标题:你真的会PHP吗?
解题链接: http://ctf5.shiyanbar.com/web/PHP/index.php
打开链接,查看response:
HTTP/1.1 200 OK
Date: Mon, 29 Oct 2018 11:13:57 GMT
Server: Apache/2.4.18 (Win32) OpenSSL/1.0.2e PHP/5.3.29
X-Powered-By: PHP/5.3.29
hint: 6c525af4059b4fe7d8c33a.txt
Content-Length: 12
Connection: close
Content-Type: text/html
have a fun!!
看到hint头,根据提示打开
http://ctf5.shiyanbar.com/web/PHP/6c525af4059b4fe7d8c33a.txt
获取代码:
<?php
$info = "";
$req = [];
$flag="xxxxxxxxxx";
ini_set("display_error", false);
error_reporting(0);
if(!isset($_POST['number'])){
header("hint:6c525af4059b4fe7d8c33a.txt");
die("have a fun!!");
}
foreach([$_POST] as $global_var) {
foreach($global_var as $key => $value) {
$value = trim($value);
is_string($value) && $req[$key] = addslashes($value);
}
}
function is_palindrome_number($number) {
$number = strval($number);
$i = 0;
$j = strlen($number) - 1;
while($i < $j) {
if($number[$i] !== $number[$j]) {
return false;
}
$i++;
$j--;
}
return true;
}
if(is_numeric($_REQUEST['number'])){
$info="sorry, you cann't input a number!";//要求1:不能是数字
}elseif($req['number']!=strval(intval($req['number']))){
$info = "number must be equal to it's integer!! ";
}else{
$value1 = intval($req["number"]);
$value2 = intval(strrev($req["number"]));
if($value1!=$value2){
$info="no, this is not a palindrome number!";//要求2:字符串正序和倒序转换为数字要相等
}else{
if(is_palindrome_number($req["number"])){
$info = "nice! {$value1} is a palindrome number!"; //要求3:不能是回文
}else{
$info=$flag;
}
}
}
echo $info;
依据代码分析:
要求1:不能输入数字
要求2:字符串正序和倒序转换为数字要相等
要求3:不能是回文
解题1:
intval()最大的值取决于操作系统。 32 位系统最大带符号的 integer 范围是 -2147483648 到 2147483647
加上空格%20
number=2147483647%00
number=2147483647%20
解题2:
number=0e-0%00
number=0e-0%20