[LitCTF 2023]作业管理系统
[LitCTF 2023]作业管理系统
题目来源:nssctf
题目类型:web
涉及考点:文件上传
这篇是补昨天的...
1. 打开题目是一个登录窗口,在源代码里找到了账密
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230811151123_image-20230811223052232.png)
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230811151123_image-20230811223108399.png)
2. 登录进去后,创建一句话木马文件
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230811151123_image-20230811223317328.png)
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230811151123_image-20230811223334188.png)
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230811151124_image-20230811223427106.png)
- 随后访问该木马文件,POST传入
system("cat /flag");
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230811151123_image-20230811224055980.png)
得到flag:
NSSCTF{5b8bef17-66b1-4b35-a4cc-eb69a3a84efb}
日期:2023.8.11
作者:y0Zero