<?php// flag in flag.phpclassC1e4r{public$test;public$str;publicfunction__construct($name){$this->str=$name;}publicfunction__destruct(){$this->test=$this->str;echo$this->test;}}classShow{public$source;public$str;publicfunction__construct($file){$this->source=$file;echo$this->source;}publicfunction__toString(){$content=$this->str['str']->source;return$content;}publicfunction__set($key,$value){$this->$key=$value;}publicfunction_show(){if(preg_match('/http|https|file:|gopher|dict|\.\.|f1ag/i',$this->source)){die('hacker!');}else{highlight_file($this->source);}}publicfunction__wakeup(){if(preg_match("/http|https|file:|gopher|dict|\.\./i",$this->source)){echo"hacker~";$this->source="index.php";}}}classTest{public$file;public$params;publicfunction__construct(){$this->params=array();}publicfunction__get($key){return$this->get($key);}publicfunctionget($key){if(isset($this->params[$key])){$value=$this->params[$key];}else{$value="index.php";}return$this->file_get($value);}publicfunctionfile_get($value){$text=base64_encode(file_get_contents($value));return$text;}}show_source(__FILE__);$name=unserialize($_GET['strs']);?>
分析
class C1e4r{public$test;public$str;publicfunction__construct($name){$this->str=$name;}publicfunction__destruct(){$this->test=$this->str;echo$this->test;}}
class Show{public$source;public$str;publicfunction__construct($file){$this->source=$file;echo$this->source;}publicfunction__toString(){$content=$this->str['str']->source;return$content;}publicfunction__set($key,$value){$this->$key=$value;}publicfunction_show(){if(preg_match('/http|https|file:|gopher|dict|\.\.|f1ag/i',$this->source)){die('hacker!');}else{highlight_file($this->source);}}publicfunction__wakeup(){if(preg_match("/http|https|file:|gopher|dict|\.\./i",$this->source)){echo"hacker~";$this->source="index.php";}}}
class Test{public$file;public$params;publicfunction__construct(){$this->params=array();}publicfunction__get($key){return$this->get($key);}publicfunctionget($key){if(isset($this->params[$key])){$value=$this->params[$key];}else{$value="index.php";}return$this->file_get($value);}publicfunctionfile_get($value){$text=base64_encode(file_get_contents($value));return$text;}}
文章目录源码分析payload*2源码<?php// flag in flag.phpclass C1e4r{ public $test; public $str; public function __construct($name){ $this->str = $name; } public function __destruct(){ $this->test = $this->str;