Demonering的博客

题目源码:<?phpif (isset($_GET['cmd'])) { $cmd = $_GET['cmd']; if (!preg_match('/flag/i',$cmd)) { $cmd = escapeshellarg($cmd); system('cat ' . $cmd); }} else { highlight_file(__FILE__);}?>知识点:1.绕过正则2.escap

知识点:任意文件下载解题过程：首先登陆后台/admin.php后台密码为弱密码admin/admindemo/demo登陆后台后进入设计->自定义->右上角导出主题这里的内容随便填写点击保存即可保存后会有一个下载链接复制这个链接进行查看http://37ceca84-9cc8-492f-be5a-e2890d84bef8.node4.buuoj.cn:81/admin.php?m=ui&f=downloadtheme...

知识点：1.ssi注入漏洞相关文献2.脚本编写解题过程1.进入页面后扫描后台发现index.php.swp文件，进入后发现源码<?php ob_start(); function get_hash(){ $chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()+-'; $random = $chars[mt_rand(0,73)].$chars[

知识点：bypass绕过具体绕过：basename(),$_SERVER['PHP_SELF']和正则匹配解题过程：打开source发现源码源码：<?phpinclude'config.php';//FLAGisdefinedinconfig.phpif(preg_match('/config\.php\/*$/i',$_SERVER['PHP_SELF'])){exit("Idon'tknowwhatyouarethinking,...