ctfshow————反序列化

最新推荐文章于 2025-04-07 11:43:32 发布

Anfy1

最新推荐文章于 2025-04-07 11:43:32 发布

阅读量973

点赞数 1

分类专栏：反序列化

本文链接：https://blog.youkuaiyun.com/qq_45655564/article/details/118253936

版权

本文详细介绍了多个CTF挑战中的PHP反序列化漏洞，从简单的GET参数传递，到改变类属性值，甚至利用 SoapClient 和 Yii2.0 框架进行反序列化攻击。通过实例分析了不同场景下的反序列化漏洞利用方法，包括弱类型、反序列化逃逸和PHP session漏洞等。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

web254-普通的get传参

<?php

/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2020-12-02 17:44:47
# @Last Modified by:   h1xa
# @Last Modified time: 2020-12-02 19:29:02
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

*/

error_reporting(0);
highlight_file(__FILE__);
include('flag.php');

class ctfShowUser{
   
    public $username='xxxxxx';
    public $password='xxxxxx';
    public $isVip=false;

    public function checkVip(){
   
        return $this->isVip;
    }
    public function login($u,$p){
   
        return $this->username===$u&&$this->password===$p;
    }
    public function vipOneKeyGetFlag(){
   
        if($this->isVip){
   
            global $flag;
            echo "your flag is ".$flag;
        }else{
   
            echo "no vip, no flag";
        }
    }
}

$username=$_GET['username'];
$password=$_GET['password'];

if(isset($username) && isset($password)){
   
    $user =  new Ctfshowuser()
        
    if($user->login($username,$password)){
   
        if($user->checkVip()){
   
            $user->vipOneKeyGetFlag();
        }
    }else{
   
        echo "no vip,no flag";
    }
}

username=xxxxxx&password=xxxxxx

web255-改变类的属性的值

<?php

/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2020-12-02 17:44:47
# @Last Modified by:   h1xa
# @Last Modified time: 2020-12-02 19:29:02
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

*/

error_reporting(0);
highlight_file(__FILE__);
include('flag.php');

class ctfShowUser{
   
    public $username='xxxxxx';
    public $password='xxxxxx';
    public $isVip=false;

    public function checkVip(){
   
        return $this->isVip;
    }
    public function login($u,$p){
   
        return $this->username===$u&&$this->password===$p;
    }
    public function vipOneKeyGetFlag(){
   
        if($this->isVip){
   
            global $flag;
            echo "your flag is ".$flag;
        }else{
   
            echo "no vip, no flag";
        }
    }
}

$username=$_GET['username'];
$password=$_GET['password'];

if

最低0.47元/天解锁文章