{"id":189,"date":"2026-05-21T19:30:08","date_gmt":"2026-05-21T11:30:08","guid":{"rendered":"https:\/\/asum1.fun\/?p=189"},"modified":"2026-05-21T19:31:35","modified_gmt":"2026-05-21T11:31:35","slug":"buuctf-%e5%ae%89%e6%b4%b5%e6%9d%af-2019easy_web","status":"publish","type":"post","link":"https:\/\/asum1.fun\/index.php\/2026\/05\/21\/buuctf-%e5%ae%89%e6%b4%b5%e6%9d%af-2019easy_web\/","title":{"rendered":"buuctf-[\u5b89\u6d35\u676f 2019]easy_web"},"content":{"rendered":"\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/asum1.fun\/wp-content\/uploads\/2026\/05\/image-37-1024x589.png'><img class=\"lazyload lazyload-style-5\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"589\" data-original=\"https:\/\/asum1.fun\/wp-content\/uploads\/2026\/05\/image-37-1024x589.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-191\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u62ff\u5230\u9898\u76ee\u53d1\u73b0\u4e24\u4e2a\u53c2\u6570\uff0c\u4e00\u4e2aimg\uff0c\u4e00\u4e2acmd\uff0c\u5148cmd=ls\u4e00\u624b<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/asum1.fun\/wp-content\/uploads\/2026\/05\/image-38-1024x588.png'><img class=\"lazyload lazyload-style-5\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"588\" data-original=\"https:\/\/asum1.fun\/wp-content\/uploads\/2026\/05\/image-38-1024x588.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-192\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u5e94\u8be5\u662f\u88ab\u8fc7\u6ee4\u4e86\uff0c\u518d\u770bimg\uff0c\u611f\u89c9\u8fd9\u4e2a\u503c\u50cf\u662fbase64<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/asum1.fun\/wp-content\/uploads\/2026\/05\/image-39-1024x425.png'><img class=\"lazyload lazyload-style-5\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"425\" data-original=\"https:\/\/asum1.fun\/wp-content\/uploads\/2026\/05\/image-39-1024x425.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-193\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u52a0\u4e2a\u7b49\u53f7\u8bd5\u8bd5\uff0c\u5f97\u5230<code>MzUzNTM1MmU3MDZlNjc=<\/code> \u518d\u89e3\u4e00\u6b21\uff0c\u5f97\u5230<code>3535352e706e67<\/code>\uff0c\u8fd9\u662f\u4e00\u4e2a16\u8fdb\u5236\u5b57\u7b26\uff0c\u89e3\u5f00\u5f97\u5230555.png\uff0c\u6211\u4eec\u6309\u7740\u53cd\u65b9\u5411\u64cd\u4f5c\u4e00\u6b21index.php\u6765\u8bfb\u53d6\u5b83\uff0c\u4e00\u6b2116\u8fdb\u5236\u8f6c\u6362\u52a0\u4e24\u6b21base64\u5f97\u5230<code>TmprMlpUWTBOalUzT0RKbE56QTJPRGN3<\/code> \uff0c\u4f20\u56deimg\uff0c\u67e5\u770b\u7f51\u9875\u6e90\u7801\uff0c\u89e3\u5f00base64\u5f97\u5230\u6e90\u7801<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/asum1.fun\/wp-content\/uploads\/2026\/05\/image-40-1024x239.png'><img class=\"lazyload lazyload-style-5\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"239\" data-original=\"https:\/\/asum1.fun\/wp-content\/uploads\/2026\/05\/image-40-1024x239.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-194\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nerror_reporting(E_ALL || ~ E_NOTICE);\nheader('content-type:text\/html;charset=utf-8');\n$cmd = $_GET&#91;'cmd'];\nif (!isset($_GET&#91;'img']) || !isset($_GET&#91;'cmd'])) \n    header('Refresh:0;url=.\/index.php?img=TXpVek5UTTFNbVUzTURabE5qYz0&amp;cmd=');\n$file = hex2bin(base64_decode(base64_decode($_GET&#91;'img'])));\n\n$file = preg_replace(\"\/&#91;^a-zA-Z0-9.]+\/\", \"\", $file);\nif (preg_match(\"\/flag\/i\", $file)) {\n    echo '&lt;img src =\".\/ctf3.jpeg\">';\n    die(\"xixi\uff5e no flag\");\n} else {\n    $txt = base64_encode(file_get_contents($file));\n    echo \"&lt;img src='data:image\/gif;base64,\" . $txt . \"'>&lt;\/img>\";\n    echo \"&lt;br>\";\n}\necho $cmd;\necho \"&lt;br>\";\nif (preg_match(\"\/ls|bash|tac|nl|more|less|head|wget|tail|vi|cat|od|grep|sed|bzmore|bzless|pcre|paste|diff|file|echo|sh|\\'|\\\"|\\`|;|,|\\*|\\?|\\\\|\\\\\\\\|\\n|\\t|\\r|\\xA0|\\{|\\}|\\(|\\)|\\&amp;&#91;^\\d]|@|\\||\\\\$|\\&#91;|\\]|{|}|\\(|\\)|-|&lt;|>\/i\", $cmd)) {\n    echo(\"forbid ~\");\n    echo \"&lt;br>\";\n} else {\n    if ((string)$_POST&#91;'a'] !== (string)$_POST&#91;'b'] &amp;&amp; md5($_POST&#91;'a']) === md5($_POST&#91;'b'])) {\n        echo `$cmd`;\n    } else {\n        echo (\"md5 is funny ~\");\n    }\n}\n\n?>\n&lt;html>\n&lt;style>\n  body{\n   background:url(.\/bj.png)  no-repeat center center;\n   background-size:cover;\n   background-attachment:fixed;\n   background-color:#CCCCCC;\n}\n&lt;\/style>\n&lt;body>\n&lt;\/body>\n&lt;\/html><\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u8fd9\u91cc\u53cd\u5f15\u53f7\u5728php\u4e2d\u76f8\u5f53\u4e8eshell_exec\uff0c\u6240\u4ee5\u9700\u8981\u7ed5\u8fc7\u6b63\u5219\u548cmd5\u5c31\u53ef\u4ee5\u547d\u4ee4\u6267\u884c<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u8fd9\u4e2a\u6b63\u5219\u8fc7\u6ee4\u4e86\u5f88\u591a\u4e1c\u897f\uff0c\u5305\u62ec\\xA0\uff0c\u6240\u4ee5<strong>{IFS}\u00a0<strong>\ud835\udc3c\ud835\udc39\ud835\udc46<\/strong>1<\/strong>\u8fd9\u79cd\u683c\u5f0f\u4e0d\u80fd\u7528\uff0c\u540c\u65f6\u8fd9\u91cc\u7684<code>preg_match(\"\/\u2026|\\|\\\\|\u2026\/i\", $cmd);<\/code> \u5728\u53cc\u5f15\u53f7\u4e2d\uff0c<code>\\\\<\/code>\u00a0\u4f1a\u88ab PHP \u5148\u8f6c\u4e49\u6210<strong>\u4e00\u4e2a\u53cd\u659c\u6760<\/strong>\u00a0<code>\\<\/code>\uff0c<code>\\\\\\\\<\/code>\u00a0\u53d8\u6210<strong>\u4e24\u4e2a\u53cd\u659c\u6760<\/strong>\u00a0<code>\\\\<\/code>\u3002\u4e8e\u662f\u4f20\u7ed9\u6b63\u5219\u5f15\u64ce\u7684\u5b9e\u9645\u6a21\u5f0f\u4e2d\uff0c<code>\\\\|\\\\\\\\<\/code>\u00a0\u53d8\u6210\u4e86\u00a0<code>\\|\\\\<\/code>\uff0c\u5b83\u7684\u610f\u601d\u662f\uff1a\u5339\u914d<strong>\u5b57\u9762\u7ba1\u9053\u7b26\u00a0<code>|<\/code><\/strong>\u00a0\u6216<strong>\u4e24\u4e2a\u8fde\u7eed\u53cd\u659c\u6760\u00a0<code>\\\\<\/code><\/strong>\uff0c\u800c<strong>\u5355\u4e2a\u53cd\u659c\u6760\u5e76\u4e0d\u5728\u9ed1\u540d\u5355\u5185<\/strong>\u3002\u6240\u4ee5\u53ef\u4ee5\u7528\u00a0<code>c\\at<\/code>\u00a0\uff0c\u91cc\u7684\u00a0<code>\\<\/code>\u00a0\u4e0d\u4f1a\u89e6\u53d1\u8fc7\u6ee4\uff0c\u540c\u65f6\u00a0<code>cat<\/code>\u00a0\u8fd9\u4e2a\u5355\u8bcd\u88ab\u00a0<code>\\<\/code>\u00a0\u62c6\u5f00\uff0c\u6b63\u5219\u5339\u914d\u4e0d\u5230\u5b8c\u6574\u7684\u00a0<code>cat<\/code>\uff0c\u6210\u529f\u7ed5\u8fc7\u3002\u6240\u4ee5cmd=c\\at%20\/flag<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728\u7f51\u4e0a\u641c\u4e00\u4e0b\u8fd9\u4e2amd5\u78b0\u649e\u7684\u89e3<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>a=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%00%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%55%5d%83%60%fb%5f%07%fe%a2 &amp;b=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%02%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%d5%5d%83%60%fb%5f%07%fe%a2<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u8bd5\u4e86hackbar\u4f1a\u81ea\u52a8\u7f16\u7801\u4e00\u6b21\uff0c\u6253\u4e0d\u8fc7\u53bb\uff0c\u53ea\u80fd\u7528burp suite\uff0c\u62ff\u5230flag<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/asum1.fun\/wp-content\/uploads\/2026\/05\/image-41-1024x576.png'><img class=\"lazyload lazyload-style-5\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" data-original=\"https:\/\/asum1.fun\/wp-content\/uploads\/2026\/05\/image-41-1024x576.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-195\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u62ff\u5230\u9898\u76ee\u53d1\u73b0\u4e24\u4e2a\u53c2\u6570\uff0c\u4e00\u4e2aimg\uff0c\u4e00\u4e2acmd\uff0c\u5148cmd=ls\u4e00\u624b \u5e94\u8be5\u662f\u88ab\u8fc7\u6ee4\u4e86\uff0c\u518d\u770bimg\uff0c\u611f\u89c9\u8fd9\u4e2a\u503c\u50cf\u662fb [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":181,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-189","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-learn"],"_links":{"self":[{"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/posts\/189","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/comments?post=189"}],"version-history":[{"count":1,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/posts\/189\/revisions"}],"predecessor-version":[{"id":196,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/posts\/189\/revisions\/196"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/media\/181"}],"wp:attachment":[{"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/media?parent=189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/categories?post=189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/asum1.fun\/index.php\/wp-json\/wp\/v2\/tags?post=189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}