https://baozongwi.xyz/tags/duckdb/Currently exploring Java security and internal network penetration, with CTFs as a hobby.Hugozh-cnhttps://baozongwi.xyz/p/hkcertctf-2025/Mon, 22 Dec 2025 01:16:06 +0800https://baozongwi.xyz/p/hkcertctf-2025/renderme thinkphp 的模板注入，测试了一下，参数带外可以放恶意函数，解析的话，ThinkPHP 模板引擎支持 {$var|function}的语法，语法结构为{$待处理变量|函数名}，发现 choom 进行 suid 提权 …