日期：
来源：山石网科安全技术研究院收集编辑：V1nt
前面我们测试了在攻击与防护方面的利用，接下来山石安研院研究人员将以一系列的常见题目测试，来深入探讨 ChatGPT AI 在CTF等各类信息安全竞赛中的题目设计与解题应用。我们先试试让chatGPT出一道CTF题目吧，举个例子，让它出个php反序列化相关的题目：
<?php
if (isset($_GET['page'])) {
$page = $_GET['page'];
include($page);
} else {
include('home.php');
}
?>
<?php
if(isset($_POST['cmd'])){
$cmd = $_POST['cmd'];
$output = shell_exec($cmd);
echo "<pre>$output</pre>";
}
?>
<!DOCTYPE html>
<html>
<head>
<title>Command Injection</title>
</head>
<body>
<h1>Command Injection</h1>
<form method="post">
<label for="cmd">Enter command:</label>
<input type="text" id="cmd" name="cmd">
<input type="submit" value="Submit">
</form>
</body>
</html>
<?php
$allowed_types = ['image/gif', 'image/jpeg', 'image/png'];
$max_size = 1024 * 1024;
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!empty($_FILES['image'])) {
$image = $_FILES['image'];
if (in_array($image['type'], $allowed_types) && $image['size'] <= $max_size) {
$filename = uniqid() . '.' . pathinfo($image['name'], PATHINFO_EXTENSION);
move_uploaded_file($image['tmp_name'], 'uploads/' . $filename);
echo '上传成功';
} else {
echo '上传失败';
}
}
}
$files = glob('uploads/*.{gif,jpg,png}', GLOB_BRACE);
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>图片上传</title>
</head>
<body>
<h1>图片上传</h1>
<form action="" method="post" enctype="multipart/form-data">
<input type="file" name="image">
<button type="submit">上传</button>
</form>
<h1>已上传的图片</h1>
<?php foreach ($files as $file) : ?>
<img src="<?php echo $file; ?>" height="200">
<br>
<?php endforeach; ?>
</body>
</html>
<?php
if (isset($_GET['image'])) {
$image = $_GET['image'];
include 'uploads/' . $image;
}
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>查看图片</title>
</head>
<body>
<h1>查看图片</h1>
<?php foreach (glob('uploads/*.{gif,jpg,png}', GLOB_BRACE) as $file) : ?>
<a href="view.php?image=<?php echo basename($file); ?>"><?php echo basename($file); ?></a>
<br>
<?php endforeach; ?>
</body>
</html>
<?php
highlight_file(__FILE__);
include("flag.php");
class mylogin{
var $user;
var $pass;
function __construct($user,$pass){
$this->user=$user;
$this->pass=$pass;
}
function login(){
if ($this->user=="daydream" and $this->pass=="ok"){
return 1;
}
}
}
$a=unserialize("");
if($a->login())
{
echo $flag;
}
?>
<?php
//flag is in flag.php
highlight_file(__FILE__);
class Modifier {
private $var;
public function append($value)
{
include($value);
echo $flag;
}
public function __invoke(){
$this->append($this->var);
}
}
class Show{
public $source;
public $str;
public function __toString(){
return $this->str->source;
}
public function __wakeup(){
echo $this->source;
}
}
class Test{
public $p;
public function __construct(){
$this->p = array();
}
public function __get($key){
$function = $this->p;
return $function();
}
}
if(isset($_GET['pop'])){
unserialize($_GET['pop']);
}
?>