[CISCN2019 North Division Day1 Web1] Dropbox

Brush title record: [CISCN2019 North Division Day1 Web1] Dropbox

Recurring topic links: https://buuoj.cn/challenges
Reference Links: ciscn2019 North Division semifinal day1_web1 solution to a problem

One, involving knowledge points

1, an arbitrary file download

Under the time line to do this step

2, PHAR deserialization RCE

Summarized here: Phar deserialized
use conditions:

1.phar file you want to upload to the server.
2. have a magic method can be used as a "springboard."
3. The parameter file manipulation functions controlled, and:, /, phar and other special characters are not filtered.

Second, problem-solving approach

See reference link