第0天，掉dokuwiki坑，文件都上传了，不解析拿不到shell；痛苦
第1天，掉header坑，改了十多种头，组合N个IP都没用；绝望
第2天，掉gopher坑，怎么绕都不行；无奈

结果发现是curl_exec的独特特性，还是知识面浅了，致敬533K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3y4F1i4K6u0V1M7$3g2U0i4K6u0W2j5$3!0E0i4K6u0r3j5i4u0U0K9r3W2$3k6i4y4Q4x3V1j5I4y4e0p5H3x3K6c8Q4x3X3g2Z5N6r3#2D9i4@1g2r3i4@1u0o6i4K6W2m8

=====================

1. 8cfK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5J5x3g2)9J5k6e0x3$3i4K6u0W2x3e0b7#2i4K6u0W2x3e0f1%4i4K6y4m8z5o6l9@1y4q4)9J5c8R3`.`.
2. 查看源码
3. 453K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5J5x3g2)9J5k6e0x3$3i4K6u0W2x3e0b7#2i4K6u0W2x3e0f1%4i4K6y4m8z5o6l9@1y4q4)9J5c8Y4m8Z5M7r3W2F1k6X3!0Q4x3X3g2H3K9s2l9`. 得到物理路径
4. 0baK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5J5x3g2)9J5k6e0x3$3i4K6u0W2x3e0b7#2i4K6u0W2x3e0f1%4i4K6y4m8z5o6l9@1y4q4)9J5c8Y4g2J5L8q4)9J5k6i4m8Z5M7q4)9K6c8Y4g2J5L8q4)9K6c8r3k6A6L8r3g2Q4x3@1q4Q4x3V1k6Q4x3V1j5I4x3U0N6Q4x3X3f1H3i4K6u0W2x3q4)9J5k6e0q4Q4x3V1k6Q4x3X3g2Q4x3X3g2Q4x3V1k6Q4x3X3g2Q4x3X3g2Q4x3V1k6Q4x3X3g2Q4x3X3g2Q4x3V1k6Q4x3X3g2Q4x3X3g2Q4x3V1k6Q4x3X3g2Q4x3X3g2Q4x3V1k6$3j5i4u0Q4x3V1k6%4N6%4N6Q4x3V1k6Z5N6r3#2D9i4K6u0r3N6i4u0D9i4K6u0W2M7r3S2H3 得到源码
5. 435K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5J5x3g2)9J5k6e0x3$3i4K6u0W2x3e0b7#2i4K6u0W2x3e0f1%4i4K6y4m8z5o6l9@1y4q4)9J5c8Y4g2J5L8q4)9J5k6i4m8Z5M7q4)9K6c8Y4g2J5L8q4)9K6c8o6p5J5x3#2)9J5k6e0f1%4i4K6u0W2x3U0f1@1i4K6u0W2y4o6u0Q4x3@1q4Q4x3V1k6Q4x3V1j5I4x3U0N6Q4x3X3f1H3i4K6u0W2x3q4)9J5k6e0q4Q4x3V1k6Q4x3X3g2Q4x3X3g2Q4x3V1k6X3L8r3q4Y4i4K6u0W2M7r3S2H3 得到flag
   
   flag{xxx_999()xx*@eeEEE}

[培训]科锐逆向工程师培训第53期2025年7月8日开班！