├── README.md
├── class03
├── 1.php
├── 2.php
├── 3.php
└── 4.php
├── class04
├── 1.php
├── 2.php
├── 3.php
├── 4.php
├── 5.php
└── 6.php
├── class05
└── 1.php
├── class06
└── index.php
├── class07
├── 1.php
├── 2.php
└── 3.php
├── class08
├── 1.php
├── 2.php
├── 3.php
└── 4.php
├── class09
├── 1.php
└── 2.php
├── class10
├── 1.php
├── 2.php
├── 3.php
├── 4.php
├── 5.php
├── 6.php
└── 7.php
├── class11
└── 1.php
├── class12
└── 1.php
├── class13
├── 1.php
└── flag.php
├── class14
└── 1.php
├── class15
└── 1.php
├── class16
├── 1.php
└── flag.php
├── class17
├── 1.php
└── flag.php
├── class18
├── 1.php
└── flag.php
├── class19
├── 1.php
└── flag.php
├── class20
├── 1.php
├── 2.php
├── 3.php
├── save.php
└── vul.php
├── class21
├── flag.php
├── hint.php
└── index.php
├── class22
├── index.php
└── phar.php
├── class23
├── flag.php
├── index.php
├── upload.php
└── upload
│ └── poc.png
├── index.html
├── info.php
└── php.ini
/README.md:
--------------------------------------------------------------------------------
1 | # php_ser_Class
2 | php反序列化靶场课程，基于课程制作的靶场,单独去看代码没有什么太大的意义
3 |
4 | 可以直接去bilibili.com上搜索橙子科技工作室的反序列化视频，对照视频进行学习
5 | https://space.bilibili.com/271803648
6 |
7 | 也可以直接通过docker部署，建议通过docker，不然部分php环境匹配不对会导致实验结果不正常
8 |
9 | docker pull mcc0624/ser:1.8
10 |
11 | docker run -p 8002:80 -d mcc0624/ser:1.8
12 |
13 | 将端口直接映射到8002，直接访问http://127.0.0.1:8002即可打开靶场
14 |
--------------------------------------------------------------------------------
/class03/1.php:
--------------------------------------------------------------------------------
1 | name;
8 | echo $var1;
9 | }
10 | }
11 | ?>
12 |
--------------------------------------------------------------------------------
/class03/2.php:
--------------------------------------------------------------------------------
1 | name."
";
8 | echo $var1."
";
9 | }
10 | }
11 | $cyj= new hero();
12 | $cyj->name='chengyaojin';
13 | $cyj->sex='man';
14 | $cyj->jineng('zuofan');
15 | print_r($cyj);
16 | ?>
17 |
--------------------------------------------------------------------------------
/class03/3.php:
--------------------------------------------------------------------------------
1 | name;
9 | echo $var1;
10 | }
11 | }
12 | $cyj= new hero();
13 | echo $cyj->name."
";
14 | echo $cyj->sex."
";
15 | echo $cyj->shengao."
";
16 | ?>
17 |
18 |
--------------------------------------------------------------------------------
/class03/4.php:
--------------------------------------------------------------------------------
1 | name;
9 | echo $var1;
10 | }
11 | }
12 | class hero2 extends hero{
13 | function test(){
14 | echo $this->name."
";
15 | echo $this->sex."
";
16 | echo $this->shengao."
";
17 | }
18 | }
19 | $cyj= new hero();
20 | $cyj2=new hero2();
21 | echo $cyj->name."
";
22 | echo $cyj2->test();
23 | ?>
24 |
--------------------------------------------------------------------------------
/class04/1.php:
--------------------------------------------------------------------------------
1 | data = $data;
11 | $this->pass = $pass;
12 | }
13 | }
14 | $number = 34;
15 | $str = 'user';
16 | $bool = true;
17 | $null = NULL;
18 | $arr = array('a' => 10, 'b' => 200);
19 | $test = new TEST('uu', true);
20 | $test2 = new TEST('uu', true);
21 | $test2->data = &$test2->data2;
22 | echo serialize($number)."
";
23 | echo serialize($str)."
";
24 | echo serialize($bool)."
";
25 | echo serialize($null)."
";
26 | echo serialize($arr)."
";
27 | echo serialize($test)."
";
28 | echo serialize($test2)."
";
29 | ?>
30 |
31 |
--------------------------------------------------------------------------------
/class04/2.php:
--------------------------------------------------------------------------------
1 |
7 |
--------------------------------------------------------------------------------
/class04/3.php:
--------------------------------------------------------------------------------
1 | pub;
7 | }
8 | }
9 | $a = new test();
10 | echo serialize($a);
11 | ?>
12 |
--------------------------------------------------------------------------------
/class04/4.php:
--------------------------------------------------------------------------------
1 | pub;
7 | }
8 | }
9 | $a = new test();
10 | echo serialize($a);
11 | ?>
12 |
--------------------------------------------------------------------------------
/class04/5.php:
--------------------------------------------------------------------------------
1 | pub;
7 | }
8 | }
9 | $a = new test();
10 | echo serialize($a);
11 | ?>
12 |
--------------------------------------------------------------------------------
/class04/6.php:
--------------------------------------------------------------------------------
1 | pub;
7 | }
8 | }
9 | class test2{
10 | var $ben;
11 | function __construct(){
12 | $this->ben=new test();
13 | }
14 | }
15 | $a = new test2();
16 | echo serialize($a);
17 | ?>
18 |
--------------------------------------------------------------------------------
/class05/1.php:
--------------------------------------------------------------------------------
1 | a;
9 | }
10 | }
11 | $d = new test();
12 | $d = serialize($d);
13 | echo $d."
";
14 | echo urlencode($d)."
";
15 | $a = urlencode($d);
16 | $b = unserialize(urldecode($a));
17 | var_dump($b);
18 |
19 | ?>
20 |
--------------------------------------------------------------------------------
/class06/index.php:
--------------------------------------------------------------------------------
1 | a);
8 | }
9 | }
10 |
11 | $get = $_GET["benben"];
12 | $b = unserialize($get);
13 | $b->displayVar() ;
14 |
15 | ?>
16 |
--------------------------------------------------------------------------------
/class07/1.php:
--------------------------------------------------------------------------------
1 | username = $username;
7 | echo "触发了构造函数1次" ;
8 | }
9 | }
10 | $test = new User("benben");
11 | $ser = serialize($test);
12 | unserialize($ser);
13 |
14 | ?>
15 |
16 |
--------------------------------------------------------------------------------
/class07/2.php:
--------------------------------------------------------------------------------
1 | " ;
7 | }
8 | }
9 | $test = new User("benben");
10 | $ser = serialize($test);
11 | unserialize($ser);
12 |
13 | ?>
14 |
--------------------------------------------------------------------------------
/class07/3.php:
--------------------------------------------------------------------------------
1 | cmd);
9 | }
10 | }
11 | $ser = $_GET["benben"];
12 | unserialize($ser);
13 |
14 | ?>
15 |
--------------------------------------------------------------------------------
/class08/1.php:
--------------------------------------------------------------------------------
1 | username = $username;
10 | $this->nickname = $nickname;
11 | $this->password = $password;
12 | }
13 | public function __sleep() {
14 | return array('username', 'nickname');
15 | }
16 | }
17 | $user = new User('a', 'b', 'c');
18 | echo serialize($user);
19 | ?>
20 |
21 |
--------------------------------------------------------------------------------
/class08/2.php:
--------------------------------------------------------------------------------
1 | username = $username;
11 | $this->nickname = $nickname;
12 | $this->password = $password;
13 | }
14 | public function __sleep() {
15 | system($this->username);
16 | }
17 | }
18 | $cmd = $_GET['benben'];
19 | $user = new User($cmd, 'b', 'c');
20 | echo serialize($user);
21 | ?>
22 |
--------------------------------------------------------------------------------
/class08/3.php:
--------------------------------------------------------------------------------
1 | password = $this->username;
12 | }
13 | }
14 | $user_ser = 'O:4:"User":2:{s:8:"username";s:1:"a";s:8:"nickname";s:1:"b";}';
15 | var_dump(unserialize($user_ser));
16 | ?>
17 |
--------------------------------------------------------------------------------
/class08/4.php:
--------------------------------------------------------------------------------
1 | username);
12 | }
13 | }
14 | $user_ser = $_GET['benben'];
15 | unserialize($user_ser);
16 | ?>
17 |
--------------------------------------------------------------------------------
/class09/1.php:
--------------------------------------------------------------------------------
1 | ";
14 | echo $test;
15 | ?>
16 |
--------------------------------------------------------------------------------
/class09/2.php:
--------------------------------------------------------------------------------
1 | benben;
13 | echo "
";
14 | echo $test() ->benben;
15 | ?>
16 |
--------------------------------------------------------------------------------
/class10/1.php:
--------------------------------------------------------------------------------
1 | callxxx('a');
12 | ?>
13 |
14 |
--------------------------------------------------------------------------------
/class10/2.php:
--------------------------------------------------------------------------------
1 |
13 |
14 |
--------------------------------------------------------------------------------
/class10/3.php:
--------------------------------------------------------------------------------
1 | var2;
13 | ?>
14 |
15 |
--------------------------------------------------------------------------------
/class10/4.php:
--------------------------------------------------------------------------------
1 | var2=1;
13 | ?>
14 |
15 |
--------------------------------------------------------------------------------
/class10/5.php:
--------------------------------------------------------------------------------
1 | var);
13 | ?>
14 |
15 |
--------------------------------------------------------------------------------
/class10/6.php:
--------------------------------------------------------------------------------
1 | var);
13 | ?>
14 |
15 |
--------------------------------------------------------------------------------
/class10/7.php:
--------------------------------------------------------------------------------
1 |
14 |
--------------------------------------------------------------------------------
/class11/1.php:
--------------------------------------------------------------------------------
1 | test = new normal();
8 | }
9 | public function __destruct(){
10 | $this->test->action();
11 | }
12 | }
13 | class normal {
14 | public function action(){
15 | echo "please attack me";
16 | }
17 | }
18 | class evil {
19 | var $test2;
20 | public function action(){
21 | eval($this->test2);
22 | }
23 | }
24 | unserialize($_GET['test']);
25 | ?>
26 |
--------------------------------------------------------------------------------
/class12/1.php:
--------------------------------------------------------------------------------
1 | source;
9 | }
10 | }
11 | class sec {
12 | var $benben;
13 | public function __tostring(){
14 | echo "tostring is here!!";
15 | }
16 | }
17 | $b = $_GET['benben'];
18 | unserialize($b);
19 | ?>
20 |
--------------------------------------------------------------------------------
/class13/1.php:
--------------------------------------------------------------------------------
1 | append($this->var);
14 | }
15 | }
16 |
17 | class Show{
18 | public $source;
19 | public $str;
20 | public function __toString(){
21 | return $this->str->source;
22 | }
23 | public function __wakeup(){
24 | echo $this->source;
25 | }
26 | }
27 |
28 | class Test{
29 | public $p;
30 | public function __construct(){
31 | $this->p = array();
32 | }
33 |
34 | public function __get($key){
35 | $function = $this->p;
36 | return $function();
37 | }
38 | }
39 |
40 | if(isset($_GET['pop'])){
41 | unserialize($_GET['pop']);
42 | }
43 | ?>
--------------------------------------------------------------------------------
/class13/flag.php:
--------------------------------------------------------------------------------
1 | v1 = $arga;
10 | $this->v2 = $argc;
11 | }
12 | }
13 | $a = $_GET['v1'];
14 | $b = $_GET['v2'];
15 | $data = serialize(new A($a,$b));
16 | $data = str_replace("system()","",$data);
17 | var_dump(unserialize($data));
18 | ?>
19 |
20 |
--------------------------------------------------------------------------------
/class15/1.php:
--------------------------------------------------------------------------------
1 | v1 = $arga;
10 | $this->v2 = $argc;
11 | }
12 | }
13 | $a = $_GET['v1'];
14 | $b = $_GET['v2'];
15 | $data = serialize(new A($a,$b));
16 | $data = str_replace("ls","pwd",$data);
17 |
18 | var_dump(unserialize($data));
19 |
--------------------------------------------------------------------------------
/class16/1.php:
--------------------------------------------------------------------------------
1 | user=$user;
14 | }
15 | }
16 | $param=$_GET['param'];
17 | $param=serialize(new test($param));
18 | $profile=unserialize(filter($param));
19 |
20 | if ($profile->pass=='escaping'){
21 | echo file_get_contents("flag.php");
22 | }
23 | ?>
24 |
--------------------------------------------------------------------------------
/class16/flag.php:
--------------------------------------------------------------------------------
1 | user=$user;
15 | $this->pass=$pass;
16 | }
17 | }
18 | $param=$_GET['user'];
19 | $pass=$_GET['pass'];
20 | $param=serialize(new test($param,$pass));
21 | $profile=unserialize(filter($param));
22 |
23 | if ($profile->vip){
24 | echo file_get_contents("flag.php");
25 | }
26 | ?>
27 |
--------------------------------------------------------------------------------
/class17/flag.php:
--------------------------------------------------------------------------------
1 | file=$file;
8 | }
9 |
10 | function __destruct(){
11 | include_once($this->file);
12 | echo $flag;
13 | }
14 |
15 | function __wakeup(){
16 | $this->file='index.php';
17 | }
18 | }
19 | $cmd=$_GET['cmd'];
20 | if (!isset($cmd)){
21 | highlight_file(__FILE__);
22 | }
23 | else{
24 | if (preg_match('/[oc]:\d+:/i',$cmd)){
25 | echo "Are you daydreaming?";
26 | }
27 | else{
28 | unserialize($cmd);
29 | }
30 | }
31 | //sercet in flag.php
32 | ?>
33 |
--------------------------------------------------------------------------------
/class18/flag.php:
--------------------------------------------------------------------------------
1 | secret = "*";
19 | if ($o->secret === $o->enter)
20 | echo "Congratulation! Here is my secret: ".$flag;
21 | else
22 | echo "Oh no... You can't fool me";
23 | }
24 | else echo "are you trolling?";
25 | ?>
26 |
--------------------------------------------------------------------------------
/class19/flag.php:
--------------------------------------------------------------------------------
1 |
7 |
--------------------------------------------------------------------------------
/class20/2.php:
--------------------------------------------------------------------------------
1 |
9 |
--------------------------------------------------------------------------------
/class20/3.php:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/class20/save.php:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/class20/vul.php:
--------------------------------------------------------------------------------
1 | a);
12 | }
13 | }
14 | ?>
--------------------------------------------------------------------------------
/class21/flag.php:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/class21/index.php:
--------------------------------------------------------------------------------
1 | her=md5(rand(1, 10000));
10 | if ($this->name===$this->her){
11 | include('flag.php');
12 | echo $flag;
13 | }
14 | }
15 | }
16 | ?>
--------------------------------------------------------------------------------
/class22/index.php:
--------------------------------------------------------------------------------
1 | output);
10 | }
11 | }
12 | if(isset($_GET['filename']))
13 | {
14 | $filename=$_GET['filename'];
15 | var_dump(file_exists($filename));
16 | }
17 | ?>
--------------------------------------------------------------------------------
/class22/phar.php:
--------------------------------------------------------------------------------
1 | startBuffering(); //开始写文件
11 | $phar->setStub(''); //写入stub
12 | $o=new Testobj();
13 | $o->output='eval($_GET["a"]);';
14 | $phar->setMetadata($o);//写入meta-data
15 | $phar->addFromString("test.txt","test"); //添加要压缩的文件
16 | $phar->stopBuffering();
17 | ?>
18 |
--------------------------------------------------------------------------------
/class23/flag.php:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/class23/upload.php:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | 上传图片文件
5 |
6 |
7 |
12 |
13 |