Revisited deserialization
The last time we use phpggc generated deserialization pop chain can take advantage of the successful implementation of the code execution, and analysis of the entire process. But based on the attitude of learning, I began to try to find their own pop a chain available
Zend\Ldap\Collection
Call the close method, and then call the close method iterator property. When the present method does not close the corresponding iterator class attribute, __call method calls the class
Zend\Filter\Compress
First method called getAdapter
First determine the $ this-> adapter is not Compress \ CompressionAlgorithmInterface class, if it is returned directly, and then also get the class attribute adapterOptions
If $ Adapter class exists, the line 104 is performed in the new operation, and this type of controllable parameter values are our next looks for a constructor can take advantage
Zend\Validator\Callback
Line 55 calls the constructor of the parent class
Zend\Validator\AbstractValidator
Looking directly at the 81-line, $ options judgment is not an array, and then call the method setOption
Was removed from the Options $ $ $ Options and name, plus the name $ front and IS set, then proceeds to determine if the class contains the method is called.
There is a method isValid Zend \ Validator \ Callback class
The presence of 139 lines call_user_func_array function, value of $ args here is that we passed in $ vaue value. Look at $ callback is not controllable. $ Callback acquisition
It is taken from the $ this-> options array inside. Look how this value is set
Foregoing methods are set, so we can assign values to $ this-> options [ 'callback'] setoptions values of the parent class. So we have two parameters call_user_func_array functions are controlled, you can achieve code execution.
the entire process
Zend\Ldap\Collection
__destruct()
->
Zend\Ldap\Collection
$this->iterator->close()
->
Zend\Filter\Compress
__call()
->
Zend\Filter\Compress
getAdapter()
->
Zend\Validator\Callback
__construct
->
Zend\Validator\Callback
Parent:__construct
->
Zend\Validator\AbstractValidator
setOptions()
->
Zend\Validator\Callback
setCallback()
->
Zend\Validator\Callback
isValid()
调用栈
测试
