{"id":150,"date":"2022-05-16T21:21:56","date_gmt":"2022-05-16T13:21:56","guid":{"rendered":"http:\/\/162.14.82.114\/?p=150"},"modified":"2022-05-16T21:21:56","modified_gmt":"2022-05-16T13:21:56","slug":"bugku-web1","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/150\/05\/16\/2022\/","title":{"rendered":"BugKu–WEB(1)"},"content":{"rendered":"

BugKu\u7684\u5e73\u53f0web\u4e13\u533a<\/h1>\n

Simple_SSTI_1<\/h2>\n

\"image-20220221134941852\"<\/div><\/p>\n

\u6839\u636e\u9898\u76ee\u540d\u5f97\u77e5\u4e3a\u7b80\u5355\u670d\u52a1\u5668\u6a21\u677f\u6ce8\u5165\u3002<\/p>\n

\n

\u670d\u52a1\u5668\u7aef\u6a21\u677f\u6ce8\u5165\u662f\u6307\u653b\u51fb\u8005\u80fd\u591f\u4f7f\u7528\u672c\u673a\u6a21\u677f\u8bed\u6cd5\u5c06\u6076\u610f\u6709\u6548\u8d1f\u8f7d\u6ce8\u5165\u6a21\u677f\u4e2d\uff0c\u7136\u540e\u5728\u670d\u52a1\u5668\u7aef\u6267\u884c\u8be5\u6a21\u677f\u3002<\/p>\n

\u8be6\u60c5\u53ef\u4ee5\u53c2\u8003\uff1aSSTI\uff08 \u670d\u52a1\u5668\u6a21\u677f\u6ce8\u5165)\u4ee5\u53ca\u5e38\u89c1\u5229\u7528\u65b9\u5f0f<\/a><\/p>\n

\u670d\u52a1\u7aef\u6a21\u677f\u6ce8\u5165\u653b\u51fb<\/a><\/p>\n

\u7ec6\u8bf4\u670d\u52a1\u5668\u7aef\u6a21\u677f\u6ce8\u5165\uff08SSTI\uff09<\/a><\/p>\n<\/blockquote>\n

\u6253\u5f00\u73af\u5883\u5f97\u77e5\u9700\u8981\u4f20\u5165\u4e00\u4e2a\u540d\u4e3a flag \u7684\u53c2\u6570\uff0c\u518d F12 \u770b\u4e00\u4e0b\uff0cflag\u5728secret_key<\/code>\u4e0b\u3002<\/p>\n

\n

flask<\/code>\uff1a\u662f\u7531python\u5b9e\u73b0\u7684\u4e00\u79cd\u5faeweb\u6846\u67b6 <\/p>\n

SECRET_KEY<\/code>\uff1aflask\u4e2d\u7684\u4e00\u79cd\u914d\u7f6e\u5c5e\u6027\uff0cflask\u6d89\u53ca\u5b89\u5168\u7684\u4e1c\u897f\u9700\u8981\u7528SECRET_KEY\u5bc6\u94a5\u8fdb\u884c\u52a0\u5bc6\u3002<\/p>\n<\/blockquote>\n

\u5728 url \u540e\u9762\u589e\u52a0==\/?flag={{config.SECRET_KEY}}==\u5c31\u884c\uff0c\u53ef\u4ee5\u987a\u5229\u5f97\u5230 flag \u3002<\/p>\n

Simple_SSTI_2<\/h2>\n

\"image-20220221142654101\"<\/div><\/p>\n

\u6253\u5f00\u73af\u5883\u663e\u793a\u5982\u4e0b\uff1a<\/p>\n

\"image-20220221142942014\"<\/div><\/p>\n

\u6d4b\u4e00\u4e0b\u6a21\u677f\u6ce8\u5165\u662f\u5426\u56de\u663e\uff1a<\/p>\n

\"image-20220221143125676\"<\/div><\/p>\n

\u6b63\u5e38\u56de\u663e\uff0c\u8bf4\u660e\u5b58\u5728\u6a21\u677f\u6ce8\u5165\u6f0f\u6d1e\uff0c\u624b\u5de5\u6d4b\u8bd5\u4e00\u4e0b\uff1a<\/p>\n

==payload\uff1a?flag={ {''.class<\/strong>.mro<\/strong>}}==<\/p>\n

\n

__class__<\/code>\u662f\u8fd4\u56de\u7c7b\u578b\u6240\u5c5e\u7684\u5bf9\u8c61\uff0c==''.class<\/strong>==\u8fd9\u4e00\u6b65\u5c31\u662f\u4e3a\u4e86\u83b7\u53d6\u5b57\u7b26\u4e32\u7684\u7c7b\u5bf9\u8c61<\/p>\n

__mro__<\/code>\u5c5e\u6027\u4f1a\u8f93\u51fa\u5f53\u524d\u5bf9\u8c61\u6240\u8c03\u7528\u7684\u5168\u90e8\u7c7b\u5305\u62ec\u5176\u7236\u7c7b<\/p>\n

__subclasses__\u5c5e\u6027<\/code>\u4f1a\u8f93\u51fa\u8be5\u7c7b\u4e0b\u6240\u6709\u7684\u5b50\u7c7b<\/p>\n

__base__<\/code> \u8fd4\u56de\u8be5\u5bf9\u8c61\u6240\u7ee7\u627f\u7684\u57fa\u7c7b<\/p>\n

__init__<\/code> \u7c7b\u7684\u521d\u59cb\u5316\u65b9\u6cd5
\n__globals__<\/code> \u5bf9\u5305\u542b\u51fd\u6570\u5168\u5c40\u53d8\u91cf\u7684\u5b57\u5178\u7684\u5f15\u7528<\/p>\n<\/blockquote>\n

ls \u67e5\u770b\u4e00\u4e0b\uff1a<\/p>\n

\/?flag={{ config.__class__.__init__.__globals__['os'].popen('ls ..\/').read() }}<\/code><\/pre>\n
\"image-20220221145043481\"<\/div><\/p>\n
\u518d\u67e5\u770b\u4e00\u4e0b flag \u4f4d\u7f6e\uff1a<\/p>\n
?flag={{ config.__class__.__init__.__globals__['os'].popen('find \/ -name flag').read() }}<\/code><\/pre>\n
\"image-20220221145624740\"<\/div><\/p>\n
cat \u4e00\u4e0b flag\uff1a<\/p>\n
?flag={{ config.__class__.__init__.__globals__['os'].popen('cat \/app\/flag').read() }}<\/code><\/pre>\n
\"image-20220221145821360\"<\/div><\/p>\n
\u5f97\u5230 flag\u3002<\/p>\n
==PS\uff1a\u8fd9\u91cc\u4ecb\u7ecd\u4e00\u4e2aSSTl\u6f0f\u6d1e\u7684\u626b\u63cf\u5229\u7528\u5de5\u5177tplmap==<\/p>\n
\u8be6\u60c5\u53ef\u4ee5\u770b https:\/\/github.com\/epinna\/tplmap<\/a><\/p>\n
Flask_FileUpload<\/h2>\n
\"image-20220221160604364\"<\/div><\/p>\n
\u6839\u636e\u9898\u76ee\u63d0\u793a\u662f\u4e00\u4e2a\u6587\u4ef6\u4e0a\u4f20<\/code>\uff1a<\/p>\n
\"image-20220221162828840\"<\/div><\/p>\n
\u53ef\u4ee5\u770b\u51fa\uff0c\u5199\u4e00\u4e2a\u811a\u672c\u4e0a\u4f20\uff0c\u5c31\u4f1a\u8fd4\u56de\u811a\u672c\u6267\u884c\u7ed3\u679c\uff0c\u4f46\u662f\u53ea\u80fd\u4e0a\u4f20.jpg\u6216.png<\/code>\u6587\u4ef6\u3002<\/p>\n
import os\nos.system('cat \/flag')<\/code><\/pre>\n
\u4e0a\u4f20\uff1a<\/p>\n
\"image-20220221163104844\"<\/div>
\n
\"image-20220221163052541\"<\/div><\/p>\n
\u5f97\u5230 flag  <\/p>\n
\u6ed1\u7a3d<\/h2>\n
\"image-20220221163246674\"<\/div><\/p>\n
\u6ed1\u7a3d\uff1f\uff1f\uff1f\uff1f
<\/div> 
<\/div><\/p>\n
\u674e\u5927\u94fa\u4e86\u5c5e\u4e8e\u662f\u3002\u6253\u5f00\u73af\u5883\uff1a<\/p>\n
\"image-20220221163940727\"<\/div><\/p>\n
\u8fd8\u771f\u662f\u6ed1\u7a3d\u3002\u3002\u3002\u3002F12 \u770b\u4e00\u4e0b\uff1a<\/p>\n
\"image-20220221164028450\"<\/div><\/p>\n
\u597d\u5bb6\u4f19\uff0cget flag\uff1a<\/p>\n
\u8ba1\u7b97\u5668<\/h2>\n
\"image-20220221164155006\"<\/div><\/p>\n
\u6253\u5f00\u73af\u5883\uff0c\u53ef\u4ee5\u770b\u5230\uff1a<\/p>\n
\"image-20220221164222043\"<\/div><\/p>\n
\u7b54\u6848\u4e0d\u5c31\u662f 91 \u5417\uff1f\u5c31\u8fd9\uff1f<\/del>
<\/div><\/p>\n
\u88c2\u5f00\u4e86\uff0c\u53ea\u80fd\u8f93\u5165\u4e00\u4e2a\u6570\u5b57\u3002\u3002\u3002\u3002<\/p>\n
\"image-20220221164455451\"<\/div><\/p>\n
F12 \u770b\u5230\u53ea\u80fd\u8f93\u5165\u4e00\u4e2a\u6570\u5b57\uff0c\u4fee\u6539\u4e00\u4e0b\u8bd5\u8bd5\uff1a<\/p>\n
\"image-20220221164544680\"<\/div><\/p>\n
nice\uff0c\u641e\u5230 flag \u4e86\uff01<\/p>\n
GET<\/h2>\n
\"image-20220221170928702\"<\/div><\/p>\n
\u6253\u5f00\u73af\u5883\uff1a<\/p>\n
$what=$_GET['what'];\necho $what;\nif($what=='flag')\necho 'flag{****}';<\/code><\/pre>\n
\u4ee3\u7801\u5ba1\u8ba1\u4e00\u4e0b\uff0c\u9700\u8981 get \u53d1\u9001\u4e00\u4e2a flag \u5c31\u884c\u4e86\u3002<\/p>\n
\"image-20220221171153095\"<\/div><\/p>\n
\u63d0\u4ea4 flag \u5c31\u884c\u4e86\uff01<\/p>\n
POST<\/h2>\n
\"image-20220221171435848\"<\/div><\/p>\n
\u6253\u5f00\u73af\u5883\u53ef\u77e5\uff1a<\/p>\n
$what=$_POST['what'];\necho $what;\nif($what=='flag')\necho 'flag{****}';<\/code><\/pre>\n
\u4ee3\u7801\u5ba1\u8ba1\u4e00\u4e0b\uff0c\u53ef\u77e5\u4ee5 POST \u65b9\u6cd5\u4f20\u9012\u4e00\u4e2a flag \u53c2\u6570\u5c31\u80fd\u5f97\u5230 flag\u3002<\/p>\n
\"image-20220221171813348\"<\/div><\/p>\n
\u501f\u52a9 hackbar<\/code> \u63d2\u4ef6\u63d0\u4ea4post<\/code>\u53c2\u6570\u5f97\u5230 flag\u3002<\/p>\n
\u77db\u76fe<\/h2>\n
\"image-20220221171940478\"<\/div><\/p>\n
\u6253\u5f00\u73af\u5883\u53ef\u4ee5\u770b\u5230\uff1a<\/p>\n
$num=$_GET['num'];\nif(!is_numeric($num))\n{\necho $num;\nif($num==1)\necho 'flag{**********}';\n}<\/code><\/pre>\n
\u9898\u76ee\u8981\u6c42\u4ee5 GET \u65b9\u5f0f\u63d0\u4ea4\u4e00\u4e2a\u53c2\u6570\uff0c\u53c2\u6570\u4e0d\u80fd\u4e3a\u6570\u5b57\u4e14\u4e3a1\uff0c\u8003\u5bdf\u7684\u662f php \u5f31\u7c7b\u578b\uff0c\u968f\u4fbf\u6784\u9020\u4e00\u4e2a\u5c31\u884c\u4e86\uff0c\u62fc\u63a5\u5b57\u7b26\u4e32\u3001\u516c\u5f0f\u7b49\u90fd\u884c\u3002<\/p>\n
\"image-20220221172651257\"<\/div><\/p>\n
\u987a\u5229\u5f97\u5230flag\u3002<\/p>\n
\"image-20220221172835939\"<\/div><\/p>\n
\u6253\u5f00\u73af\u5883\uff1a<\/p>\n
\"image-20220221173506672\"<\/div>
\n
\"image-20220221173520569\"<\/div><\/p>\n
\u65e0\u6cd5\u53f3\u952e\uff0c\u4f46\u662f F12<\/code> \u548c Ctrl+U<\/code>\u53ef\u4ee5\u4f7f\u7528\u3002<\/p>\n
\u53ef\u4ee5\u770b\u5230\u6e90\u4ee3\u7801\uff1a<\/p>\n
<html>  \n<head>  \n<title>BKCTF-WEB6<\/title>  \n<script language="javascript">   \nalert("flag\u5c31\u5728\u8fd9\u91cc");  \nalert("\u6765\u627e\u627e\u5427"); \n<!-- &#102;&#108;&#97;&#103;&#123;&#48;&#99;&#52;&#101;&#97;&#49;&#54;&#99;&#102;&#57;&#49;&#52;&#101;&#50;&#98;&#99;&#54;&#56;&#48;&#51;&#55;&#52;&#54;&#102;&#97;&#50;&#100;&#56;&#102;&#100;&#57;&#101;&#125; --><\/script>  \n<\/head>  \n<\/html> <\/code><\/pre>\n
\u5f88\u660e\u663e\u6700\u540e\u4e00\u6bb5\u7684\u7f16\u7801\u4e0e flag \u6709\u5173\uff0c\u4f7f\u7528Unicode\u7f16\u7801\u8f6c\u6362- \u7ad9\u957f\u5de5\u5177<\/a>\u5c06 Unicode \u8f6c ASCII\u3002<\/p>\n
\"image-20220221174303022\"<\/div><\/p>\n
\u5f53\u7136\u4e5f\u53ef\u4ee5\u76f4\u63a5\u5c06\u7f16\u7801\u653e\u5230\u4e00\u4e2ahtml\u6587\u4ef6\uff0c\u7528\u6d4f\u89c8\u5668\u6253\u5f00\u4e5f\u53ef\u4ee5\u3002 <\/p>\n
\"image-20220221174636307\"<\/div><\/p>\n
\u4f60\u5fc5\u987b\u8ba9\u4ed6\u505c\u4e0b<\/h2>\n
\"image-20220221174931490\"<\/div><\/p>\n
\u6253\u5f00\u73af\u5883\uff0c\u53d1\u73b0\u7f51\u9875\u4e0d\u505c\u7684\u5728\u5237\u65b0\uff1a<\/p>\n
\"image-20220221182032373\"<\/div><\/p>\n
\u67e5\u770b\u4e00\u4e0b\u6e90\u7801\uff1a<\/p>\n
<html>\n<head>\n<meta charset="utf-8">\n<meta name="viewport" content="width=device-width, initial-scale=1.0">\n<meta name="description" content="">\n<meta name="author" content="">\n<title>Dummy game<\/title>\n<\/head>\n\n<script language="JavaScript">\nfunction myrefresh(){\nwindow.location.reload();\n}\nsetTimeout('myrefresh()',500); \n<\/script>\n<body>\n<center><strong>I want to play Dummy game with others\u00a3\u00a1But I can't stop!<\/strong><\/center>\n<center>Stop at panda ! u will get flag<\/center>\n<center><div><img src="12.jpg" \/><\/div><\/center><br><a style="display:none">flag is here~<\/a><\/body>\n<\/html><\/code><\/pre>\n
\u6253\u5f00burpsuite<\/code>\uff0c\u62e6\u5305\uff1a<\/p>\n
<\/div><\/p>\n
\u53d1\u9001\u5230\u91cd\u53d1\u5668\uff1a<\/p>\n
\"image-20220221181546106\"<\/div><\/p>\n
\u4e0d\u65ad\u7684\u91cd\u53d1\uff0c\u89c2\u5bdf\u8fd4\u56de\uff1a<\/p>\n
\"image-20220221181739512\"<\/div><\/p>\n
\u5f53 src =\u201c10.jpg\u201d<\/code>\u65f6\uff0c\u5f97\u5230 flag\uff0c\u6709\u70b9\u62fc\u8fd0\u6c14\u548c\u773c\u529b\u3002<\/p>\n
\u8fd9\u91cc\u6709\u4e2a\u5c0f\u63d2\u66f2\uff0c\u5f97\u5230 flag \u4ee5\u540e\u8bb0\u5f97\u5173\u6389\u4ee3\u7406\u3002<\/p>\n
\u793e\u5de5-\u521d\u6b65\u6536\u96c6<\/h2>\n
\"image-20220221202638046\"<\/div><\/p>\n
\u6253\u5f00\u73af\u5883\uff1a<\/p>\n
\"image-20220221211121568\"<\/div><\/p>\n
\u5565\u60c5\u51b5\uff1f\uff1f\uff1f\u597d\u5728\u4e4b\u540e\u6253\u5f00\u73af\u5883\u7684\u65f6\u5019\u6210\u529f\u4e86\uff0c\u4e0d\u7136\u6211\u8fd8\u4ee5\u4e3a\u73af\u5883\u574f\u6389\u4e86\u3002<\/p>\n
<\/div><\/p>\n
\u67e5\u770b\u6e90\u4ee3\u7801\uff1a<\/p>\n
<!DOCTYPE HTML>\n<html>\n    <head>\n        <title>\u5c0fbug\u5237\u94bb\u5b98\u7f51 - \u4e00\u4ef6\u5237\u94bb<\/title>\n        <meta charset="utf-8">\n        <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no">\n         <!--\u5173\u952e\u8bcd-->\n        <meta name="keywords" content="bugku,ctf,\u5237\u94bb">\n        <!--\u63cf\u8ff0-->\n        <meta name="description" content="\u56fd\u5185\u9996\u5c48\u4e00\u6307\u7684\u5237\u94bb\u8f6f\u4ef6">\n        <link rel="stylesheet" href="static\/css\/main.css">\n        <noscript><link rel="stylesheet" href="https:\/\/csgodouyu.com\/assets%09\/css\/noscript.css"><\/noscript>\n    <\/head>\n    <body class="is-preload">\n                    <section id="banner">\n                        <div class="inner">\n                            <div class="logo"><span class="icon fa-gem"><\/span><\/div>\n                            <h2>\u5c0fbug\u5237\u94bb\u5b98\u7f51<\/h2>\n                            <p>\u7b80\u5355\u6613\u7528\u4f46\u529f\u80fd\u591a\u6837\u5f3a\u5927\u7684\u5185\u90e8\u8f85\u52a9<a href="">.<\/a><br>\u53ea\u4e3a\u5e26\u7ed9\u60a8\u66f4\u597d\u7684\u6e38\u620f\u4f53\u9a8c\u3002<\/p>\n                            <a href="#goumai" target="_blank" class="special">\u8d2d\u4e70\u8f85\u52a9<\/a>\n                            <a href="#" class="special">\u5c0f\u53f7\u8d2d\u4e70<\/a>\n                            <a href="http:\/\/wpa.qq.com\/msgrd?v=3&uin=123456&site=qq&menu=yes" class="special">\u8054\u7cfb\u5ba2\u670d<\/a>\n                            <a href="shiyongjiaocheng.php" class="special">\u4f7f\u7528\u6559\u7a0b<\/a>\n                        <\/div>\n                    <\/section>\n                    <!--\u97f3\u4e50\u4ee3\u7801\u5f00\u59cb-->\n                    <!--\u97f3\u4e50\u4ee3\u7801\u7ed3\u675f-->\n                <!-- Wrapper -->\n                    <section id="wrapper">\n                        <!-- One -->\n                        <!-- Three -->            \n                            <\/section>                        \n                        <!-- Four -->\n                            <section id="four" class="wrapper alt style1">\n                                <div class="inner">\n                                    <h2 class="major" id="goumai">\u8d2d\u4e70\u8f85\u52a9\/\u5546\u54c1\u4ecb\u7ecd<\/h2>\n                                    <section class="features">\n                                    <article>\n                                            <a href="#" class="image"><img src="static\/picture\/1.jpg " alt=""><\/a>\n                                            <h3 class="major">\u5237\u94bb<\/h3>\n                                            <p>\u529f\u80fd\u5217\u8868\uff1a\u4e00\u952e\u5237\u94bb<\/p>\n                                            <p>\u652f\u6301\u7cfb\u7edf\uff1aWin7 \/ Win8 \/ Win10<\/p>\n                                            <p>\u7a33\u5b9a\u6307\u6570\uff1a100%<\/p>\n                                            <p>\u6ce8\u610f\u4e8b\u9879\uff1a\u6b64\u7f51\u7ad9\u6240\u6709\u5185\u5bb9\u4e3abugku\u9898\u76ee\u73af\u5883\uff0c\u4ec5\u7528\u4e8e\u7b54\u9898\u3002<\/p>\n                                            <p>\u8f85\u52a9\u4ef7\u683c\uff1a\u514d\u8d39<\/p>\n                                            <a href="#" class="special">\u8d2d\u4e70\u8f85\u52a9<\/a>\n                                            <a href="\/sz.zip" class="special">\u4e0b\u8f7d\u8f85\u52a9<\/a>\n                                        <\/article> \n                                    <\/section>\n                                <\/div>\n                            <\/section>\n                    <\/section>\n                            <ul class="contact">\n                                <li class="icon solid fa-home">\n                                    \u5ba2\u670dQQ:123456<br>\n                                    \u4eca\u65e5\u5df2\u5b8c\u6210\uff01\u4e0a\u67b6\u7684\u5747\u7a33\u5b9a\u5954\u653e\uff01                             <\/li>                         \n                            <\/ul>                         \n                    <\/section>\n            <\/div>            \n        <!-- Scripts -->\n            <script src="static\/js\/jquery.min.js"><\/script>\n            <script src="static\/js\/jquery.scrollex.min.js"><\/script>\n            <script src="static\/js\/browser.min.js"><\/script>\n            <script src="static\/js\/breakpoints.min.js"><\/script>\n            <script src="static\/js\/util.js"><\/script>\n            <script src="static\/js\/main.js"><\/script>         \n            <!--\u77e5\u97f3\u5f00\u59cb-->\n            <style>\n            .music {\n            position: fixed!important;\n            position: absolute;\n            width: 90px;\n            height: 95px;\n            z-index: 9;\n            right: 0;\n            bottom: 0;\n            top: expression(offsetParent.scrollTop+offsetParent.clientHeight-150);\n            cursor: pointer;\n            }\n            <\/style>\n            <div id="audio" class="music">\n            <img src="http:\/\/ku.oioweb.cn\/img\/weimusic1.gif" width="100px" height="100px" id="d" onclick="c();">\n            <\/div>\n            <\/style>\n            <!--\u77e5\u97f3\u7ed3\u675f-->\n            <script src="\/\/lib.baomitu.com\/twitter-bootstrap\/3.3.7\/js\/bootstrap.min.js"><\/script>\n            <script src="https:\/\/yzf.qq.com\/xv\/web\/static\/chat_sdk\/yzf_chat.min.js"><\/script>\n    <\/body>\n<\/html><\/code><\/pre>\n
\u68c0\u67e5\u65e0\u679c\uff0c\u76ee\u5f55\u626b\u63cf\u4e00\u4e0b\uff1a<\/p>\n
\"image-20220221212202210\"<\/div>
\n
\"image-20220221212227584\"<\/div><\/p>\n
\u67e5\u5230\u4e86\u654f\u611f\u76ee\u5f55\uff0c\u8bd5\u7740\u8f93\u5165\u6d4f\u89c8\u5668\u770b\u4e00\u4e0b\uff0c\u8fd8\u771f\u6709\uff1a<\/p>\n
\"image-20220221212504014\"<\/div><\/p>\n
\u53ef\u4ee5\u627e\u5230\u4e00\u4e2a\u8f85\u52a9\u8f6f\u4ef6\uff0c\u4e0b\u8f7d\u4e0b\u6765\u770b\u770b\u6709\u6ca1\u6709\u4ec0\u4e48\u53d1\u73b0\uff1a
\"image-20220221213241094\"<\/div><\/p>\n
\u6253\u5f00\u770b\u4e00\u4e0b\uff1a<\/p>\n
\"image-20220221213420581\"<\/div><\/p>\n
\u70b8\u88c2\uff0c\u5f39\u5b8c\u7a97\u53d1\u73b0\u6ca1\u5565\u7528\uff0c\u5bb3\u3002<\/p>\n
\u6ca1\u529e\u6cd5\u4e86\uff0c\u770b\u5e08\u5085\u4eec\u7684wp\u624d\u77e5\u9053\u9700\u8981\u6293\u5305\uff0c\u6ca1\u529e\u6cd5\u4e86\uff0c\u53ea\u80fd\u6293\u5305\u4e86\uff0c\u6293\u5230\u5982\u4e0b\u5185\u5bb9\uff1a<\/p>\n
==PS\uff1awireshark\u6293\u5305\u524d\uff0c\u9009\u9879\u5185\u7528Wi-Fi\u7684\u65f6\u5019\u5c31\u8bbe\u7f6e\u6210WLAN\uff0c\u4e0d\u662fWi-Fi\u5c31\u8bbe\u7f6e\u6210\u672c\u5730\uff0c\u7136\u540e\u6253\u5f00\u8f6f\u4ef6\u3002==<\/p>\n
\"image-20220221214612545\"<\/div><\/p>\n
\u4e00\u770b\u5c31\u662fbase64\u7f16\u7801\uff0c\u89e3\u5bc6\u4e00\u4e0b\uff1a<\/p>\n

\n    
\"image-20220221215233800\"<\/div>
\"image-20220221215203904\"<\/div>
\n<\/center><\/p>\n
\u8fd9\u6837\u5c31\u5f97\u5230\u4e86\u8d26\u53f7\u5bc6\u7801\uff1a<\/p>\n
\n
\u8d26\u53f7\uff1abugkuku@163.com<\/p>\n
\u5bc6\u7801\uff1aXSLROCPMNWWZQDZL<\/p>\n<\/blockquote>\n
\u767b\u5f55\u4e00\u4e0b\u770b\u770b\u6709\u6ca1\u6709\u4ec0\u4e48\u53d1\u73b0\uff1a<\/p>\n
\"image-20220221215929390\"<\/div><\/p>\n
\u767b\u5f55\u5931\u8d25\u4e86\u3002\u3002\u3002\u3002\u90a3\u8bd5\u8bd5foxmail<\/code>\u3002<\/p>\n

\n    
\"image-20220221220213471\"<\/div>
\"image-20220221220229606\"<\/div>
\n    <\/center><\/p>\n
\u7136\u540e\u5c31\u662f\u75af\u72c2\u7684\u7ffb\u627e\u90ae\u4ef6\uff0c\u53ef\u60dc\u4e00\u65e0\u6240\u83b7\u3002<\/p>\n
\"image-20220221220521859\"<\/div><\/p>\n
\u6700\u7ec8\u5728\u5df2\u5220\u9664\u90ae\u4ef6\u91cc\u627e\u5230\u4e86\u8d26\u53f7\u5bc6\u7801\uff0c\u963f\u897f\u5427\u3002<\/p>\n
\"image-20220221221015482\"<\/div><\/p>\n
451806289----WANGJUAN765620<\/code><\/pre>\n
\u62ff\u8d26\u53f7\u5bc6\u7801\u767b\u5f55\u3002\u3002\u3002\u3002\u3002\u611f\u89c9\u81ea\u5df1\u88ab\u641e\u4e86\uff0c\u53ef\u6076\uff01\uff01<\/p>\n
\"image-20220221221938786\"<\/div>
\n
\"image-20220221222035260\"<\/div><\/p>\n
\u62c5\u5fc3\u6f0f\u6389\u4e86\uff0c\u518d\u627e\u4e00\u904d\uff0c\u5783\u573e\u90ae\u7bb1\u91cc\u9762\u627e\u5230\u4e86\u8fd9\u4e2a\uff1a<\/p>\n
\"image-20220221221633521\"<\/div><\/p>\n
\u8fd9\u4e5f\u6ca1\u7528\u554a\uff0c\u4f30\u8ba1\u662f\u54ea\u4e2a\u72d7\u8d3c\u628a\u5220\u6389\u4e86\uff0c\u8bd5\u8bd5\u5e08\u5085wp\u91cc\u9762\u7684\u8d26\u53f7\u5bc6\u7801\uff1a<\/p>\n
\"image-20220221222338948\"<\/div>
\n
\"image-20220221222411398\"<\/div><\/p>\n
\u6ca1\u5565\u597d\u8bf4\u7684\uff0c\u5c31\u8fd9\u6837\u5427\u3002\u3002\u3002\u3002\u8fdb\u5165\u540e\u53f0\u4ee5\u540e\uff1a<\/p>\n
\"image-20220221222611152\"<\/div><\/p>\n
\u5728\u7f51\u7ad9\u4fe1\u606f<\/strong>>\u7f51\u7ad9\u8bbe\u7f6e<\/strong>\u91cc\u9762\u627e\u5230\u4e86flag\uff01<\/p>\n
\"image-20220221222712067\"<\/div><\/p>\n
\u6210\u529f\uff01\uff01\uff01<\/p>\n
\u6700\u540e\u4e0d\u5fd8\u91cd\u65b0\u53d1\u4e00\u4efd\u6b63\u786e\u7684\u5230\u90ae\u7bb1\u8349\u7a3f\u91cc\uff0c\u907f\u514d\u4ee5\u540e\u7684\u4eba\u8e29\u5751\uff01<\/p>\n
\"image-20220221222950539\"<\/div><\/p>\n
over\uff01<\/p>\n
game1<\/h2>\n
\"image-20220221225604543\"<\/div><\/p>\n
\u6253\u5f00\u73af\u5883\uff0c\u53d1\u73b0\u662f\u4e00\u6b3e\u6e38\u620f\uff0c\u5c1d\u8bd5\u73a9\u4e00\u4e0b
<\/div><\/p>\n
\"image-20220221225704637\"<\/div>
\n
\"image-20220221225826822\"<\/div><\/p>\n
\u5dee\u70b9\u5fd8\u8bb0\u6b63\u4e8b\uff0c\u5148\u770b\u4e0b\u6e90\u7801\uff0c\u592a\u957f\u4e86\uff0c\u5b83\u8fd8\u6ca1\u7ed9\u51fa\u5177\u4f53\u8981\u6c42\uff0c\u4e0d\u8fc7\u4e00\u770b\u8fd9\u9898\u76ee\u60f3\u901a\u8fc7\u73a9\u6e38\u620f\u83b7\u53d6flag\u80af\u5b9a\u4e0d\u592a\u663e\u793a\u3002<\/p>\n
F12\u770b\u4e00\u4e0b\uff1a<\/p>\n
\"image-20220221230442041\"<\/div><\/p>\n
\u4e5f\u662f\u76f8\u5f53\u7684\u7e41\u7410\uff0c\u4e0d\u8fc7\u770bwp\uff0c\u6709\u7684\u5e08\u5085\u4f1a\u76f4\u63a5\u627e sign\uff0c\u4e0d\u77e5\u9053\u662f\u4e3a\u5565\uff0c\u7ecf\u9a8c\uff1f<\/p>\n
\u6211\u505a\u7684\u65f6\u5019\u7b2c\u4e00\u53cd\u5e94\u53ea\u80fd\u6293\u5305\u4e86\uff0c\u7136\u540e\u628a\u5206\u6570\u8bbe\u7f6e\u9ad8\u70b9\uff0clet's go\uff01<\/p>\n
\u968f\u4fbf\u73a9\u4e00\u4e0b\uff0c\u7136\u540e\u6293\u5305\uff1a<\/p>\n
\"image-20220221230742668\"<\/div><\/p>\n
\u53d1\u9001\u5230\u91cd\u53d1\u5668\u5185\uff1a<\/p>\n
\"image-20220221230844358\"<\/div><\/p>\n
\u5c06\u5206\u6570\u8bbe\u7f6e\u6210\u4e8699999<\/code>\u90fd\u5931\u8d25\u4e86\uff0c\u8fd9\u4e0d\u7b26\u5408\u5e38\u7406\uff0c\u80af\u5b9a\u662f\u6709\u522b\u7684\u9a8c\u8bc1\uff0c\u91cd\u6293\u4e00\u6b21\u5bf9\u6bd4\u4e00\u4e0b:<\/p>\n
\"image-20220221231214689\"<\/div>
\n
\"image-20220221231410456\"<\/div><\/p>\n
\u5bf9\u6bd4\u53ef\u77e5\uff0csign<\/code>\u503c\u968f\u7740score<\/code>\u4e00\u8d77\u53d8\u5316\uff0c\u5728\u6e90\u7801\u5185ctrl+F<\/code>\u68c0\u7d22\u4e00\u4e0bsign<\/code>\uff0c\u53d1\u73b0\uff1a<\/p>\n
\"image-20220221231649503\"<\/div><\/p>\n
sign \u662f\u7ecf\u5386\u4e86base64\u7f16\u7801\u7684\uff0c\u5c06 sign \u5728\u7ebf\u8f6c\u7801\u4e00\u4e0b\u53d1\u73b0\uff1a<\/p>\n
\"image-20220221232017183\"<\/div><\/p>\n
\u4e00\u76ee\u4e86\u7136\uff0csign\u7684\u5f62\u5f0f\u5c31\u662f\uff1a==sign="zM"+Base64(score)+"\\=\\="==<\/p>\n
\"image-20220221232328631\"<\/div><\/p>\n
\u6210\u529f\u83b7\u5f97 flag\uff01nice\uff01<\/p>\n
\u7f51\u7ad9\u88ab\u9ed1<\/h2>\n
\"image-20220221232534172\"<\/div><\/p>\n
\u4e00\u770b\u9898\u76ee\uff0c\u731c\u6d4b\u9898\u76ee\u548c\u540e\u95e8\u6709\u5173\uff0c\u641c\u5230\u4e00\u4e2a\u540e\u95e8\u68c0\u6d4b\u5de5\u5177findWebshell<\/a>\uff0c\u7a81\u7136\u60f3\u8bd5\u8bd5\uff0c\u6253\u5f00\u73af\u5883\uff1a<\/p>\n
\"image-20220221235522118\"<\/div><\/p>\n
\u8fd9\u73a9\u610f\u505a\u7684\u592atm\u597d\u770b\u4e86\uff0c\u7231\u4e86\u7231\u4e86\uff0c\u4f7f\u7528\u5de5\u5177\u7ed3\u679c\u5931\u8d25\u4e86\uff0c\u5bb3\u3002<\/p>\n
\u4e0d\u614c\uff0c\u90a3\u5c31\u6309\u90e8\u5c31\u73ed\u505a\u5427\uff01<\/p>\n
\u626b\u63cf\u4e00\u4e0b\uff1a<\/p>\n
\"image-20220222001446472\"<\/div><\/p>\n
\u5feb\u4e50\u5c31\u662f\u8fd9\u4e48\u7b80\u5355\uff1f\uff1f\uff1f\uff1f\uff1f\u81ea\u7136\u800c\u7136<\/p>\n
\"image-20220222001614876\"<\/div><\/p>\n
\u968f\u610f\u8bd5\u4e86\u4e00\u4e0bpassword<\/code> \u3001123456<\/code>\u7b49\u5f31\u5bc6\u7801\uff0c\u7ed3\u679c\u9519\u8bef\u3002<\/p>\n
\"image-20220222001903587\"<\/div><\/p>\n
\u4f7f\u7528 burpsuit \u81ea\u5e26\u7684 Passwords \u8fdb\u884c\u7206\u7834\uff0c\u5f97\u5230\u5bc6\u7801\uff1a<\/p>\n
\"image-20220222003430245\"<\/div><\/p>\n
\u5bc6\u7801\u5c31\u662f\uff1a==hack==<\/p>\n
\"image-20220222003553791\"<\/div><\/p>\n
\u5f97\u5230 flag\uff01<\/p>\n
\u672c\u5730\u7ba1\u7406\u5458<\/h2>\n
\"image-20220222011253216\"<\/div><\/p>\n
\u6253\u5f00\u73af\u5883\uff0c\u53ef\u4ee5\u5f97\u5230\uff1a<\/p>\n
\"image-20220222011347108\"<\/div><\/p>\n
\u67e5\u770b\u6e90\u7801\uff1a<\/p>\n
\"image-20220222011452796\"<\/div><\/p>\n
\u4e0b\u9762\u90a3\u4e00\u6392\u5f88\u957f\u7684\u5b57\u7b26\u6700\u540e\uff1a   <\/p>\n
\"image-20220222011532499\"<\/div><\/p>\n
\u5f53\u7136\uff0c\u4f7f\u7528 F12 \u4e5f\u53ef\u4ee5\u3002<\/p>\n
\"image-20220222011854541\"<\/div><\/p>\n
\u5927\u6982\u7387\u662f Base64 \uff0c\u5728\u7ebf\u89e3\u5bc6\u4e00\u4e0b\uff1a<\/p>\n
\"image-20220222011745053\"<\/div><\/p>\n
\u731c\u4e00\u4e0b\uff0c\u4f7f\u7528test123<\/code>\u4f5c\u4e3a\u5bc6\u7801\uff0cadmin\u4f5c\u4e3a\u8d26\u53f7\u6216\u5176\u4ed6\uff1a<\/p>\n
\"image-20220222012204559\"<\/div><\/p>\n
\u591a\u6b21\u5c1d\u8bd5\u65e0\u679c\uff0c\u60f3\u5230\u8054\u7cfb\u672c\u5730\u7ba1\u7406\u5458\u8fd9\u53e5\u8bdd\u3002\u3002\u3002\u3002\u6293\u4e2a\u5305\u770b\u770b\uff01<\/p>\n
\"image-20220222012400323\"<\/div><\/p>\n
\u4f2a\u88c5\u6210\u672c\u5730\u8bbf\u95ee\uff1f\uff1f\uff1f\u6ca1\u6709\u770b\u5230XFF<\/code>\uff0c\u90a3\u5c31\u81ea\u5df1\u6dfb\u52a0\u4e00\u4e2a\u8bd5\u8bd5\uff01<\/p>\n
\u6b63\u5e38\u662f\u8fd9\u6837\u7684\uff1a<\/p>\n
\"image-20220222012705975\"<\/div><\/p>\n
\u6dfb\u52a0XFF<\/code>\u4ee5\u540e\u662f\u8fd9\u6837\u7684\uff1a<\/p>\n
\"image-20220222013135377\"<\/div><\/p>\n
\u5f97\u5230 flag\u3002<\/p>\n
bp<\/h2>\n
\"image-20220222013808078\"<\/div><\/p>\n
\u6253\u5f00\u73af\u5883\uff1a<\/p>\n
\"image-20220222013918996\"<\/div><\/p>\n
\u770b\u5230\u9898\u76ee\u53ef\u4ee5\u731c\u5230\u5bc6\u7801\u4ee5z\u5f00\u5934\u7684\u4e14\u4e0etop1000\u6709\u5173\uff0c\u53ef\u4ee5\u60f3\u5230\uff1a<\/p>\n