0x01 寻找做题信息
打开环境，查看源代码，发现可疑链接，/Archive_room.php，action.php
打开action.php会发生302跳转，查找302跳转无果，百度这道题，发现用burp发包就不会发生跳转
![[极客大挑战 2019]Secret File](https://johngo-pic.oss-cn-beijing.aliyuncs.com/articles/20230605/2438918-20211021205438331-2034196423.png)
![[极客大挑战 2019]Secret File](https://www.johngo689.com/wp-content/themes/justnews/themer/assets/images/lazy.png)
0x02 找到/secr3t.php，打开看到以下代码
![[极客大挑战 2019]Secret File](https://johngo-pic.oss-cn-beijing.aliyuncs.com/articles/20230605/2438918-20211021205407702-1401593870.png)
0x03 百度include函数，存在文件包含漏洞，用伪协议读取
参考这篇文章https://www.anquanke.com/post/id/232358
通过伪协议实现文件读取，题目中strstr函数会匹配一些伪协议，造成过滤
?file=php://filter/resource=flag.php
![[极客大挑战 2019]Secret File](https://johngo-pic.oss-cn-beijing.aliyuncs.com/articles/20230605/2438918-20211021210234101-1548077357.png)
这样读取出来，看不到flag,加密读取，通过burp解密，拿到flag
?file=php://filter/read=convert.base64-encode/resource=flag.php
![[极客大挑战 2019]Secret File](https://johngo-pic.oss-cn-beijing.aliyuncs.com/articles/20230605/2438918-20211021210313192-176022826.png)
Original: https://www.cnblogs.com/BackRoads/p/15435203.html
Author: Osako
Title: [极客大挑战 2019]Secret File
原创文章受到原创版权保护。转载请注明出处：https://www.johngo689.com/586150/
转载文章受原作者版权保护。转载请注明原作者出处！