web

1.GET

就GET传入一个p3得了
header函数: 用于发送原生的 HTTP 头
header用法

<?php
error_reporting(0);
include('flag.php');
if($_GET['p1'] == '' or $_GET['p2'] == '') {
    header('location: index.php?p1=CDUSEC&p2=CTF');
}

highlight_file('index.php');
print $_GET['p1'];
print '<br>';
print $_GET['p2'];
print '<br>';

if($_GET['p3'] === 'flag') {
    print $flag;
}

2.POST

post p3=flag就行了

3.百度

没啥思路。ctrl+u看源代码发现有个baidu.png，访问baidu.png下下来还试了下隐写...抓包也没收获。扫描发现robots.txt，进去就看到flag了....

4.矛盾

post f2=0 就行了

<?php
include('flag.php');
$f1 = @$_GET['f1'];
$f2 = @$_POST['f2'];
$f3 = @$_COOKIE['f3'];

if($f2 !== '0') {
    echo 'no';
}
else {
    if($f1 == 0 and $f1 !== 0) {
        $f2 == $f3;
        if(md5($f2) == 0 and $f2 == 0) {
            echo $flag;
        }
    }
}
highlight_file(__FILE__);

5.HASH

function ctt($key)
{
    $t="";
    for($i=0;$i<strlen($key);++$i)
    {
        $t.=chr(ord($key[$i])^$i);
    }
    
    return $t;
}
            $auth = false;
            $role1 = "xxxxxxxxx";
            $salt = "xxxxxxxxxx";//闀垮害涓嶈秴杩�15
            if (isset($_COOKIE["role_true"])) {
                $hsh = $_COOKIE["hsh"];
                if ($_COOKIE["role_true"] === $role1 && $hsh === md5($salt.urldecode($_COOKIE["role"]))) {
                    $auth = true;
                } else {
                    $auth = false;
                }
            } else {
                $s =$role1;
                setcookie('role',ctt(base64_encode($s)));
                
                $hsh = md5($salt.ctt(base64_encode($s)));
                setcookie('hsh',$hsh);
            }
            if ($auth) {
                echo "<h3>Welcome Admin. Your flag is ";
            } else {
                echo "<h3>Only True Admin can see the flag!!</h3>";
            }

if的第二个判断恒成立，主要在if的第一个判断。 ^异或的性质: 两次异或是本身, 抓包可以看到role=YVPweR3oRN%3B%7Bnj32;注意里面有两个url编码得字符。转码后异或得YWRtaW5hZG1pbg==, base64解码得答案.

6.serialization-1

<?php
error_reporting(0);
class Test
{
    private $a = 'nothing';

    public function __destruct()
    {
        if($this->a != 'nothing') {

            highlight_file('flag.php');
        }
        else {
            echo 'No Flag!';
        }
    }
}

if(isset($_GET['data'])) {
    unserialize($_GET['data']);
}
else {
    highlight_file(__FILE__);
}

就...最简单得反序列化,,,, 没啥思路好写的...
'O:4:"Test":1:{s:7:"\00Test\00a";s:7:"oothing";}'

7.sql1

手工注入貌似不太行.上sqlmap.
post传参使用方法参考我前面写的一篇
sqlmap跑了半个小时...

开始时间

结束时间

8.WeekPassword

题目名字都叫弱口令了..
但是没爆破出来..

19-11-16成都大学新生杯