[BUUCTF 2018]Online Tool

<?php

if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_FORWARDED_FOR'];
}

if(!isset($_GET['host'])) {
    highlight_file(__FILE__);
} else {
    $host = $_GET['host'];
    $host = escapeshellarg($host);
    $host = escapeshellcmd($host);
    $sandbox = md5("glzjin". $_SERVER['REMOTE_ADDR']);
    echo 'you are in sandbox '.$sandbox;
    @mkdir($sandbox);
    chdir($sandbox);
    echo system("nmap -T5 -sT -Pn --host-timeout 2 -F ".$host);
}

system()命令执行函数中存在可控变量，考虑为rce漏洞，这就是利用点了。

参考文章：

https://github.com/hongriSec/PHP-Audit-Labs/blob/master/Part1/Day5/files/README.md

https://blog.csdn.net/mochu7777777/article/details/110605396

https://blog.csdn.net/qq_26406447/article/details/100711933