https://baozongwi.xyz/tags/%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0/Currently exploring Java security and internal network penetration, with CTFs as a hobby.Hugozh-cnhttps://baozongwi.xyz/p/d3ctf-2025-d3jtar/Thu, 18 Dec 2025 22:55:03 +0800https://baozongwi.xyz/p/d3ctf-2025-d3jtar/这是一道比较简单的题目，不涉及反序列化的知识，一个 Jtar 的解析问题 git clone https://github.com/5i1encee/D3CTF2025-d3jtar.git wget -O jdk-8u202-linux-x64.tar.gz …https://baozongwi.xyz/p/longjian-cup-finals-2025/Fri, 19 Sep 2025 22:53:10 +0800https://baozongwi.xyz/p/longjian-cup-finals-2025/ezzupload 查看文件，拿到源码 <?php session_start(); $session_id = session_id(); $target_dir = "/var/www/html/uploads/$session_id/"; if (!is_dir($target_dir)) { …https://baozongwi.xyz/p/shield-2025-iov-prelim/Wed, 20 Aug 2025 13:36:21 +0800https://baozongwi.xyz/p/shield-2025-iov-prelim/firmware-update-system-web admin\admin123登录后台，看到Apache/2.4.54，直接上传恶意文件压缩的包 POST /upload.php HTTP/1.1 Host: 124.133.253.44:32855 Content-Length: 375 …https://baozongwi.xyz/p/file-upload-case-study/Tue, 17 Sep 2024 21:36:55 +0000https://baozongwi.xyz/p/file-upload-case-study/0x01 前言 之前一般遇到的文件上传，仅仅考虑header等操作就可以了，但是前几天却遇到了一个与流量包相关联的，那么，让我想起了墨者杯，顺便也来记录一下 0x02 question 这道题目，是和一个师傅交流之后(由于没有电脑)，由那位师傅打通 whereisfilepath 既然是文件上传而且给了流量包，我们先看 …