Jump to content
  • Hello visitors, welcome to the Hacker World Forum!

    Red Team 1949  (formerly CHT Attack and Defense Team) In this rapidly changing Internet era, we maintain our original intention and create the best community to jointly exchange network technologies. You can obtain hacker attack and defense skills and knowledge in the forum, or you can join our Telegram communication group to discuss and communicate in real time. All kinds of advertisements are prohibited in the forum. Please register as a registered user to check our usage and privacy policy. Thank you for your cooperation.

    TheHackerWorld Official

Recommended Posts

题目如下:

<?php

highlight_file('source.txt');
echo "<br><br>";

$flag = 'xxxxxxxx';
$giveme = 'can can need flag!';
$getout = 'No! flag.Try again. Come on!';
if(!isset($_GET['flag']) && !isset($_POST['flag'])){
    exit($giveme);
}

if($_POST['flag'] === 'flag' || $_GET['flag'] === 'flag'){
    exit($getout);
}

foreach ($_POST as $key => $value) {
    $$key = $value;
}

foreach ($_GET as $key => $value) {
    $$key = $$value;
}

echo 'the flag is : ' . $flag;

?>

代码分析:

第一个if判断get请求和post请求的参数是否为flag,第二个if判断get请求参数和post请求参数为flag的值是否为flag。综上,代码限制的条件是,要有get和post的请求参数为flag,注意这里这是要求有这个参数而已,没有说参数唯一。其次要求我们参数为flag时其值都不能出现flag。接着分析,第一个foreach是关于post请求的,把参数名赋值给变量key,把参数值赋值给变量value,于是假设参数名为flag,参数值为a,则第一个foreach得到的是:$flag = a。即把变量flag重新赋值为a。同理得到第二个foreach得到的结果:$flag = $a。即变量flag的值为变量a的值。

漏洞利用:

因为最后要输出flag的值,而经过前面的代码又会把flag的值覆盖掉,于是这里解决的问题是:如何让变量flag不被覆盖,原样输出。

前面说了参数可以不为一,所以我们思路是:通过另外一个参数作为变量(假设为a)先获取原来flag的值,然后去获取变量a的值,则能够到达我们获取原来的值的目的。

payload:

GET:a=flag&flag=a

POST:anything(这里post传参不重要)

 

Link to post
Link to comment
Share on other sites

 Share

discussion group

discussion group

    You don't have permission to chat.
    • Recently Browsing   0 members

      • No registered users viewing this page.
    ×
    ×
    • Create New...