5-7日常 Posted on 2023-05-07 [HZNUCTF 2023 preliminary]pickle1234567891011121314151617181920212223242526272829import base64import picklefrom flask import Flask, requestapp = Flask(__name__)@app.route('/')def index(): with open('app.py', 'r') as f: return f.read()@app.route('/calc', methods=['GET'])def getFlag(): payload = request.args.get("payload") pickle.loads(base64.b64decode(payload).replace(b'os', b''))# 对payload参数进行base64解码,并且将os置换为空 return "ganbadie!"@app.route('/readFile', methods=['GET'])def readFile(): filename = request.args.get('filename').replace("flag", "????") with open(filename, 'r') as f: return f.read()if __name__ == '__main__': app.run(host='0.0.0.0') Read more »
5.4日常 Posted on 2023-05-04 Edited on 2023-05-07 [虎符CTF] ezphp之前在buu上做过,但是忘了,正好在nss上再做一遍 开局一段PHP代码 1<?php (empty($_GET["env"])) ? highlight_file(__FILE__) : putenv($_GET["env"]) && system('echo hfctf2022');?> Read more »