web131阿呆彻底呆了，阿呆拿起谷姐搜索好久，终于找到更狠的方法。解法可知flag在config.php。<?php#flaginconfig.phpinclude("config.php");if(isset($_GET['c'])){$c=$_GET['c'];if(!preg_match("/system|exec|highlight|cat|\.|