add web200-8

web200-8/Dockerfile

@@ -0,0 +1 @@
+FROM 1and1internet/ubuntu-16-apache-php-7.0:latest

web200-8/docker-compose.yml

@@ -0,0 +1,8 @@
+version: '2'
+services:
+  apache2-php7:
+    build: ./
+    volumes:
+    - ./www:/var/www/html/
+    ports:
+    - "8080:8080"

web200-8/writeup.md

@@ -0,0 +1 @@
+[https://xz.aliyun.com/t/3174#toc-0](https://xz.aliyun.com/t/3174#toc-0)

web200-8/www/admin.php

@@ -0,0 +1,8 @@
+<?php
+if(empty($_SESSION['name'])){
+    session_start();
+    #echo 'hello ' + $_SESSION['name'];
+}else{
+    die('you must login with admin');
+}
+?>

web200-8/www/function.php

@@ -0,0 +1,9 @@
+<?php
+function filters($data){
+    foreach($data as $key=>$value){
+        if(preg_match('/eval|assert|exec|passthru|glob|system|popen/i',$value)){
+            die('Do not hack me!');
+        }
+    }
+}
+?>

web200-8/www/index.php

@@ -0,0 +1,14 @@
+<?php
+    highlight_file(__FILE__);
+    error_reporting(0);
+    ini_set('open_basedir', '/var/www/html:/tmp');
+    $file = 'function.php';
+    $func = isset($_GET['function'])?$_GET['function']:'filters'; 
+    call_user_func($func,$_GET);
+    include($file);
+    session_start();
+    $_SESSION['name'] = $_POST['name'];
+    if($_SESSION['name']=='admin'){
+        header('location:admin.php');
+    }
+?>

web200-8/www/sess_hc47qbga0gqeonmhm1pai6c704

@@ -0,0 +1 @@
+name|N;