Shulou(Shulou.com)06/01 Report--

This article introduces the relevant knowledge of "case Analysis of the use of yii2 Framework". In the operation of actual cases, many people will encounter such a dilemma, so let the editor lead you to learn how to deal with these situations. I hope you can read it carefully and be able to achieve something!

Yii is a high-performance PHP framework based on components for developing large-scale Web applications. There is a deserialization vulnerability in the version before Yii2 2.0.38. When a program calls unserialize (), an attacker can execute arbitrary commands by constructing a specific malicious request. This article analyzes how yii2 uses chains and how to construct payload, and combines CTF topics to learn the yii2 framework.

Yii2 < 2.0.38 deserialization

Installation: download version 2.0.37 from https://github.com/yiisoft/yii2/releases

Then give a random value to cookieValidationKey in yii-basic-app-2.0.37\ basic\ config\ web.php, run php yii serve, and create a new controller

Yii-basic-app-2.0.37\ basic\ controllers\ TestController.php

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.