前面我们测试了在攻击与防护方面的利用，接下来山石安研院研究人员将以一系列的常见题目测试，来深入探讨 ChatGPT AI 在CTF等各类信息安全竞赛中的题目设计与解题应用。我们先试试让chatGPT出一道CTF题目吧，举个例子，让它出个php反序列化相关的题目：
<?php
if (isset($_GET[\'page\'])) {
$page = $_GET[\'page\'];
include($page);
} else {
include(\'home.php\');
}
?>
<?php
if(isset($_POST[\'cmd\'])){
$cmd = $_POST[\'cmd\'];
$output = shell_exec($cmd);
echo \"<pre>$output</pre>\";
}
?>
<!DOCTYPE html>
<html>
<head>
<title>Command Injection</title>
</head>
<body>
<h1>Command Injection</h1>
<form method=\"post\">
<label for=\"cmd\">Enter command:</label>
<input type=\"text\" id=\"cmd\" name=\"cmd\">
<input type=\"submit\" value=\"Submit\">
</form>
</body>
</html>
<?php
$allowed_types = [\'image/gif\', \'image/jpeg\', \'image/png\'];
$max_size = 1024 * 1024;
if ($_SERVER[\'REQUEST_METHOD\'] === \'POST\') {
if (!empty($_FILES[\'image\'])) {
$image = $_FILES[\'image\'];
if (in_array($image[\'type\'], $allowed_types) && $image[\'size\'] <= $max_size) {
$filename = uniqid() . \'.\' . pathinfo($image[\'name\'], PATHINFO_EXTENSION);
move_uploaded_file($image[\'tmp_name\'], \'uploads/\' . $filename);
echo \'上传成功\';
} else {
echo \'上传失败\';
}
}
}
$files = glob(\'uploads/*.{gif,jpg,png}\', GLOB_BRACE);
?>
<!DOCTYPE html>
<html>
<head>
<meta charset=\"UTF-8\">
<title>图片上传</title>
</head>
<body>
<h1>图片上传</h1>
<form action=\"\" method=\"post\" enctype=\"multipart/form-data\">
<input type=\"file\" name=\"image\">
<button type=\"submit\">上传</button>
</form>
<h1>已上传的图片</h1>
<?php foreach ($files as $file) : ?>
<img src=\"<?php echo $file; ?>\" height=\"200\">
<br>
<?php endforeach; ?>
</body>
</html>
<?php
if (isset($_GET[\'image\'])) {
$image = $_GET[\'image\'];
include \'uploads/\' . $image;
}
?>
<!DOCTYPE html>
<html>
<head>
<meta charset=\"UTF-8\">
<title>查看图片</title>
</head>
<body>
<h1>查看图片</h1>
<?php foreach (glob(\'uploads/*.{gif,jpg,png}\', GLOB_BRACE) as $file) : ?>
<a href=\"view.php?image=<?php echo basename($file); ?>\"><?php echo basename($file); ?></a>
<br>
<?php endforeach; ?>
</body>
</html>
<?php
highlight_file(__FILE__);
include(\"flag.php\");
class mylogin{
var $user;
var $pass;
function __construct($user,$pass){
$this->user=$user;
$this->pass=$pass;
}
function login(){
if ($this->user==\"daydream\" and $this->pass==\"ok\"){
return 1;
}
}
}
$a=unserialize(\"\");
if($a->login())
{
echo $flag;
}
?>
<?php
//flag is in flag.php
highlight_file(__FILE__);
class Modifier {
private $var;
public function append($value)
{
include($value);
echo $flag;
}
public function __invoke(){
$this->append($this->var);
}
}
class Show{
public $source;
public $str;
public function __toString(){
return $this->str->source;
}
public function __wakeup(){
echo $this->source;
}
}
class Test{
public $p;
public function __construct(){
$this->p = array();
}
public function __get($key){
$function = $this->p;
return $function();
}
}
if(isset($_GET[\'pop\'])){
unserialize($_GET[\'pop\']);
}
?>