狼组CTF web-baby.php

变量覆盖题目源码如下

 <?php

highlight_file('source.txt');
echo "<br><br>";

$flag = 'xxxxxxxx';
$msg_giveme = 'Give me the flag!';
$msg_getout = 'No this. Get out!';
if(!isset($_GET['flag']) && !isset($_POST['flag'])){
    exit($msg_giveme);
}

if($_POST['flag'] === 'flag' || $_GET['flag'] === 'flag'){
    exit($msg_getout);
}

foreach ($_POST as $key => $value) {
    $$key = $value;
}

foreach ($_GET as $key => $value) {
    $$key = $$value;
}

echo 'the flag is : ' . $flag;

?>


Give me the flag!

审计一波 思路是
需要flag=flag才能echo出来$flag
可是发现过滤了flag=flag

foreach ($_GET as $key => $value) {
    $$key = $$value;
}

value是遍历赋值给key
构造出flag1=flag 这时候就是$flag的值赋给了$flag1
最后是echo出flag
构造出下一个payload flag=flag1
这样就是flag=flag 最后就能echo 出来flag
完整payload flag1=flag&flag=flag1