1
<?php
2
show_source(__FILE__);
3

4
error_reporting(0);
5
class All_in_one
6
{
7
    public $KiraKiraAyu;
8
    public $_4ak5ra;
9
    public $K4per;
10
    public $Samsāra;
11
    public $komiko;
12
    public $Fox;
13
    public $Eureka;
14
    public $QYQS;
15
    public $sleep3r;
16
    public $ivory;
17
    public $L;
18

19
    public function __set($name, $value){
20
        echo "他还是没有忘记那个".$value."<br>";
21
        echo "收集夏日的碎片吧<br>";
22

23
        $fox = $this->Fox;
24

25
        if ( !($fox instanceof All_in_one) && $fox()==="summer"){
26
            echo "QYQS enjoy summer<br>";
27
            echo "开启循环吧<br>";
28
            $komiko = $this->komiko;
29
            $komiko->Eureka($this->L, $this->sleep3r);
30
        }
31
    }
32

33
    public function __invoke(){
34
        echo "恭喜成功signin!<br>";
35
        echo "welcome to Geek_Challenge2025!<br>";
36
        $f = $this->Samsāra;
37
        $arg = $this->ivory;
38
        $f($arg);
39
    }
40
    public function __destruct(){
41

42
        echo "你能让K4per和KiraKiraAyu组成一队吗<br>";
43

44
        if (is_string($this->KiraKiraAyu) && is_string($this->K4per)) {
45
            if (md5(md5($this->KiraKiraAyu))===md5($this->K4per)){
46
                die("boys和而不同<br>");
47
            }
48

49
            if(md5(md5($this->KiraKiraAyu))==md5($this->K4per)){
50
                echo "BOY♂ sign GEEK<br>";
51
                echo "开启循环吧<br>";
52
                $this->QYQS->partner = "summer";
53
            }
54
            else {
55
                echo "BOY♂ can`t sign GEEK<br>";
56
                echo md5(md5($this->KiraKiraAyu))."<br>";
57
                echo md5($this->K4per)."<br>";
58
            }
59
        }
60
        else{
61
            die("boys堂堂正正");
62
        }
63
    }
64

65
    public function __tostring(){
66
        echo "再走一步...<br>";
67
        $a = $this->_4ak5ra;
68
        $a();
69
    }
70

71
    public function __call($method, $args){
72
        if (strlen($args[0])<4 && ($args[0]+1)>10000){
73
            echo "再走一步<br>";
74
            echo $args[1];
75
        }
76
        else{
77
            echo "你要努力进窄门<br>";
78
        }
79
    }
80
}
81

82
class summer {
83
    public static function find_myself(){
84
        return "summer";
85
    }
86
}
87
$payload = $_GET["24_SYC.zip"];
88

89
if (isset($payload)) {
90
    unserialize($payload);
91
} else {
92
    echo "没有大家的压缩包的话，瓦达西！<br>";
93
}
94
?>

1
from flask import Flask, request, render_template, render_template_string, redirect, url_for, session
2
import os
3

4
app = Flask(__name__, template_folder="templates", static_folder="static")
5
app.secret_key = "key_ciallo_secret"
6

7
USERS = {}
8

9

10
def waf(payload: str) -> str:
11
    print(len(payload))
12
    if not payload:
13
        return ""
14

15
    if len(payload) not in (114, 514):
16
        return payload.replace("(", "")
17
    else:
18
        waf = ["__class__", "__base__", "__subclasses__", "__globals__", "import","self","session","blueprints","get_debug_flag","json","get_template_attribute","render_template","render_template_string","abort","redirect","make_response","Response","stream_with_context","flash","escape","Markup","MarkupSafe","tojson","datetime","cycler","joiner","namespace","lipsum"]
19
        for w in waf:
20
            if w in payload:
21
                raise ValueError(f"waf")
22

23
    return payload
24

25

26
@app.route("/")
27
def index():
28
    user = session.get("user")
29
    return render_template("index.html", user=user)
30

31

32
@app.route("/register", methods=["GET", "POST"])
33
def register():
34
    if request.method == "POST":
35
        username = (request.form.get("username") or "")
36
        password = request.form.get("password") or ""
37
        if not username or not password:
38
            return render_template("register.html", error="用户名和密码不能为空")
39
        if username in USERS:
40
            return render_template("register.html", error="用户名已存在")
41
        USERS[username] = {"password": password}
42
        session["user"] = username
43
        return redirect(url_for("profile"))
44
    return render_template("register.html")
45

46

47
@app.route("/login", methods=["GET", "POST"])
48
def login():
49
    if request.method == "POST":
50
        username = (request.form.get("username") or "").strip()
51
        password = request.form.get("password") or ""
52
        user = USERS.get(username)
53
        if not user or user.get("password") != password:
54
            return render_template("login.html", error="用户名或密码错误")
55
        session["user"] = username
56
        return redirect(url_for("profile"))
57
    return render_template("login.html")
58

59

60
@app.route("/logout")
61
def logout():
62
    session.clear()
63
    return redirect(url_for("index"))
64

65

66
@app.route("/profile")
67
def profile():
68
    user = session.get("user")
69
    if not user:
70
        return redirect(url_for("login"))
71
    name_raw = request.args.get("name", user)
72

73
    try:
74
        filtered = waf(name_raw)
75
        tmpl = f"欢迎，{filtered}"
76
        rendered_snippet = render_template_string(tmpl)
77
        error_msg = None
78
    except Exception as e:
79
        rendered_snippet = ""
80
        error_msg = f"渲染错误: {e}"
81
    return render_template(
82
        "profile.html",
83
        content=rendered_snippet,
84
        name_input=name_raw,
85
        user=user,
86
        error_msg=error_msg,
87
    )
88

89

90
@app.route("/read", methods=["GET", "POST"])
91
def read_file():
92
    user = session.get("user")
93
    if not user:
94
        return redirect(url_for("login"))
95

96
    base_dir = os.path.join(os.path.dirname(__file__), "story")
97
    try:
98
        entries = sorted([f for f in os.listdir(base_dir) if os.path.isfile(os.path.join(base_dir, f))])
99
    except FileNotFoundError:
100
        entries = []
101

102
    filename = ""
103
    if request.method == "POST":
104
        filename = request.form.get("filename") or ""
105
    else:
106
        filename = request.args.get("filename") or ""
107

108
    content = None
109
    error = None
110

111
    if filename:
112
        sanitized = filename.replace("../", "")
113
        target_path = os.path.join(base_dir, sanitized)
114
        if not os.path.isfile(target_path):
115
            error = f"文件不存在: {sanitized}"
116
        else:
117
            with open(target_path, "r", encoding="utf-8", errors="ignore") as f:
118
                content = f.read()
119

120
    return render_template("read.html", files=entries, content=content, filename=filename, error=error, user=user)
121

122

123
if __name__ == "__main__":
124
    app.run(host="0.0.0.0", port=8080, debug=False)

1
<?php
2
ini_set('display_errors', '0');
3
$filename = isset($_GET['filename']) ? $_GET['filename'] : null;
4

5
$content = null;
6
$error = null;
7

8
if (isset($filename) && $filename !== '') {
9
    $balcklist = ["../","%2e","..","data://","\n","input","%0a","%","\r","%0d","php://","/etc/passwd","/proc/self/environ","php:file","filter"];
10
    foreach ($balcklist as $v) {
11
        if (strpos($filename, $v) !== false) {
12
            $error = "no no no";
13
            break;
14
        }
15
    }
16

17
    if ($error === null) {
18
        if (isset($_GET['serialized'])) {
19
            require 'function.php';
20
            $file_contents= file_get_contents($filename);
21
            if ($file_contents === false) {
22
                $error = "Failed to read seraizlie file or file does not exist: " . htmlspecialchars($filename);
23
            } else {
24
                $content = $file_contents;
25
            }
26
        } else {
27
            $file_contents = file_get_contents($filename);
28
            if ($file_contents === false) {
29
                $error = "Failed to read file or file does not exist: " . htmlspecialchars($filename);
30
            } else {
31
                $content = $file_contents;
32
            }
33
        }
34
    }
35
} else {
36
    $error = null;
37
}
38
?>

1
<?php
2
class A {
3
    public $file;
4
    public $luo;
5

6
    public function __construct() {
7
    }
8

9
    public function __toString() {
10
        $function = $this->luo;
11
        return $function();
12
    }
13
}
14

15
class B {
16
    public $a;
17
    public $test;
18

19
    public function __construct() {
20
    }
21

22
    public function __wakeup()
23
    {
24
        echo($this->test);
25
    }
26

27
    public function __invoke() {
28
        $this->a->rce_me();
29
    }
30
}
31

32
class C {
33
    public $b;
34

35
    public function __construct($b = null) {
36
        $this->b = $b;
37
    }
38

39
    public function rce_me() {
40
        echo "Success!\n";
41
        system("cat /flag/flag.txt > /tmp/flag");
42
    }
43
}
44
?>

1
<?php
2
$uploadDir = __DIR__ . '/uploads/';
3
if (!is_dir($uploadDir)) {
4
    mkdir($uploadDir, 0755, true);
5
}
6
$whitelist = ['txt', 'log', 'jpg', 'jpeg', 'png', 'zip','gif','gz'];
7
$allowedMimes = [
8
    'txt'  => ['text/plain'],
9
    'log'  => ['text/plain'],
10
    'jpg'  => ['image/jpeg'],
11
    'jpeg' => ['image/jpeg'],
12
    'png'  => ['image/png'],
13
    'zip'  => ['application/zip', 'application/x-zip-compressed', 'multipart/x-zip'],
14
    'gif'  => ['image/gif'],
15
    'gz'   => ['application/gzip', 'application/x-gzip']
16
];
17

18
$resultMessage = '';
19

20
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['file'])) {
21
    $file = $_FILES['file'];
22

23
    if ($file['error'] === UPLOAD_ERR_OK) {
24
        $originalName = $file['name'];
25
        $ext = strtolower(pathinfo($originalName, PATHINFO_EXTENSION));
26
        if (!in_array($ext, $whitelist, true)) {
27
            die('File extension not allowed.');
28
        }
29

30
        $mime = $file['type'];
31
        if (!isset($allowedMimes[$ext]) || !in_array($mime, $allowedMimes[$ext], true)) {
32
            die('MIME type mismatch or not allowed. Detected: ' . htmlspecialchars($mime));
33
        }
34

35
        $safeBaseName = preg_replace('/[^A-Za-z0-9_\-\.]/', '_', basename($originalName));
36
        $safeBaseName = ltrim($safeBaseName, '.');
37
        $targetFilename = time() . '_' . $safeBaseName;
38

39
        file_put_contents('/tmp/log.txt', "upload file success: $targetFilename, MIME: $mime\n");
40

41
        $targetPath = $uploadDir . $targetFilename;
42
        if (move_uploaded_file($file['tmp_name'], $targetPath)) {
43
            @chmod($targetPath, 0644);
44
            $resultMessage = '<div class="success"> File uploaded successfully '. '</div>';
45
        } else {
46
            $resultMessage = '<div class="error"> Failed to move uploaded file.</div>';
47
        }
48
    } else {
49
        $resultMessage = '<div class="error"> Upload error: ' . $file['error'] . '</div>';
50
    }
51
}
52
?>

1
<?php
2
session_start();
3
error_reporting(0);
4

5
if (!isset($_SESSION['user'])) {
6
    header("Location: login.php");
7
    exit;
8
}
9

10
$salt = 'GeekChallenge_2025';
11
if (!isset($_SESSION['dir'])) {
12
    $_SESSION['dir'] = bin2hex(random_bytes(4));
13
}
14
$SANDBOX = sys_get_temp_dir() . "/uploads_" . md5($salt . $_SESSION['dir']);
15
if (!is_dir($SANDBOX)) mkdir($SANDBOX, 0700, true);
16
// 读取文件时已经加上了文件目录
17

18
$files = array_diff(scandir($SANDBOX), ['.', '..']);
19
$result = '';
20
if (isset($_GET['f'])) {
21
    $filename = basename($_GET['f']);
22
    $fullpath = $SANDBOX . '/' . $filename;
23
    if (file_exists($fullpath) && preg_match('/\.(zip|bz2|gz|xz|7z)$/i', $filename)) {
24
                                  // 正则匹配的白名单过滤
25
        ob_start();
26
        @include($fullpath);        // 漏洞点
27
        $result = ob_get_clean();
28
    } else {
29
        $result = "文件不存在或非法类型。";
30
    }
31
}
32
?>

1
<?php
2
session_start();
3

4
$err = '';
5
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
6
    $u = $_POST['user'] ?? '';
7
    $p = $_POST['pass'] ?? '';
8
    if ($u === 'admin' && $p === 'guest123') {
9
        // 登录的用户名与密码
10
        $_SESSION['user'] = $u;
11
        header("Location: index.php");
12
        exit;
13
    } else {
14
        $err = '登录失败：用户名或密码错误';
15
    }
16
}
17
?>

1
<?php
2
// 说明：已修复前端 JS 的语法错误并增强上传完成后的 UI 行为
3
session_start();
4
error_reporting(0);
5

6
// 文件后缀名与 MINE 的白名单
7
$allowed_extensions = ['zip', 'bz2', 'gz', 'xz', '7z'];
8
$allowed_mime_types = [
9
    'application/zip',
10
    'application/x-bzip2',
11
    'application/gzip',
12
    'application/x-gzip',
13
    'application/x-xz',
14
    'application/x-7z-compressed',
15
];
16

17
// 对内容的黑名单限制。只看这个黑名单限制，绕过有些困难
18
$BLOCK_LIST = [
19
    "__HALT_COMPILER()",
20
    "PK",       // 文件头限制了 zip 文件
21
    "<?",
22
    "<?php",
23
    "phar://",
24
    "php",
25
    "?>"
26
];
27

28
// 这个函数只对文件的前 4096 与后 4096 个字节进行了检查，而没有对中间的内容进行检查
29
// 因此我们可以在中间加入危险内容
30
function content_filter($tmpfile, $block_list) {
31
    $fh = fopen($tmpfile, "rb");
32
    if (!$fh) return true;
33
    $head = fread($fh, 4096);
34
    fseek($fh, -4096, SEEK_END);
35
    $tail = fread($fh, 4096);
36
    fclose($fh);
37
    $sample = $head . $tail;
38
    $lower = strtolower($sample);
39
    foreach ($block_list as $pat) {
40
        if (stripos($sample, $pat) !== false) {
41
            // 为避免泄露过多信息，这里不直接 echo sample（你之前有 echo，保持注释）
42
            return false;
43
        }
44
        if (stripos($lower, strtolower($pat)) !== false) {
45
            return false;
46
        }
47
    }
48
    return true;
49
}
50

51
if (!isset($_SESSION['dir'])) {
52
    $_SESSION['dir'] = bin2hex(random_bytes(4));
53
}
54
$salt = 'GeekChallenge_2025';
55
$SANDBOX = sys_get_temp_dir() . "/uploads_" . md5($salt . $_SESSION['dir']);
56
if (!is_dir($SANDBOX)) mkdir($SANDBOX, 0700, true);
57

58
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
59
    if (!isset($_FILES['file'])) {
60
        http_response_code(400);
61
        die("No file.");
62
    }
63

64
    // 对文件后缀名及 MINE 的一系列检查
65
    $tmp = $_FILES['file']['tmp_name'];
66
    $orig = basename($_FILES['file']['name']);
67
    if (!is_uploaded_file($tmp)) {
68
        http_response_code(400);
69
        die("Upload error.");
70
    }
71

72
    $ext = strtolower(pathinfo($orig, PATHINFO_EXTENSION));
73
    if (!in_array($ext, $allowed_extensions)) {
74
        http_response_code(400);
75
        die("Bad extension.");
76
    }
77

78
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
79
    $mime = finfo_file($finfo, $tmp);
80
    finfo_close($finfo);
81
    if (!in_array($mime, $allowed_mime_types)) {
82
        http_response_code(400);
83
        die("Bad mime.");
84
    }
85

86
    if (!content_filter($tmp, $BLOCK_LIST)) {
87
        http_response_code(400);
88
        die("Content blocked.");
89
    }
90

91
    // 文件名变化
92
    $newname = time() . "_" . preg_replace('/[^A-Za-z0-9._-]/', '_', $orig);
93
    $dest = $SANDBOX . '/' . $newname;
94

95
    if (!move_uploaded_file($tmp, $dest)) {
96
        http_response_code(500);
97
        die("Move failed.");
98
    }
99

100
    // 上传成功后，回显文件名
101
    echo "UPLOAD_OK:" . htmlspecialchars($newname, ENT_QUOTES);
102
    exit;
103
}
104
?>