Hi! Could we please enable some services and cookies to improve your experience and our website?
Online Sandbox for SQL and PHP: Write, Run, Test, and Share SQL Queries and PHP Code
<?php
class ctf{
public $name = "scholar";
public $age = "19";
public $flag = "no flag";
public function __wakeup(){
// 修改成员变量 $flag 的值为 "get flag"
$this->flag = "get flag";
}
}
$ctfer = new ctf();
$str = serialize($ctfer);
$res = unserialize($str);
// 输出反序列化后对象的 flag 属性值
echo $res->flag;
?>
<?php
class ctf{
public $name = "scholar";
public $age = "19";
public $flag = "phpinfo();";
public function __wakeup(){
echo "wakeup";
$this->flag = "echo 'no flag';";
}
public function __destruct(){
echo "destruct" ;
eval($this->flag);
}
}
#$ctfer = new ctf();
#$str = serialize($ctfer);
#echo $str;
if(isset($_GET['o'])){
$s = $_GET['o'];
$ctfer = unserialize($s);
echo $ctfer -> flag;
}
?>