一、找到與數據庫有關系的PHP文件

打開內容如下，發現數據庫密碼是函數my_encrypt()返回的結果。

二、在文件夾encrypt中找到encrypt.php,內容如下，其中mcrypt已不再使用，所以使用php>=7版本可能沒有執行結果，需要換成較低版本的PHP

<?php
function my_encrypt(){$str = 'P3LMJ4uCbkFJ/RarywrCvA==';$str = str_replace(array("/r/n", "/r", "/n"), "", $str);$key = 'PanGuShi';$iv = substr(sha1($key),0,16);$td = mcrypt_module_open(MCRYPT_RIJNDAEL_128,"",MCRYPT_MODE_CBC,"");mcrypt_generic_init($td, "PanGuShi", $iv);$decode = base64_decode($str);$dencrypted = mdecrypt_generic($td, $decode);mcrypt_generic_deinit($td);mcrypt_module_close($td);$dencrypted = trim($dencrypted);return $dencrypted;
}

修改文件如下，并放置phpstudy的WWW目錄下，再訪問該文件，文件就會被執行，生成密碼

<?php
function my_encrypt(){$str = 'P3LMJ4uCbkFJ/RarywrCvA==';$str = str_replace(array("/r/n", "/r", "/n"), "", $str);$key = 'PanGuShi';$iv = substr(sha1($key),0,16);$td = mcrypt_module_open(MCRYPT_RIJNDAEL_128,"",MCRYPT_MODE_CBC,"");mcrypt_generic_init($td, "PanGuShi", $iv);$decode = base64_decode($str);$dencrypted = mdecrypt_generic($td, $decode);mcrypt_generic_deinit($td);mcrypt_module_close($td);$dencrypted = trim($dencrypted);return $dencrypted;
}
echo my_encrypt();
?>

得到flag