1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

<?php
echo'<center><strong>welc0me to 2020UNCTF!!</strong></center>';
highlight_file(__FILE__);
$url = $_GET['url'];
if(preg_match('/unctf\.com/',$url)){
    if(!preg_match('/php|file|zip|bzip|zlib|base|data/i',$url)){
        $url=file_get_contents($url);
        echo($url);
    }else{
        echo('error!!');
    }
}else{
    echo("error");
}

1
2

preg_match('/unctf\.com/',$url)
preg_match('/php|file|zip|bzip|zlib|base|data/i',$url)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

<?php
    error_reporting(0);
    highlight_file(__FILE__);
    class a
    {
        public $uname;
        public $password;
        public function __construct($uname,$password)
        {
            $this->uname=$uname;
            $this->password=$password;
        }
        public function __wakeup()
        {
                if($this->password==='easy')
                {
                    include('flag.php');
                    echo $flag;    
                }
                else
                {
                    echo 'wrong password';
                }
            }
        }
    function filter($string){
        return str_replace('challenge','easychallenge',$string);
    }
    $uname=$_GET[1];
    $password=1;
    $ser=filter(serialize(new a($uname,$password)));
    $test=unserialize($ser);
?>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

<?php
    // flag在flag.php
    if(isset($_GET['a'])){
        if(preg_match('/\(.*\)/', $_GET['a']))
            die('hacker!!!');
        ob_start(function($data){
                 if (strpos($data, 'flag') !== false)
                 return 'ByeBye hacker';
                 return false;
                 });
        eval($_GET['a']);
    } else {
        highlight_file(__FILE__);
    }
?>

1
2
3

preg_match('/\(.*\)/', $_GET['a'])//（匹配括号的限制）

if (strpos($data, 'flag') !== false)//（返回输出的限制）

1
2
3
4
5

<?php

$flag='UNCTF{55eaf551-0695-4ca0-8721-a5bfe091ea80}';

?>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

<?php
show_source(__FILE__);
$username  = "admin";
$password  = "password";
include("flag.php");
$data = isset($_POST['data'])? $_POST['data']: "" ;
$data_unserialize = unserialize($data);
if ($data_unserialize['username']==$username&&$data_unserialize['password']==$password){
    echo $flag;
}else{
    echo "username or password error!";
}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103

from flask import *
import random as rd
import os

app = Flask(__name__)

def ranstr(num):
    H = 'abcdefghijklmnopqrstuvwxyz0123456789'
    salt = ''
    for i in range(num):
        salt += rd.choice(H)
    return salt

SECRET = ranstr(4)

Flask.secret_key = SECRET

BLACKLIST = ['%', '_', 'eval', 'open', 'flag',
             'in', '-', 'class', 'mro', '[', ']', '\"', '\'']

user_dicts = dict()

def init():
    user_dicts["admin"] = User('admin', ranstr(32))

class User:
    def __init__(self, username, password):
        self.username = username
        self.password = password

def black_list(string):
    for i in string:
        if i in BLACKLIST:
            return True
    return False

@app.route('/', methods=['GET'])
def index():
    if 'username' in session:
        if session['username'] == 'admin':
            return render_template_string(
                "admin login success and check the secret route /secret_route_you_do_not_know")
        else:
            return render_template('hello.html', name=session['username'])
    else:
        return render_template_string("a easy flask problem,first login as the admin")

@app.route('/login', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        username = request.form['username'] if 'username' in request.form else ""
        password = request.form['password'] if 'password' in request.form else ""
        if username == "" or password == "":
            return render_template_string("pass the username or password use get method")
        if username in user_dicts and user_dicts[username].password == password:
            session['username'] = username
            if username == 'admin':
                return render_template_string("admin login success!")
            else:
                return render_template_string("login success!!")
        else:
            return render_template_string("login fail! check /register")
    else:
        return render_template('login.html')

@app.route('/register', methods=['GET', 'POST'])
def register():
    if request.method == 'POST':
        username = request.form['username'] if 'username' in request.form else ""
        password = request.form['password'] if 'password' in request.form else ""

        if username == "" or password == "":
            return render_template_string("pass the username or password use get method")

        if username not in user_dicts:
            user_dicts[username] = User(username, password)
            return render_template_string("register success")
        else:
            return render_template_string("the user already exists")
    else:
        return render_template('register.html')

@app.route('/secret_route_you_do_not_know', methods=['GET'])
def secret():
    guess = request.args['guess'] if 'guess' in request.args else ''
    secret_num = rd.randint(0, 100000)
    if guess == '':
        return render_template_string("you should 'guess' the secret number")
    try:
        guess_num = int(guess)
        if guess_num == secret_num:
            return render_template_string('final step, check the source code')
        else:
            return render_template_string('you are wrong')
    except Exception:
        if not black_list(guess):
            return render_template_string(guess + ' error!!')
        else:
            return render_template_string('black list filter')

if __name__ == '__main__':
    init()
    app.run(host='0.0.0.0', port=80)

1
2
3

AddType Application/x-httpd-p\

hp .jpg