DASCTF X GFCTF 2022十月挑战赛！

最新推荐文章于 2025-04-01 22:09:27 发布

原创

最新推荐文章于 2025-04-01 22:09:27 发布 · 1.7k 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#php #web安全 #安全

博客围绕PHP Web安全展开，介绍了EasyPOP和hade_waibo两道题的解题思路。EasyPOP通过触发一系列方法利用代码；hade_waibo利用任意文件包含、phar反序列化等，结合恒定式和可控变量，上传特定文件并使用phar伪协议包含，最终列出目录找到flag文件。

EasyPOP

 <?php
highlight_file(__FILE__);
error_reporting(0);

class fine
{
   
   
    private $cmd;
    private $content;

    public function __construct($cmd, $content)
    {
   
   
        $this->cmd = $cmd;
        $this->content = $content;
    }

    public function __invoke()
    {
   
   
        call_user_func($this->cmd, $this->content);
    }

    public function __wakeup()
    {
   
   
        $this->cmd = "";
        die("Go listen to Jay Chou's secret-code! Really nice");
    }
}

class show
{
   
   
    public $ctf;
    public $time = "Two and a half years";

    public function __construct($ctf)
    {
   
   
        $this->ctf = $ctf;
    }


    public function __toString()
    {
   
   
        return $this->ctf->show();
    }

    public function show(): string
    {
   
   
        return $this->ctf . ": Duration of practice: " . $this->time;
    }


}

class sorry
{
   
   
    private $name;
    private $password;
    public $hint = "hint is depend on you";
    public $key;

    public function __construct($name, $password)
    {
   
   
        $this->name = $name;
        $this->password = $password;
    }

    public function __sleep()
    {
   
   
        $this->hint = new secret_code();
    }

    public function __get($name)
    {
   
   
        $name = $this->key;
        $name();
    }


    public function __destruct()
    {
   
   
        if ($this->password == $this->name) {
   
   

            echo $this->hint;
        } else if ($this->name = "jay") {
   
   
            secret_code::secret();
        } else {
   
   
            echo "This is our code";
        }
    }


    public function getPassword()
    {

最低0.47元/天解锁文章