[GDOUCTF 2023]受不了一点

0x00

这个就是代码审计

<?php
error_reporting(0);
header("Content-type:text/html;charset=utf-8");
if (isset($_POST['gdou']) && isset($_POST['ctf'])) {
    $b = $_POST['ctf'];
    $a = $_POST['gdou'];
    if ($_POST['gdou'] != $_POST['ctf'] && md5($a) === md5($b)) {
        if (isset($_COOKIE['cookie'])) {
            if ($_COOKIE['cookie'] == 'j0k3r') {
                if (isset($_GET['aaa']) && isset($_GET['bbb'])) {
                    $aaa = $_GET['aaa'];
                    $bbb = $_GET['bbb'];
                    if ($aaa == 114514 && $bbb == 114514 && $aaa != $bbb) {
                        $give = 'cancanwordflag';
                        $get = 'hacker!';
                        if (isset($_GET['flag']) && isset($_POST['flag'])) {
                            die($give);
                        }
                        if ($_POST['flag'] === 'flag' || $_GET['flag'] === 'flag') {
                            die($get);
                        }
                        foreach ($_POST as $key => $value) {
                            $$key = $value;
                        }
                        foreach ($_GET as $key => $value) {
                            $$key = $$value;
                        }
                        echo $flag;
                    } else {
                        echo "洗洗睡吧";
                    }
                } else {
                    echo "行不行啊细狗";
                }
            }
        } else {
            echo '菜菜';
        }
    } else {
        echo "就这?";
    }
} else {
    echo "别来沾边";
}

0x01

这个地方只需要进行数组绕过就可以了

设置cookie

两个等号这个是弱比较

php比较绕过（强比较“===”/弱比较“==“）-CSDN博客

这个地方只需要设置一个flag，而且这个部分并没有对其他的参数进行过滤，我们只需要将其他参数设置成flag然后Falg使用这个参数就可以了

[鹤城杯 2021]Middle magic

0x00

运用的知识点

换行符的url编码为 %0a 空格的编码为 %20
正则匹配

0x01

<?php
highlight_file(__FILE__);
include "./flag.php";
include "./result.php";
if(isset($_GET['aaa']) && strlen($_GET['aaa']) < 20){

    $aaa = preg_replace('/^(.*)level(.*)$/', '${1}<!-- filtered -->${2}', $_GET['aaa']);

    if(preg_match('/pass_the_level_1#/', $aaa)){
        echo "here is level 2";
        
        if (isset($_POST['admin']) and isset($_POST['root_pwd'])) {
            if ($_POST['admin'] == $_POST['root_pwd'])
                echo '<p>The level 2 can not pass!</p>';
        // START FORM PROCESSING    
            else if (sha1($_POST['admin']) === sha1($_POST['root_pwd'])){
                echo "here is level 3,do you kown how to overcome it?";
                if (isset($_POST['level_3'])) {
                    $level_3 = json_decode($_POST['level_3']);
                    
                    if ($level_3->result == $result) {
                        
                        echo "success:".$flag;
                    }
                    else {
                        echo "you never beat me!";
                    }
                }
                else{
                    echo "out";
                }
            }
            else{
                
                die("no");
            }
        // perform validations on the form data
        }
        else{
            echo '<p>out!</p>';
        }

    }
    
    else{
        echo 'nonono!';
    }

    echo '<hr>';
}

?>  nonono!