[BJDCTF2020]Mark loves cat

知识点

•  .git源码泄露
• $$导致变量覆盖

扫描到有.git源码泄露，将其下载下来

 

<?php

include 'flag.php';

$yds = "dog";
$is = "cat";
$handsome = 'yds';

foreach($_POST as $x => $y){
$$x = $y;
}

foreach($_GET as $x => $y){
$$x = $$y;
}

foreach($_GET as $x => $y){
if($_GET['flag'] === $x && $x !== 'flag'){
exit($handsome);
}
}

if(!isset($_GET['flag']) && !isset($_POST['flag'])){
exit($yds);
}

if($_POST['flag'] === 'flag' || $_GET['flag'] === 'flag'){
exit($is);
}

 

echo "the flag is: ".$flag;

这里post$flag=flag，由第一个foreach

foreach($_POST as $x => $y){
$$x = $y;
}

我们得到$$flag=flag

 

<?php
$flag = 'flagtest';
$$flag = 'flag';
echo $flagtest;
?>
#flag

然后get yds=flag，由第二个foreach

foreach($_GET as $x => $y){
$$x = $$y;
}

得到$yds=$flag，这里的flag为真的flag

if(!isset($_GET['flag']) && !isset($_POST['flag'])){
exit($yds);
}

退出的时候打印出$yds的值，即flag