{"id":134,"date":"2026-09-03T08:28:10","date_gmt":"2026-09-03T00:28:10","guid":{"rendered":"https:\/\/cookie-qwq.xyz\/?p=134"},"modified":"2026-09-05T14:24:28","modified_gmt":"2026-09-05T06:24:28","slug":"%e9%9d%92%e5%b2%91ctf-%e5%ae%87%e5%ae%99%e7%9a%84%e4%b8%ad%e5%bf%83%e6%98%afphp","status":"publish","type":"post","link":"https:\/\/cookie-qwq.xyz\/index.php\/2026\/09\/03\/%e9%9d%92%e5%b2%91ctf-%e5%ae%87%e5%ae%99%e7%9a%84%e4%b8%ad%e5%bf%83%e6%98%afphp\/","title":{"rendered":"\u9752\u5c91CTF-\u5b87\u5b99\u7684\u4e2d\u5fc3\u662fPHP"},"content":{"rendered":"\n
\"\"<\/div><\/figure>\n\n\n\n

\u542f\u52a8\u5bb9\u5668<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u6765\u5230\u9898\u76ee\uff0c\u53d1\u73b0\u53ea\u6709\u4e00\u4e2aPHP\u52a8\u753b\uff0c\u5c1d\u8bd5\u6309F12\u6253\u5f00\u5f00\u53d1\u8005\u9009\u9879\/\u67e5\u770b\u9875\u9762\u6e90\u4ee3\u7801\u53d1\u73b0\u4e0d\u884c\uff0c\u4f7f\u7528\u5feb\u6377\u952eCTRL+SHIFT+I<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u8fd9\u91cc\u63d0\u793a\u4e86\u8fd9\u7bc7\u9ed1\u6697\u7684\u79d8\u5bc6\uff0c\u5728URL\u680f\u4e0a\u8f93\u5165<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u6765\u5230\u5168\u65b0\u9875\u9762\uff0c\u5206\u6790\u4ee3\u7801\uff0c\u7ecf\u8fc7POST\u4f20\u9012\u8fc7\u6765\u7684\u6570\u636e\u4f1a\u7ecf\u8fc7intval()\u51fd\u6570\u7684\u68c0\u67e5\uff0c\u7b26\u5408\u6761\u4ef6\u5c31\u8fd4\u56deflag\uff0c\u4e0d\u7b26\u5408\u6761\u4ef6\u5c31\u8f93\u51fa\u201c\u4f60\u8fd8\u672a\u53c2\u900f\u5965\u79d8\u201d<\/p>\n\n\n\n

\u8fd9\u91cc\u6211\u4eec\u9996\u5148\u9700\u8981\u77e5\u9053php\u4e2dintval()\u51fd\u6570\u7684\u4f5c\u7528\u3002<\/p>\n\n\n\n

PHP\u4e2d\u7684intval()\u51fd\u6570\uff0c\u4e3b\u8981\u7528\u4e8e\u83b7\u53d6\u53d8\u91cf\u7684\u6574\u6570\u503c<\/p>\n\n\n\n

\u683c\u5f0f\uff1a<\/p>\n\n\n\n

int intval(mixed $value, int $base = 10):int<\/p>\n\n\n\n

$value\uff1a\u9700\u8981\u8f6c\u6362\u7684\u6807\u91cf\u503c\uff08\u6570\u5b57\u3001\u5b57\u7b26\u4e32\u3001\u5e03\u5c14\u503c\u7b49\uff09<\/p>\n\n\n\n

$base\uff1a\u8f6c\u6362\u6240\u7528\u7684\u8fdb\u5236\uff08\u53ef\u9009\uff0c\u9ed8\u8ba4\u4e3a10\uff09\u3002\u4ec5\u5728$value\u662f\u5b57\u7b26\u4e32\u65f6\u751f\u6548\u3002<\/p>\n\n\n\n

\u5982\u679c\u8bbe\u7f6e\u4e3a0\uff0c\u5219\u6839\u636e\u5b57\u7b26\u4e32\u524d\u7f00\u81ea\u884c\u5224\u65ad<\/p>\n\n\n\n

0x\u5f00\u5934\u8bc6\u522b\u4e3a16\u8fdb\u5236<\/p>\n\n\n\n

0b\u5f00\u5934\u8bc6\u522b\u4e3a2\u8fdb\u5236\uff0c<\/p>\n\n\n\n

0\u5f00\u5934\u8bc6\u522b\u4e3a8\u8fdb\u5236<\/p>\n\n\n\n

\u5e38\u89c1\u7528\u6cd5\u53ca\u8f6c\u6362<\/p>\n\n\n\n

\u6d6e\u70b9\u6570\u622a\u65ad\uff1a\u76f4\u63a5\u5411\u4e0b\u820d\u5f03\u5c0f\u6570\u90e8\u5206\uff0c\u4e0d\u8fdb\u884c\u56db\u820d\u4e94\u5165<\/p>\n\n\n\n

intval(4.2);  \/\/ 4<\/p>\n\n\n\n

intval(4.9);  \/\/ 4<\/p>\n\n\n\n

intval(-4.9); \/\/ -4<\/p>\n\n\n\n

\u5b57\u7b26\u4e32\u8f6c\u6362\uff1a\u4ece\u5b57\u7b26\u4e32\u5de6\u4fa7\u5f00\u59cb\u89e3\u6790\uff0c\u76f4\u5230\u9047\u5230\u7b2c\u4e00\u4e2a\u975e\u6709\u6548\u6570\u5b57\u5b57\u7b26\u505c\u6b62\uff1b\u82e5\u5f00\u5934\u4e0d\u662f\u6570\u5b57\u5219\u8fd4\u56de0.<\/p>\n\n\n\n

intval(“42”);     \/\/ 42<\/p>\n\n\n\n

intval(“42abc”);  \/\/ 42<\/p>\n\n\n\n

intval(“abc42”);  \/\/ 0<\/p>\n\n\n\n

\u4e0d\u540c\u8fdb\u5236\u8f6c\u6362<\/p>\n\n\n\n

intval(“1a”, 16); \/\/ 26 (16 \u8fdb\u5236)<\/p>\n\n\n\n

intval(“012”, 8);  \/\/ 10 (8 \u8fdb\u5236)<\/p>\n\n\n\n

intval(“0x1a”, 0); \/\/ 26 (\u81ea\u52a8\u8bc6\u522b\u4e3a 16 \u8fdb\u5236)<\/p>\n\n\n\n

\u5e03\u5c14\u4e0e\u7279\u6b8a\u503c\uff1a<\/p>\n\n\n\n

intval(true);   \/\/ 1<\/p>\n\n\n\n

intval(false);  \/\/ 0<\/p>\n\n\n\n

intval(null);   \/\/ 0<\/p>\n\n\n\n

intval([]);     \/\/ 0 (\u7a7a\u6570\u7ec4\u8fd4\u56de 0\uff0c\u975e\u7a7a\u6570\u7ec4\u8fd4\u56de 1)<\/p>\n\n\n\n

\u89e3\u9898\u601d\u8def\uff1a<\/p>\n\n\n\n

\u6838\u5fc3\uff0c\u5229\u7528\u8fdb\u5236\u7279\u6027\u7ed5\u8fc7<\/p>\n\n\n\n

\u5148\u628a\u5341\u8fdb\u523647\u8f6c\u6210\u516b\u8fdb\u5236\u4e3a\uff1a57<\/p>\n\n\n\n

\u5728PHP\u5b57\u7b26\u4e32\u4e2d\u8868\u793a8\u8fdb\u5236\u8981\u52a0\u4e0a\u524d\u7f000\uff0c\u5373057<\/p>\n\n\n\n

\u7531\u4e8e\u4f20\u9012\u65b9\u5f0f\u4f7f\u7528\u7684\u662f$_POST[‘newstart2025’]\uff0c\u6240\u4ee5\u5fc5\u987b\u6784\u9020POST\u8bf7\u6c42<\/p>\n\n\n\n

\u6709\u4ee5\u4e0b\u51e0\u79cd\u65b9\u6cd5<\/p>\n\n\n\n

payload\u6784\u9020\u539f\u7406<\/p>\n\n\n\n

Intval($answer\uff0c0) == 47\uff08base\u4e3a0\u65f6\u4f1a\u6839\u636e\u524d\u7f00\u81ea\u52a8\u8bc6\u522b\u8fdb\u5236\uff0c\u89e3\u6790\u540e\u7b49\u4e8e47\uff09<\/p>\n\n\n\n

\u2460\u3001\u4f7f\u7528hackbar\u6784\u9020<\/p>\n\n\n\n

\u9009\u62e9POST\u8bf7\u6c42\u65b9\u5f0f\uff0cURL\u4e3a\u9898\u76ee\u94fe\u63a5\uff0cBody\u53c2\u6570\u9ed8\u8ba4\u5373\u53ef<\/p>\n\n\n\n

payload\uff1a<\/p>\n\n\n\n

newstar2025=057\/newstar2025=0x2f<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u62ff\u5230\u4e86flag<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u2461\u3001\u7ec8\u7aefcurl\u547d\u4ee4\uff1a<\/p>\n\n\n\n

curl -X POST -d “newstar2025=057” http:\/\/\u9898\u76eeURL<\/a><\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

\u542f\u52a8\u5bb9\u5668 \u6765\u5230\u9898\u76ee\uff0c\u53d1\u73b0\u53ea\u6709\u4e00\u4e2aPHP\u52a8\u753b\uff0c\u5c1d\u8bd5\u6309F12\u6253\u5f00\u5f00\u53d1\u8005\u9009\u9879\/\u67e5\u770b\u9875\u9762\u6e90\u4ee3\u7801\u53d1\u73b0\u4e0d\u884c\uff0c\u4f7f\u7528\u5feb\u6377\u952eCT […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[6,16,15],"class_list":["post-134","post","type-post","status-publish","format-standard","hentry","category-archives","tag-ctf","tag-php","tag-web"],"_links":{"self":[{"href":"https:\/\/cookie-qwq.xyz\/index.php\/wp-json\/wp\/v2\/posts\/134","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cookie-qwq.xyz\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cookie-qwq.xyz\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cookie-qwq.xyz\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cookie-qwq.xyz\/index.php\/wp-json\/wp\/v2\/comments?post=134"}],"version-history":[{"count":1,"href":"https:\/\/cookie-qwq.xyz\/index.php\/wp-json\/wp\/v2\/posts\/134\/revisions"}],"predecessor-version":[{"id":152,"href":"https:\/\/cookie-qwq.xyz\/index.php\/wp-json\/wp\/v2\/posts\/134\/revisions\/152"}],"wp:attachment":[{"href":"https:\/\/cookie-qwq.xyz\/index.php\/wp-json\/wp\/v2\/media?parent=134"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cookie-qwq.xyz\/index.php\/wp-json\/wp\/v2\/categories?post=134"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cookie-qwq.xyz\/index.php\/wp-json\/wp\/v2\/tags?post=134"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}