Wed, 13 Mar 2024 20:13:30 +0800</pubDate><description><![CDATA[过程，扫描内网地址、端口，访问端口服务、使用工具对wordpress进行资产收集漏洞攻击，使用弱密码攻击web服务、使用弱密码攻击ssh服务，对-rbash进行绕过，对环境变量进行绕过，使用git进行提权。分析:hosts文件是系统的本地DNS文件记录了ip与域名的关系，我们输入域名时系统会先访问本地hosts文件，如果没有找到才回去访问DNS服务器、9.使用cat提示我们当前shell是-rbash，使用vi查看获得falg3，意思应该是让我们切换到jreey去。5.访问成功，得到flag1和提示。]]></description><category></category></item></channel></rss>