[buuctf][网鼎杯 2018]Fakebook 构造反序列化

源码分析

get方法获得str
if(isset($_GET{
   'str'})) {
   

    $str = (string)$_GET['str'];
    if(is_valid($str)) {
   
        $obj = unserialize($str);
    }

}

反序列化赋值给obj
看看这个类

class FileHandler {
   

    protected $op;
    protected $filename;
    protected $content;

    function __construct() {
   
        $op = "1";
        $filename = "/tmp/tmpfile";
        $content = "Hello World!";
        $this->process();
    }

    public function process() {
   
        if($this->op == "1") {
   
            $this