PHP serialization Function Vulnerability----unserialize () function

unserialize () function Concept

unserialize() 对单一的已序列化的变量进行操作，将其转换回 PHP 的值。返回的是转换之后的值，可为 integer、float、string、array 或 object。如果传递的字符串不可解序列化，则返回 FALSE。与之相对的函数serialize()序列化函数。

Let's look at a topic
Title: Skynet Management System, Link: http://ctf5.shiyanbar.com/10/web1/

1, enter the topic to view the Web source

This line of hint compare domineering, directly let you judge your user name MD5 value is not equal to 0, here use PHP processing MD5 hash flaw, encounter hash value is 0e string that starts as 0,qnkcdzo is such string. Recommended websites; https://www.cnblogs.com/Primzahl/p/6018158.html.
2. Enter this special string to see

3, gave a path to see all of a sudden

Here again get a source code, inside the key part is said Unserialize () function. It is clear from the source that the username value of the post transmission should be an array. In this way, the value of User,pass can be derived separately.
It is not possible for us to give the array directly, because the unserialize () function needs to process the serialized string and then deserialize it into PHP's value. So the value that we enter should be the array after the serialization function serialize (), and then the Unserialize () function to handle.
To write a serialized string script:
<?php
$a =array ("user" = True, "pass" = true)//or False
$b =serialize ($a)
Echo $b
?>
Here to remember the value of the group to be prompted with a Boolean value, otherwise will not get flag
You can get the flag by filling in the text box with the result.

Recommend an article: 8664026

PHP serialization Function Vulnerability----unserialize () function