[网络安全 CTF] 记一次PHP序列化反序列化解题详析_ctfphp的new类

最新推荐文章于 2024-09-15 14:09:20 发布

2401_84971562

最新推荐文章于 2024-09-15 14:09:20 发布

阅读量598

点赞数 4

分类专栏：程序员文章标签： web安全 php android

本文链接：https://blog.youkuaiyun.com/2401_84971562/article/details/138784758

版权

<?php
error\_reporting(0);
function backdoor()
{
    $a = $\_GET["a"];
    $b = $\_GET["b"];
    $d = $\_GET["d"];
    $e = $\_GET["e"];
    $f = $\_GET["f"];
    $g = $\_GET["g"];
    $class = new $a($b);
    $str1 = substr($class, $d, $e);
    $str2 = substr($class, $f, $g);
    $str1($str2);
}

class popko
{
    public $left;
    public $right;

    public function \_\_call($method,$args)
    {
        if (($this->left != $this->right) && (md5($this->left) === md5($this->right)) && (sha1($this->left) === sha1($this->right))) {
            echo "backdoor is here";
            backdoor();
        }
    }

    public function \_\_wakeup()
    {
        $this->left = "";
        $this->right = "";
    }
}

class pipimi
{
    function \_\_destruct()
    {
        echo $this->a->a();