Nanjing posts and Telecommunications CTF platform to do the problem writeup--web--download~

The URL provides a download link for two songs, respectively

http://way.nuptzj.cn/web6/download.php?url=eGluZ3hpbmdkaWFuZGVuZy5tcDM=

Http://way.nuptzj.cn/web6/download.php?url=YnV4aWFuZ3poYW5nZGEubXAz

The name of the downloaded file appears in Base64 encrypted form, so the download.php base64 encryption is constructed ZG93BMXVYWQUCGHW

Visit HTTP://WAY.NUPTZJ.CN/WEB6/DOWNLOAD.PHP?URL=ZG93BMXVYWQUCGHW Download download.php

download.php

?? <?PHPerror_reporting(0);include("hereiskey.php");$url=Base64_decode($_get[url]);if($url= = "Hereiskey.php" | |$url= = "Buxiangzhangda.mp3" | |$url= = "Xingxingdiandeng.mp3" | |$url= = "Download.php"){    $file _size=filesize($url); Header("Pragma:public" ); Header("Cache-control:must-revalidate, post-check=0, pre-check=0" ); Header("Cache-control:private",false ); Header("Content-transfer-encoding:binary" ); Header("Content-type:audio/mpeg MP3"); Header("Content-length:".)$file _size); Header("Content-disposition:attachment; Filename= ".$url); Echo(file_get_contents($url)); Exit;}Else {    Echo"Access forbidden!";}?>

Discover hereiskey.php Download hereiskey.php

? <? PHP // flag:nctf{download_any_file_666}?>

Nanjing posts and Telecommunications CTF platform to do the problem writeup--web--download~