[CISCN2019 South East Division] Web11

[CISCN2019 South East Division] Web11

The sun and the moon back to supination; rivers but want to make the painting

Test sites: ssti ;;

State records a tournament title. Open the topic ,, find information, tips are Smarty template, then it is natural to think it might be based on the Smarty template ssti ;; ;;

And then found the upper right corner there is a record current ip ip ah. With the basic idea; it may be ssti occur at XFF;

** Smarty supports { php } {/ php } tag which performs wrapped php instructions. **

So we simply test and found ;; error

{If} Smarty the condition judgment and PHP if very similar, but adds features. PHP and all of the conditional expressions can be used in the function if, as || , or, &&, and, is_array (), and the like.

So directly a bobbin; injection {if phpinfo ()} {/ if} return directly phpinfo ;; successful injection; to see if the system can be used here, may be used after the test was found, so a direct two bobbin; {if system ( " ls / ")} {/ if} {if system (" cat / flag ")} {/ if}

Or may be directly read php built-in functions; ReadFile or show_source

Here is not the flag flashed