正则 代码审计



[Zer0pts2020]Can you guess it?_文件名

 

打开/?source

 



<?php
include 'config.php'; // FLAG is defined in config.php

if (preg_match('/config\.php\/*$/i', $_SERVER['PHP_SELF'])) {//$_SERVER['PHP_SELF']//返回正在执行脚本的文件名 
  exit("I don't know what you are thinking, but I won't let you read it :)");
}

if (isset($_GET['source'])) {//get一个参数source
  highlight_file(basename($_SERVER['PHP_SELF']));//basename()函数返回路径中的文件名部分。basename("/path/home.php")-->home.php 
  exit();                                        //basename("/index.php/config.php")-->/index.php/config.php
}

$secret = bin2hex(random_bytes(64));//bin2hex()函数把 ASCII 字符的字符串转换为十六进制值。字符串可通过使用 pack() 函数再转换回去。
if (isset($_POST['guess'])) {//post一个参数guess
  $guess = (string) $_POST['guess'];
  if (hash_equals($secret, $guess)) {//比较两个字符串是否相等
    $message = 'Congratulations! The flag is: ' . FLAG;
  } else {
    $message = 'Wrong.';
  }
}
?>
<!doctype html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <title>Can you guess it?</title>
  </head>
  <body>
    <h1>Can you guess it?</h1>
    <p>If your guess is correct, I'll give you the flag.</p>
    <p><a href="?source">Source</a></p>
    <hr>
<?php if (isset($message)) { ?>
    <p><?= $message ?></p>
<?php } ?>
    <form action="index.php" method="POST">
      <input type="text" name="guess">
      <input type="submit">
    </form>
  </body>
</html>


看到有一个随机数，用post输入字符与随机数相等，就能得到flag，这个做不出来

flag在config.php文件中,但是正则匹配掉了config.php

当访问index.php时，可以在后面加上一些东西，例如/index.php/config.php，访问的仍然是index.php。但经过basename()后，就变成了config.php，然后再通过?source读取。

如果能绕过正则，就可以访问config.php，进而得到flag

如果构造



/index.php/config.php?souce


[Zer0pts2020]Can you guess it?_文件名_02

 

用不可显字符绕过正则（后面加 %80 – %ff 的任意字符）

构造



/index.php/config.php/%ff?source


[Zer0pts2020]Can you guess it?_php_03