醉梦半醒的博客

bugku的一道题

字数统计: 198阅读时长: 1 min
2018/06/21 Share

 

if(!$_GET['id'])
{
header('Location: hello.php?id=1');
exit();
}
$id=$_GET['id'];
$a=$_GET['a'];
$b=$_GET['b'];
if(stripos($a,'.'))
{
echo 'no no no no no no no';
return ;
}
$data = @file_get_contents($a,'r');
if($data=="bugku is a nice plateform!" and $id==0 and strlen($b)>5 and eregi("111".substr($b,0,1),"1114") and substr($b,0,1)!=4)
{
require("f4l2a3g.txt");
}
else
{
print "never never never give up !!!";
}

1.最简单的id==0 用0==字符串绕过

2.
$data = @file_get_contents($a,’r’);
$data==”bugku is a nice plateform!”

这个利用了file_get_contents的特性,当用到php://input的时候,file_get_contents支持字节流输入,只要将a设为php://input,且post过去bugku is a nice plateform!即可

3.strlen($b)>5 and eregi(“111”.substr($b,0,1),”1114”) and substr($b,0,1)!=4

strlen对%00不截断,而eregi对%00截断,只要构造b=%00+大于4位的串即可

Tip:我会告诉你直接require就行?

CATALOG