抓包发现两个参数，结合报文返回的warning猜测两个参数一个传函数名，另一个传函数参数
尝试直接system('ls /')，发现被过滤了
file_get_contents获取index.php的源码，发现可以反序列化实现RCE
这里复现的时候不知道为什么显示不全
最后手动找到flag
![[<span style='color:red;'>网</span><span style='color:red;'>鼎</span><span style='color:red;'>杯</span> <span style='color:red;'>2020</span> <span style='color:red;'>朱雀</span><span style='color:red;'>组</span>]<span style='color:red;'>phpweb</span>](https://img-blog.csdnimg.cn/img_convert/a404a4237fdec0feb92af881eaa8d0fa.png)
[网鼎杯 2020 朱雀组]phpweb
2024-02-11 09:08:02 62 阅读
![[<span style='color:red;'>网</span><span style='color:red;'>鼎</span><span style='color:red;'>杯</span> <span style='color:red;'>2020</span> <span style='color:red;'>朱雀</span><span style='color:red;'>组</span>]<span style='color:red;'>phpweb</span>](https://img-blog.csdnimg.cn/direct/bbf1930ae4d94c43964c3e0823383b56.png)
![[<span style='color:red;'>网</span><span style='color:red;'>鼎</span><span style='color:red;'>杯</span> <span style='color:red;'>2020</span> <span style='color:red;'>朱雀</span><span style='color:red;'>组</span>]<span style='color:red;'>phpweb</span>](https://i-blog.csdnimg.cn/direct/e189c50ce5ef47fda1285f70f06d9d6b.png)
![[<span style='color:red;'>网</span><span style='color:red;'>鼎</span><span style='color:red;'>杯</span> <span style='color:red;'>2020</span> <span style='color:red;'>朱雀</span><span style='color:red;'>组</span>]<span style='color:red;'>phpweb</span>1](https://img-blog.csdnimg.cn/direct/90a2f0f5f0e04d9fab14ea60d14f9fe2.png)
![反序列化 [<span style='color:red;'>网</span><span style='color:red;'>鼎</span><span style='color:red;'>杯</span> <span style='color:red;'>2020</span> <span style='color:red;'>朱雀</span><span style='color:red;'>组</span>]<span style='color:red;'>phpweb</span> 1](https://img-blog.csdnimg.cn/direct/7560556c9054464abdbd26c256b171e3.png)
![[<span style='color:red;'>网</span><span style='color:red;'>鼎</span><span style='color:red;'>杯</span> <span style='color:red;'>2020</span> <span style='color:red;'>朱雀</span><span style='color:red;'>组</span>]Nmap1](https://img-blog.csdnimg.cn/direct/161c13906fa947db88844286c83aac44.png)
![[<span style='color:red;'>网</span><span style='color:red;'>鼎</span><span style='color:red;'>杯</span> <span style='color:red;'>2020</span> 青龙<span style='color:red;'>组</span>]AreUSerialz](https://img-blog.csdnimg.cn/direct/3f9117e7bccc4403bfe20690a4fd3545.png)
![[<span style='color:red;'>网</span><span style='color:red;'>鼎</span><span style='color:red;'>杯</span> <span style='color:red;'>2020</span> 青龙<span style='color:red;'>组</span>]AreUSerialz1](https://img-blog.csdnimg.cn/direct/8ddf9308eb744e04aef5bb6257ef13dc.png)
![[<span style='color:red;'>网</span><span style='color:red;'>鼎</span><span style='color:red;'>杯</span> <span style='color:red;'>2020</span> 青龙<span style='color:red;'>组</span>]AreUSerialz](https://img-blog.csdnimg.cn/direct/414b2bb89c554c538e18c780330bd58c.png)
