参考链接:https://blog.csdn.net/qq_41173457/article/details/90724943 注意 只要namespace相同那就可以直接实例化同一namespace的类,至少在本题环境下是这样,所以可以在访问Index.php反序化影响到Regeister.php <?php namespace app\web\controller; use think\Controller; class Index extends Controller { public $…
Smarty <= 3.1.34,存在任意文件删除的POP链. Exp: <?php class Smarty_Internal_Template { public $smarty = null; public function __construct() { $this->smarty = new Smarty; $this->cached = new Smarty_Template_Cached; } } class Smarty { public $cache_locking…
D. Maximum Diameter Graph time limit per test 2 seconds memory limit per test 256 megabytes input standard input output standard output Graph constructive problems are back! This time the graph you are asked to build should match the following proper…
#发现之前对这个链关注的点有点问题,重新分析了一下 由于最近面试的过程中被问到了yso中URLDNS这个pop链的工作原理,当时面试因为是谈到shiro的怎么检测和怎么攻击时谈到了这个.其实在实战中用JRMP其实比URLDNS更准(这个技巧后续再说). 当时因为没有分析URLDNS和JRMP,所以问到URLDNS的pop链就懵了,没回答出来.因此现在就分析一下URLDNS这款的代码吧. public class URLDNS implements ObjectPayload<Object> {…
那次某信内部比赛中有道pop链问题的题目,我当时没有做出来,所以在此总结一下,本次以buu上复现的[MRCTF2020]Ezpop为例. 题目 1 Welcome to index.php 2 <?php 3 //flag is in flag.php 4 //WTF IS THIS? 5 //Learn From https://ctf.ieki.xyz/library/php.html#%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E9%AD%94%E6%9C%A…
比赛时候还是太慢了……要是能做快点就能上分了 Monocarp has drawn a tree (an undirected connected acyclic graph) and then has given each vertex an index. All indices are distinct numbers from 11 to nn. For every edge ee of this tree, Monocarp has written two numbers: the ma…
