BUGKUCTF Web problem Solving record 16-20

write a part of the web problem, is to make it the most basic part of it, the next few days will continue to update the BUGKUCTF Web Part of the problem, in order not to affect the reading, so every five questions in the form of an article published, thank you have always been the support and understanding, mutual encouragement ~ ~ ~ Website is hacked

Topic Link http://120.24.86.145:8002/webshell/

Because the topic link is temporarily not going to go, then update

Web4

Topic Link http://120.24.86.145:8002/web4/

Because the topic link is temporarily not going to go, then update

Flag in Index

Topic Link http://120.24.86.145:8005/post/

Open the topic, inside is a link, click to find only test5 a few characters

View link found to have file=xxxxxx re-combine topic name flag again index

We'll think of a local file type that's included, so let's construct

http://120.24.86.145:8005/post/index.php?file=php://filter/read=convert.base64-encode/resource= index.php

Opens a page where we view the source code for easy viewing using F12

Such a large string of characters, which is Base64 encrypted format we use the tool to decrypt the BASE64 encryption decryption

Give us a bunch of code, flag, in the code.

Enter password to view flag

Topic Link http://120.24.86.145:8002/baopo/

Because the topic link is temporarily not going to go, then update

Viewed 1 million times

Topic Link http://120.24.86.145:9001/test/

Open the page, ask us to click 1 million times, we look at the source code, see if we can start from the source code to solve the problem

After we click some data will change, we try to change the next click Data, and then still back to the original state

We keep looking down there's no wonder a bunch of code

    varClicks=0    $(function() {      $("#cookie")        . MouseDown (function() {$ (this). Width (' 350px '). Height (' 350px '); })        . MouseUp (function() {$ (this). Width (' 375px '). Height (' 375px '); Clicks++; $("#clickcount").text (clicks); if(Clicks >= 1000000){              varForm = $ (' <form action= "" method= "post" > ' + ' <input type= "text" name= "clicks" value= "' + C Licks + ' hidden/> ' + ' </form> '); $(' Body ').append (form); Form.submit ();    }        });  }); 

Defines a clicks to continue viewing the discovery is transmitted using the POST method

We use Hackbar (Firefox plugin) to transfer

Drag the console page down to see our flag

BUGKUCTF Web problem Solving record 16-20