[XCTF]华为第二场
这个星期好像华为三连。。。今天这场选星期三刚好完全满课，下午就没机会看了，中午花了一个小时做了一个web签到呜呜，估计下午肯定还有一堆新题
babyphp
给了一个莫名其妙的扫描扫描器界面，可选ip端口和超时时间，随便怎么输都是回显Port scan is deperacted and try to find the source code! // Google is your best friend让人不知道想表达什么，意思是要谷歌出源码？
我反正是没懂什么情况，然后无敌老国王直接从GitHub给我丢了一份源码
直接把HTML复制粘贴在GitHub上一搜就能搜到对应的代码
太牛逼了
<?php
set_time_limit(0);//设置程序执行时间
ob_implicit_flush(True);
ob_end_flush();
$url = isset($_REQUEST['url'])?$_REQUEST['url']:null;
/*端口扫描代码*/
.....这段就是被出题人魔改去掉的部分
/*内网代理代码*/
function getHtmlContext($url){
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HEADER, TRUE); //表示需要response header
curl_setopt($ch, CURLOPT_NOBODY, FALSE); //表示需要response body
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt($ch, CURLOPT_TIMEOUT, 120);
$result = curl_exec($ch);
global $header;
if($result){
$headerSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
$header = explode("\r\n",substr($result, 0, $headerSize));
$body = substr($result, $headerSize);
}
if (curl_getinfo($ch, CURLINFO_HTTP_CODE) == '200') {
return $body;
}
if (curl_getinfo($ch, CURLINFO_HTTP_CODE) == '302') {
$location = getHeader("Location");
if(strpos(getHeader("Location"),'http://') == false){
$location = getHost($url).$location;
}
return getHtmlContext($location);
}
return NULL;
}
function getHost($url){
preg_match("/^(http:\/\/)?([^\/]+)/i",$url, $matches);
return $matches[0];
}
function getCss($host,$html){
preg_match_all("/<link[\s\S]*?href=['\"](.*?[.]css.*?)[\"'][\s\S]*?>/i",$html, $matches);
foreach($matches[1] as $v){
$cssurl = $v;
if(strpos($v,'http://') == false){
$cssurl = $host."/".$v;
}
$csshtml = "<style>".file_get_contents($cssurl)."</style>";
$html .= $csshtml;
}
return $html;
}
if($url != null){
$host = getHost($url);
echo getCss($host,getHtmlContext($url));
}
?>