PCTF 神盾局的秘密

最新推荐文章于 2022-09-07 22:10:39 发布

偷一个月亮

最新推荐文章于 2022-09-07 22:10:39 发布

阅读量541

点赞数

分类专栏： CTF PHP

本文为博主原创文章，未经博主允许不得转载，否则追究法律责任。

本文链接：https://blog.youkuaiyun.com/yiqiushi4748/article/details/108355940

版权

CTF 同时被 2 个专栏收录

44 篇文章

订阅专栏

PHP

36 篇文章

订阅专栏

http://web.jarvisoj.com:32768/

文件包含读源码

index.php

<?php

        require_once('shield.php');

        $x = new Shield();

        isset($_GET['class']) && $g = $_GET['class'];

        if (!empty($g)) {

                $x = unserialize($g);

        }

        echo $x->readfile();

?>

shield.php

<?php

        //flag is in pctf.php

        class Shield {

                public $file;

                function __construct($filename = '') {

                        $this -> file = $filename;

                }

                

                function readfile() {

                       if (!empty($this->file) && stripos($this->file,'..')===FALSE  

                       && stripos($this->file,'/')===FALSE && stripos($this->file,'\\')==FALSE) {

                               return @file_get_contents($this->file);

                       }

               }

       }

?>

构造字符串