Jarvis OJ Writeup

md5 ( string $str [, bool $raw_output = FALSE ] ) : string
// raw 为 TRUE 时为 16 字符二进制格式，默认为 false 32 字符十六进制数

// showing.php
<?php
    $f = $_GET['img'];
    if (!empty($f)) {
    $f = base64_decode($f);
    if (stripos($f,'..')===FALSE && stripos($f,'/')===FALSE 
    && stripos($f,'\\')===FALSE&& stripos($f,'pctf')===FALSE) {
    readfile($f);
    } else {
    echo "File not found!";
    }
    }
?>

// index.php
<?php 
    require_once('shield.php');
    $x = new Shield();
    isset($_GET['class']) && $g = $_GET['class'];
    if (!empty($g)) {
    $x = unserialize($g);
    }
    echo $x->readfile();
?>

// shield.php
<?php
    //flag is in pctf.php
    class Shield {
    public $file;
    function __construct($filename = '') {
    $this -> file = $filename;
    }

    function readfile() {
    if (!empty($this->file) && stripos($this->file,'..')===FALSE  
    && stripos($this->file,'/')===FALSE && stripos($this->file,'\\')==FALSE) {
    return @file_get_contents($this->file);
    }
    }
    }
?>