nginx/1.16.1PHP/7.3.11

    1. <?php
    3. /*
    4. # -*- coding: utf-8 -*-
    5. # @Author: h1xa
    6. # @Date:   2020-12-08 19:13:36
    7. # @Last Modified by:   h1xa
    8. # @Last Modified time: 2020-12-08 20:08:07
    9. # @email: h1xa@ctfer.com
    10. # @link: https://ctfer.com
    12. */
    15. highlight_file(__FILE__);
    17. class filter{
    18.     public $filename;
    19.     public $filecontent;
    20.     public $evilfile=false;
    22.     public function __construct($f,$fn){
    23.         $this->filename=$f;
    24.         $this->filecontent=$fn;
    25.     }
    26.     public function checkevil(){
    27.         if(preg_match('/php|\.\./i', $this->filename)){
    28.             $this->evilfile=true;
    29.         }
    30.         if(preg_match('/flag/i', $this->filecontent)){
    31.             $this->evilfile=true;
    32.         }
    33.         return $this->evilfile;
    34.     }
    35.     public function __destruct(){
    36.         if($this->evilfile){
    37.             system('rm '.$this->filename);
    38.         }
    39.     }
    40. }
    42. if(isset($_GET['fn'])){
    43.     $content = file_get_contents('php://input');
    44.     $f = new filter($_GET['fn'],$content);
    45.     if($f->checkevil()===false){
    46.         file_put_contents($_GET['fn'], $content);
    47.         copy($_GET['fn'],md5(mt_rand()).'.txt');
    48.         unlink($_SERVER['DOCUMENT_ROOT'].'/'.$_GET['fn']);
    49.         echo 'work done';
    50.     }
    52. }else{
    53.     echo 'where is flag?';
    54. }
    56. where is flag?

    分析：
    看似花里胡哨，其实 __destruct 里的 system 可直接拼接，也就是设法让 $this->evilfile 置为 true ，然后拼接命令即可。

    image.png
    flag
    ctfshow{0e4fa799-1846-4520-93b8-ea81d66e786d}

    题外：第一眼看去这一读一写，长的这么想被我条件竞争的样子 （