第三届vecctf WP

Web

php源码审计

打开发现是登录界面，Ctrl + U查看一下源代码

<!--
php
	$username = $_POST['username'];
	$passwd = $_POST['password'];
	if($username=="admin" && md5($passwd)=="0e509367213418206700842008763514"){
		echo "y0u Ar3 a HaCK3R".'<br>'.'<br>';
		system("cat flag_md5.txt");
	}else{
		echo "username or password is wrong"."<br>";
		echo "please come back";
	}
>

-->

发现flag在flag_md5.txt里面，那还绕过什么，直接访问URL/flag_md5.txt获得flag

flag{md5inphpisnotsafe_guet11}