{"id":349,"date":"2024-02-04T00:24:38","date_gmt":"2024-02-03T16:24:38","guid":{"rendered":"http:\/\/162.14.82.114\/?p=349"},"modified":"2024-02-04T00:24:38","modified_gmt":"2024-02-03T16:24:38","slug":"%e6%94%bb%e9%98%b2%e4%b8%96%e7%95%8c%e8%bf%9b%e9%98%b6%e4%b8%93%e5%8c%ba-web120","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/349\/02\/04\/2024\/","title":{"rendered":"\u653b\u9632\u4e16\u754c\u8fdb\u9636\u4e13\u533a\u2014\u2014WEB(1~20)"},"content":{"rendered":"

\u653b\u9632\u4e16\u754c\u8fdb\u9636\u4e13\u533a\u2014\u2014WEB(1~20)<\/h1>\n

001 baby_web<\/h2>\n

\"image-20220224103640132\"<\/div><\/p>\n

\u6253\u5f00\u73af\u5883\uff1a<\/p>\n

\"image-20220224103654741\"<\/div><\/p>\n

ctrl+u<\/code>\u67e5\u770b\u6e90\u4ee3\u7801\uff0c\u548c\u9875\u9762\u5185\u5bb9\u4e00\u6478\u4e00\u6837\uff0c\u770b\u9898\u76ee\u63d0\u793a\u548c\u8d77\u59cb\u9875\u9762\u6709\u5173\uff0c\u5728index.php<\/code>\u7528 F12 \u5373\u53ef\u5728header<\/code>\u91cc\u9762\u627e\u5230flag\u3002<\/p>\n

\"image-20220224104048566\"<\/div><\/p>\n

002 warmup<\/h2>\n

\"image-20220224104319446\"<\/div><\/p>\n

\u6253\u5f00\u573a\u666f\uff1a<\/p>\n

\"image-20220224104434158\"<\/div><\/p>\n

F12\u770b\u4e00\u4e0b\uff1a

\"image-20220224105124661\"<\/div><\/p>\n

\u8fd9\u91cc\u627e\u5230\u4e00\u4e2asource.php<\/code>\uff0c\u8bbf\u95ee\u770b\u4e00\u4e0b\uff1a<\/p>\n

<?php\n    highlight_file(__FILE__);\n    class emmm\n    {\n        public static function checkFile(&$page)\n        {\n            $whitelist = ["source"=>"source.php","hint"=>"hint.php"];\n            if (! isset($page) || !is_string($page)) {\n                echo "you can't see it";\n                return false;\n            }\n\n            if (in_array($page, $whitelist)) {\n                return true;\n            }\n\n            $_page = mb_substr(\n                $page,\n                0,\n                mb_strpos($page . '?', '?')\n            );\n            if (in_array($_page, $whitelist)) {\n                return true;\n            }\n\n            $_page = urldecode($page);\n            $_page = mb_substr(\n                $_page,\n                0,\n                mb_strpos($_page . '?', '?')\n            );\n            if (in_array($_page, $whitelist)) {\n                return true;\n            }\n            echo "you can't see it";\n            return false;\n        }\n    }\n\n    if (! empty($_REQUEST['file'])\n        && is_string($_REQUEST['file'])\n        && emmm::checkFile($_REQUEST['file'])\n    ) {\n        include $_REQUEST['file'];\n        exit;\n    } else {\n        echo "<br><img src=\\"https:\/\/i.loli.net\/2018\/11\/01\/5bdb0d93dc794.jpg\\" \/>";\n    }  \n?><\/code><\/pre>\n
\u627e\u5230\u4e86\u4e2ahint.php<\/code>\uff0c\u6253\u5f00\u770b\u770b\uff1a
\"image-20220224113642361\"<\/div><\/p>\n
\u63d0\u793a flag \u5728 ffffllllaaaagggg \u91cc\u9762\uff0c\u518d\u770b source.php ,<\/p>\n