https://bigshans.github.io/categories/buucft/ Recent content in BUUCFT on Bigshans' Blog Hugo en bigshans Sun, 23 Jul 2023 08:19:53 +0800 https://bigshans.github.io/post/buucft/ Sun, 23 Jul 2023 08:19:53 +0800 https://bigshans.github.io/post/buucft/ <p>娱乐性质，玩一玩。</p> <h2 id="linux-lab">Linux Lab</h2> <p>使用 ssh 连接到靶机即可。</p> <pre class="shell"><code>ssh root@address -p port</code></pre> <p>flag.txt 就放在根目录下面。</p> <h2 id="buucft">BUUCFT</h2> <p>打开页面，首先给了一段代码。</p> <div class="sourceCode" id="cb2"><pre class="sourceCode php"><code class="sourceCode php"><span id="cb2-1"><a href="#cb2-1" aria-hidden="true" tabindex="-1"></a><span class="kw">&lt;?php</span></span> <span id="cb2-2"><a href="#cb2-2" aria-hidden="true" tabindex="-1"></a><span class="co">/**</span></span> <span id="cb2-3"><a href="#cb2-3" aria-hidden="true" tabindex="-1"></a><span class="co"> * Created by PhpStorm.</span></span> <span id="cb2-4"><a href="#cb2-4" aria-hidden="true" tabindex="-1"></a><span class="co"> * User: jinzhao</span></span> <span id="cb2-5"><a href="#cb2-5" aria-hidden="true" tabindex="-1"></a><span class="co"> * Date: 2019/7/9</span></span> <span id="cb2-6"><a href="#cb2-6" aria-hidden="true" tabindex="-1"></a><span class="co"> * Time: 7:07 AM</span></span> <span id="cb2-7"><a href="#cb2-7" aria-hidden="true" tabindex="-1"></a><span class="co"> */</span></span> <span id="cb2-8"><a href="#cb2-8" aria-hidden="true" tabindex="-1"></a></span> <span id="cb2-9"><a href="#cb2-9" aria-hidden="true" tabindex="-1"></a><span class="fu">highlight_file</span>(<span class="cn">__FILE__</span>)<span class="ot">;</span></span> <span id="cb2-10"><a href="#cb2-10" aria-hidden="true" tabindex="-1"></a></span> <span id="cb2-11"><a href="#cb2-11" aria-hidden="true" tabindex="-1"></a><span class="cf">if</span>(<span class="kw">isset</span>(<span class="va">$_GET</span>[<span class="st">&#39;file&#39;</span>])) {</span> <span id="cb2-12"><a href="#cb2-12" aria-hidden="true" tabindex="-1"></a> <span class="va">$str</span> <span class="op">=</span> <span class="va">$_GET</span>[<span class="st">&#39;file&#39;</span>]<span class="ot">;</span></span> <span id="cb2-13"><a href="#cb2-13" aria-hidden="true" tabindex="-1"></a></span> <span id="cb2-14"><a href="#cb2-14" aria-hidden="true" tabindex="-1"></a> <span class="kw">include</span> <span class="va">$_GET</span>[<span class="st">&#39;file&#39;</span>]<span class="ot">;</span></span> <span id="cb2-15"><a href="#cb2-15" aria-hidden="true" tabindex="-1"></a>}</span></code></pre></div> <p>这里的意思是，高亮当前文件，判断是否存在为 file 的 query 参数，如果存在，就加载它。</p>