{"action":"created","issue":{"url":"https://api.github.com/repos/louchaooo/louchaooo.github.io/issues/20","repository_url":"https://api.github.com/repos/louchaooo/louchaooo.github.io","labels_url":"https://api.github.com/repos/louchaooo/louchaooo.github.io/issues/20/labels{/name}","comments_url":"https://api.github.com/repos/louchaooo/louchaooo.github.io/issues/20/comments","events_url":"https://api.github.com/repos/louchaooo/louchaooo.github.io/issues/20/events","html_url":"https://github.com/louchaooo/louchaooo.github.io/issues/20","id":182231641,"number":20,"title":"代码审计从小段开始","user":{"login":"louchaooo","id":12745454,"avatar_url":"https://avatars.githubusercontent.com/u/12745454?v=3","gravatar_id":"","url":"https://api.github.com/users/louchaooo","html_url":"https://github.com/louchaooo","followers_url":"https://api.github.com/users/louchaooo/followers","following_url":"https://api.github.com/users/louchaooo/following{/other_user}","gists_url":"https://api.github.com/users/louchaooo/gists{/gist_id}","starred_url":"https://api.github.com/users/louchaooo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/louchaooo/subscriptions","organizations_url":"https://api.github.com/users/louchaooo/orgs","repos_url":"https://api.github.com/users/louchaooo/repos","events_url":"https://api.github.com/users/louchaooo/events{/privacy}","received_events_url":"https://api.github.com/users/louchaooo/received_events","type":"User","site_admin":false},"labels":[{"id":426828824,"url":"https://api.github.com/repos/louchaooo/louchaooo.github.io/labels/code-audit","name":"code-audit","color":"b60205","default":false},{"id":459260504,"url":"https://api.github.com/repos/louchaooo/louchaooo.github.io/labels/php","name":"php","color":"1d76db","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-10-11T10:42:41Z","updated_at":"2016-10-30T09:06:27Z","closed_at":null,"body":"```\r\n<?php\r\n\r\n\r\n$info = \"\"; \r\n$req = [];\r\n$flag=\"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\";\r\n\r\nini_set(\"display_error\", false); \r\nerror_reporting(0); \r\n\r\nif(!isset($_GET['number'])){\r\n   header(\"hint:26966dc52e85af40f59b4fe73d8c323a.txt\");\r\n   \r\n   die(\"have a fun!!\");\r\n    \r\n}\r\n\r\nforeach([$_GET, $_POST] as $global_var) { \r\n    foreach($global_var as $key => $value) { \r\n        $value = trim($value); \r\n        is_string($value) && $req[$key] = addslashes($value); \r\n    } \r\n} \r\n\r\n\r\nfunction is_palindrome_number($number) { \r\n    $number = strval($number); \r\n    $i = 0; \r\n    $j = strlen($number) - 1; \r\n    while($i < $j) { \r\n        if($number[$i] !== $number[$j]) { \r\n            return false; \r\n        } \r\n        $i++; \r\n        $j--; \r\n    } \r\n    return true; \r\n} \r\n\r\n\r\nif(is_numeric($_REQUEST['number']))\r\n{\r\n\r\n   $info=\"sorry, you cann't input a number!\";\r\n\r\n}\r\nelseif($req['number']!=strval(intval($req['number'])))\r\n{\r\n      \r\n     $info = \"number must be equal to it's integer!! \";  \r\n\r\n}\r\nelse\r\n{\r\n\r\n     $value1 = intval($req[\"number\"]);\r\n     $value2 = intval(strrev($req[\"number\"]));  \r\n\r\n     if($value1!=$value2){\r\n          $info=\"no, this is not a palindrome number!\";\r\n     }\r\n     else\r\n     {\r\n          \r\n          if(is_palindrome_number($req[\"number\"])){\r\n              $info = \"nice! {$value1} is a palindrome number!\"; \r\n          }\r\n          else\r\n          {\r\n             $info=$flag;\r\n          }\r\n     }\r\n\r\n}\r\n\r\necho $info;\r\n\r\n```"},"comment":{"url":"https://api.github.com/repos/louchaooo/louchaooo.github.io/issues/comments/257139987","html_url":"https://github.com/louchaooo/louchaooo.github.io/issues/20#issuecomment-257139987","issue_url":"https://api.github.com/repos/louchaooo/louchaooo.github.io/issues/20","id":257139987,"user":{"login":"louchaooo","id":12745454,"avatar_url":"https://avatars.githubusercontent.com/u/12745454?v=3","gravatar_id":"","url":"https://api.github.com/users/louchaooo","html_url":"https://github.com/louchaooo","followers_url":"https://api.github.com/users/louchaooo/followers","following_url":"https://api.github.com/users/louchaooo/following{/other_user}","gists_url":"https://api.github.com/users/louchaooo/gists{/gist_id}","starred_url":"https://api.github.com/users/louchaooo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/louchaooo/subscriptions","organizations_url":"https://api.github.com/users/louchaooo/orgs","repos_url":"https://api.github.com/users/louchaooo/repos","events_url":"https://api.github.com/users/louchaooo/events{/privacy}","received_events_url":"https://api.github.com/users/louchaooo/received_events","type":"User","site_admin":false},"created_at":"2016-10-30T09:06:27Z","updated_at":"2016-10-30T09:06:27Z","body":"```\r\n<?php\r\nerror_reporting(0);\r\n\r\nif (!isset($_POST['uname']) || !isset($_POST['pwd'])) {\r\n\techo '<form action=\"\" method=\"post\">'.\"<br/>\";\r\n\techo '<input name=\"uname\" type=\"text\"/>'.\"<br/>\";\r\n\techo '<input name=\"pwd\" type=\"text\"/>'.\"<br/>\";\r\n\techo '<input type=\"submit\" />'.\"<br/>\";\r\n\techo '</form>'.\"<br/>\";\r\n\techo '<!--source: source.txt-->'.\"<br/>\";\r\n    die;\r\n}\r\n\r\nfunction AttackFilter($StrKey,$StrValue,$ArrReq){  \r\n    if (is_array($StrValue)){\r\n\r\n//检测变量是否是数组\r\n\r\n        $StrValue=implode($StrValue);\r\n\r\n//返回由数组元素组合成的字符串\r\n\r\n    }\r\n    if (preg_match(\"/\".$ArrReq.\"/is\",$StrValue)==1){   \r\n\r\n//匹配成功一次后就会停止匹配\r\n\r\n        print \"水可载舟，亦可赛艇！\";\r\n        exit();\r\n    }\r\n}\r\n\r\n$filter = \"and|select|from|where|union|join|sleep|benchmark|,|\\(|\\)\";\r\nforeach($_POST as $key=>$value){ \r\n\r\n//遍历数组\r\n\r\n    AttackFilter($key,$value,$filter);\r\n}\r\n\r\n$con = mysql_connect(\"XXXXXX\",\"XXXXXX\",\"XXXXXX\");\r\nif (!$con){\r\n\tdie('Could not connect: ' . mysql_error());\r\n}\r\n$db=\"XXXXXX\";\r\nmysql_select_db($db, $con);\r\n\r\n//设置活动的 MySQL 数据库\r\n\r\n$sql=\"SELECT * FROM interest WHERE uname = '{$_POST['uname']}'\";\r\n$query = mysql_query($sql); \r\n\r\n//执行一条 MySQL 查询\r\n\r\nif (mysql_num_rows($query) == 1) { \r\n\r\n//返回结果集中行的数目\r\n\r\n    $key = mysql_fetch_array($query);\r\n\r\n//返回根据从结果集取得的行生成的数组，如果没有更多行则返回 false\r\n\r\n    if($key['pwd'] == $_POST['pwd']) {\r\n        print \"CTF{XXXXXX}\";\r\n    }else{\r\n        print \"亦可赛艇！\";\r\n    }\r\n}else{\r\n\tprint \"一颗赛艇！\";\r\n}\r\nmysql_close($con);\r\n?>\r\n```"}}
{"actor":{"display_login":"louchaooo"}}