/index.php?re=hello
<?php
require_once('../../header.php');
?>
<html>
<head>
<title>反序列化漏洞</title>
</head>
<h2>反序列化漏洞</h2>
<div class="alert alert-success">
<p>/index.php?re=hello </p>
</div>
<body>
<?php
highlight_file(__FILE__);
class a {
var $test = 'hello';
function __destruct(){
$fp = fopen("/var/www/html/unserialize/01/hello.php","w");
fputs($fp,$this->test);
fclose($fp);
}
}
$class = stripslashes($_GET['re']);
$class_unser = unserialize($class);
require '/var/www/html/unserialize/01/hello.php';
require_once '../../footer.php';
?>
| ( ! ) Warning: system() [<a href='function.system'>function.system</a>]: Cannot execute a blank command in /var/www/html/unserialize/01/hello.php on line 1 | ||||
|---|---|---|---|---|
| Call Stack | ||||
| # | Time | Memory | Function | Location |
| 1 | 0.0011 | 95584 | {main}( ) | ../index.php:0 |
| 2 | 0.0021 | 98232 | require( '/var/www/html/unserialize/01/hello.php' ) | ../index.php:26 |
| 3 | 0.0021 | 98312 | system ( ) | ../hello.php:1 |