Glut4micum
0%

出题

发表于 分类于
cookie篡改 反序列化：多加一些干扰项,循环调用，关键字绕过 $$ 套一下unserialize(base64_decode()) ​ setcookie('cookie_name', '', time() - 3600);//删除不用的cookie值 WOWO->destruct()->NAN…

出题

cookie篡改

反序列化：多加一些干扰项,循环调用，关键字绕过 $$

套一下unserialize(base64_decode())

​

setcookie(‘cookie_name’, ‘’, time() - 3600);//删除不用的cookie值

WOWO->destruct()->NANI->__Set()->Soga->__invoke->WOW->__get()–>H->_toString

绕过正则表达式

(preg_match(’/[oc]:\d+:/i’, $var))

$b=str_replace(“O:4”,”O:+4”,$b); #正则绕过

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
<?php
highlight_file(__FILE__);
error_reporting(0);

class WOWO{
    private $nano;
    public $hahaha;
    public $evn;

    public function __destruct()
    {
        $this->evn->do='do you know serialize?';
    }

    public function __get($a){
        echo $this->hahaha;
    }
}

class Soga{
    public $asdj;
    public $grape;

    public function __invoke()
    {
        return $this->asdj->nano;
    }
    public  function __toString()
    {
        $this->grape='123';
        return 'are you sure?';
    }
}

class H{
    public $a ;
    public $b ;

    public function __toString()
    {
        $Love=$this->a;
        $Love('',$this->b);
        return "it's too esay,yet?";
    }
}

class NANI{
    public $lal;
    public $so;

    public function __set($star,$bob){
        $str=$this->lal;
        $str();

    }
}

class Dman{
    public $apple;
    public $strawberry;

    public function __invoke(){
        return $this->apple;
    }

    public function __get($a){
        $des=$this->strawberry;
        $des();
    }

}

class Hnu{
    public $sun='HnuSec is very good';
    public $setad='do you think so?';

    public function __destruct(){
        if($this->setad='yes'){
            echo 'Thank you,have a fun.';
        }
    }
}

if(isset($_POST['Hun'])){
    $cmd=$_POST['Hun'];
    if(!preg_match('/[oc]:\d+:/i', $cmd))
        unserialize(base64_decode($cmd));
    else
        echo "OMG!what's the promblem?";

}

?>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
<?php
$flag = "flag{this_is_a_fake_flag}";
header("Content-type:text/html;charset=utf-8");
error_reporting(0);
if(!isset($_COOKIE['role'])){
    setcookie('role','guest');
    $_COOKIE['role'] = 'guest';
}

if($_COOKIE['role'] != 'admin'){
    die('<h1>You are not admin!!!!</h1>');
}
echo '/hhhheelllloooo.php';

​

来源: https://www.yuque.com/guansuanbangzhuangganjun/oxmbxg/lxcnicnte147pg63
语雀文档ID: 182096628