Download~!

标签：nsf   type   contents   gravity   down   ast   proc   strong   bin   

利用burpsuite抓包看看，点击两个下载比对一下，发现它的url是可变的，而且是base64编码

这样的话构造一下download.php的base64编码，放置url运行，得到源码

<?php
error_reporting(0);
include("hereiskey.php");
$url=base64_decode($_GET[url]);
if( $url=="hereiskey.php" || $url=="buxiangzhangda.mp3" || $url=="xingxingdiandeng.mp3" || $url=="download.php"){
    $file_size = filesize($url);
    header ( "Pragma: public" );
    header ( "Cache-Control: must-revalidate, post-check=0, pre-check=0" );
    header ( "Cache-Control: private", false );
    header ( "Content-Transfer-Encoding: binary" );
    header ( "Content-Type:audio/mpeg MP3");
    header ( "Content-Length: " . $file_size);
    header ( "Content-Disposition: attachment; filename=".$url);
    echo(file_get_contents($url));
    exit;
}
else {
    echo "Access Forbidden!";
}
?>

分析源码可知有一个hereiskey.php，构造url提交可得flag

Download~!

标签：nsf   type   contents   gravity   down   ast   proc   strong   bin   

原文地址：http://www.cnblogs.com/maodun/p/6915736.html