WEB常见漏洞之反序列化（靶场篇）2

NULL被序列化为：N
Boolean型数据序列化为：b:1，b:0，分别代表True和False
Integer型数据序列化为：i:数值
String型数据序列化为：s:长度:"值"
对象序列化为：O:类名长度:类名:字段数:字段

__construct：当对象被创建时调用
__destruct：当对象被销毁前调用
__sleep：执行serialize函数前调用
__wakeup：执行unserialize函数前调用
__call：在对象中调用不可访问的方法时调用
__callStatic：用静态方法调用不可访问方法时调用
__get：获得类成因变量时调用
__set：设置类成员变量时调用

<?php
    $a="test"; //字符串
    $arr = array('j' => 'jack' ,'r' => 'rose'); //数组
    class A{
        public $test="yeah";
    }
    echo "序列化:";
    echo "</br>";
    $aa=serialize($a);
    print_r($aa);
    echo "</br>";
    $arr_a=serialize($arr);
    print_r($arr_a);
    echo "</br>";
    $class1 = new A(); //对象
    $class_a=serialize($class1);
    print_r($class_a);
    echo "<br/>";
    echo "反序列化:";
    echo "<br/>";
    print_r(unserialize($aa));
    echo "</br>";
    print_r(unserialize($arr_a));
    echo "</br>";
    print_r(unserialize($class_a));
?>

<?php
    $a="test"; //字符串
    $arr = array('j' => 'jack' ,'r' => 'rose'); //数组
    class A{
        public $test="<img src=1 onerror=alert(1)>";
    }
    echo "序列化:";
    echo "</br>";
    $aa=serialize($a);
    print_r($aa);
    echo "</br>";
    $arr_a=serialize($arr);
    print_r($arr_a);
    echo "</br>";
    $class1 = new A(); //对象
    $class_a=serialize($class1);
    print_r($class_a);
    echo "<br/>";
    echo "反序列化:";
    echo "<br/>";
    print_r(unserialize($aa));
    echo "</br>";
    print_r(unserialize($arr_a));
    echo "</br>";
    print_r(unserialize($class_a));
?>

<?php
class A{
    var $test = "demo";
    function __wakeup(){
            echo $this->test;
    }
}
$a = $_GET['test'];
$a_unser = unserialize($a);
?>

<?php
class A{
    var $test = "demo";
    function __wakeup(){
           eval($this->test);
    }
}
$b = new A();
$c = serialize($b);
echo $c;
$a = $_GET['test'];
$a_unser = unserialize($a);
?>

<?php
//为显示效果，把这个shell.php包含进来
require "shell.php";
class A{
    var $test = '123';
    function __wakeup(){
        $fp = fopen("shell.php","w") ;
        fwrite($fp,$this->test);
        fclose($fp);
    }
}
$a= new A();
print_r(serialize($a));
$class1 = $_GET['test'];
print_r($class1);
echo "</br>";
$class1_unser = unserialize($class1);
?>

<?php
require "shell.php";
class B{
    function __construct($test){
        $fp = fopen("shell.php","w") ;
        fwrite($fp,$test);
        fclose($fp);
    }
}
class A{
    var $test = '123';
    function __wakeup(){
        $obj = new B($this->test);
    }
}
$class1 = $_GET['test'];
echo "</br>";
$class1_unser = unserialize($class1);
?>

<?php
    class maniac{
        public $test;
        function __construct(){
            $this->test =new x1();
        }
        function __destruct(){
            $this->test->action();
        }
    }
class x1{
    function action(){
        echo "x1";
    }
}
class x2{
    public $test2;
    function action(){
        eval($this->test2);
    }
}
$class2  = new maniac();
unserialize($_GET['test']);
?>