BUUCTF-Web Comment

dirsearch扫出/.git/目录

遂用航神写的Githacker脚本 https://github.com/wangyihang/githacker

出来的源码并不完整，使用git log --reflog查看下记录

选择第一条修改的记录的commit执行git reset --hard bfbdf218902476c5c6164beedd8d2fcf593ea23b

这是恢复后的源码

 1 <?php
 2 include "mysql.php";
 3 session_start();
 4 if($_SESSION[\'login\'] != \'yes\'){
 5     header("Location: ./login.php");
 6     die();
 7 }
 8 if(isset($_GET[\'do\'])){
 9 switch ($_GET[\'do\'])
10 {
11 case \'write\':
12     $category = addslashes($_POST[\'category\']);
13     $title = addslashes($_POST[\'title\']);
14     $content = addslashes($_POST[\'content\']);
15     $sql = "insert into board
16             set category = \'$category\',
17                 title = \'$title\',
18                 content = \'$content\'";
19     $result = mysql_query($sql);
20     header("Location: ./index.php");
21     break;
22 case \'comment\':
23     $bo_id = addslashes($_POST[\'bo_id\']);
24     $sql = "select category from board where id=\'$bo_id\'";
25     $result = mysql_query($sql);
26     $num = mysql_num_rows($result);
27     if($num>0){
28     $category = mysql_fetch_array($result)[\'category\'];
29     $content = addslashes($_POST[\'content\']);
30     $sql = "insert into comment
31             set category = \'$category\',
32                 content = \'$content\',
33                 bo_id = \'$bo_id\'";
34     $result = mysql_query($sql);
35     }
36     header("Location: ./comment.php?id=$bo_id");
37     break;
38 default:
39     header("Location: ./index.php");
40 }
41 }
42 else{
43     header("Location: ./index.php");
44 }
45 ?>