https://blog.youkuaiyun.com/m0_70819573zh-cnhttps://blog.youkuaiyun.com/https://blog.youkuaiyun.com/m0_70819573/article/details/130957891https://blog.youkuaiyun.com/m0_70819573/article/details/130957891m0_70819573Tue, 30 May 2023 21:48:03 +0800https://blog.youkuaiyun.com/m0_70819573/article/details/130303884https://blog.youkuaiyun.com/m0_70819573/article/details/130303884m0_70819573Sat, 22 Apr 2023 13:40:36 +0800class B __call()通过抓包可以发现base64加密的user cookie。通过payloadpost传参获得flag。1.代开环境，发现一片空白。将零改为一后可以显示源码了。]]>https://blog.youkuaiyun.com/m0_70819573/article/details/130298065https://blog.youkuaiyun.com/m0_70819573/article/details/130298065m0_70819573Fri, 21 Apr 2023 22:22:44 +0800https://blog.youkuaiyun.com/m0_70819573/article/details/130208029https://blog.youkuaiyun.com/m0_70819573/article/details/130208029m0_70819573Mon, 17 Apr 2023 20:41:23 +0800https://blog.youkuaiyun.com/m0_70819573/article/details/130185744https://blog.youkuaiyun.com/m0_70819573/article/details/130185744m0_70819573Sun, 16 Apr 2023 18:53:43 +0800https://blog.youkuaiyun.com/m0_70819573/article/details/130133906https://blog.youkuaiyun.com/m0_70819573/article/details/130133906m0_70819573Thu, 13 Apr 2023 16:48:53 +0800https://blog.youkuaiyun.com/m0_70819573/article/details/130108107https://blog.youkuaiyun.com/m0_70819573/article/details/130108107m0_70819573Wed, 12 Apr 2023 15:27:07 +0800https://blog.youkuaiyun.com/m0_70819573/article/details/130092256https://blog.youkuaiyun.com/m0_70819573/article/details/130092256m0_70819573Tue, 11 Apr 2023 20:08:11 +0800https://blog.youkuaiyun.com/m0_70819573/article/details/130045710https://blog.youkuaiyun.com/m0_70819573/article/details/130045710m0_70819573Sun, 09 Apr 2023 18:43:47 +0800https://blog.youkuaiyun.com/m0_70819573/article/details/130041592https://blog.youkuaiyun.com/m0_70819573/article/details/130041592m0_70819573Sun, 09 Apr 2023 14:29:51 +0800https://blog.youkuaiyun.com/m0_70819573/article/details/130029690https://blog.youkuaiyun.com/m0_70819573/article/details/130029690m0_70819573Sat, 08 Apr 2023 15:56:42 +0800https://blog.youkuaiyun.com/m0_70819573/article/details/129962973https://blog.youkuaiyun.com/m0_70819573/article/details/129962973m0_70819573Tue, 04 Apr 2023 22:10:17 +0800destruct=>Show->__toString=>Test->__get->file_get(),其中__get在类被[]引用时会触发，且$key=source。在查看文件区域发现？file=结果有文件任意读取的漏洞,可以获取相关文件源码。改名上传后用phar://伪协议读取flag。提示flag在f1ag.php里。]]>https://blog.youkuaiyun.com/m0_70819573/article/details/129942751https://blog.youkuaiyun.com/m0_70819573/article/details/129942751m0_70819573Tue, 04 Apr 2023 00:14:02 +0800https://blog.youkuaiyun.com/m0_70819573/article/details/129770527https://blog.youkuaiyun.com/m0_70819573/article/details/129770527m0_70819573Sat, 25 Mar 2023 18:37:45 +0800https://blog.youkuaiyun.com/m0_70819573/article/details/129751596https://blog.youkuaiyun.com/m0_70819573/article/details/129751596m0_70819573Fri, 24 Mar 2023 15:48:12 +0800https://blog.youkuaiyun.com/m0_70819573/article/details/129739172https://blog.youkuaiyun.com/m0_70819573/article/details/129739172m0_70819573Thu, 23 Mar 2023 21:02:37 +0800https://blog.youkuaiyun.com/m0_70819573/article/details/129710754https://blog.youkuaiyun.com/m0_70819573/article/details/129710754m0_70819573Wed, 22 Mar 2023 15:28:52 +0800https://blog.youkuaiyun.com/m0_70819573/article/details/129673771https://blog.youkuaiyun.com/m0_70819573/article/details/129673771m0_70819573Mon, 20 Mar 2023 19:12:50 +0800https://blog.youkuaiyun.com/m0_70819573/article/details/129651065https://blog.youkuaiyun.com/m0_70819573/article/details/129651065m0_70819573Sun, 19 Mar 2023 15:33:41 +0800$template,在extract函数(暗示了可以变量覆盖）之后，调用getTempName方法，$space->$dir,且要求$dir=admin。在listdata中发现危险函数call_user_fuc_array,首先，该函数将system数组化成$param,接着call_user_fuc_array会调用name元素的值执行命令。含有CVE-2021-41773漏洞，可以读取任意位置的文件。用dirsearch可以扫到。]]>https://blog.youkuaiyun.com/m0_70819573/article/details/129574246https://blog.youkuaiyun.com/m0_70819573/article/details/129574246m0_70819573Thu, 16 Mar 2023 00:26:48 +0800