How Gopher attacks MySql

This article introduces how Gopher attacks MySql, the content is very detailed, interested friends can refer to, hope to be helpful to you.

Introduction to the topic

Extract0r in 34c3CTF web.

The object in the question is a secure decompression service. The user enters the url address of the zip. After verifying the validity of the url, the program will download the zip, and then create a directory for the user to extract the files.

0x00 arbitrary file reading

After testing, it is found that the input domain name cannot contain numbers, and the compressed file cannot contain directories, and the extracted directory does not parse php. By uploading a compressed package containing symbolic links, you can achieve the effect of reading arbitrary files.

Ln-s.. / index.php test_link7za a-t7z-r test.7z test

Visit test_link after uploading to get the source code

Index.php (part html has been deleted)