ctfshow web150_plus

web150_plus

源码

include("flag.php");
error_reporting(0);
highlight_file(__FILE__);
​
class CTFSHOW{
    private $username;
    private $password;
    private $vip;
    private $secret;
​
    function __construct(){
        $this->vip = 0;
        $this->secret = $flag;
    }
​
    function __destruct(){
        echo $this->secret;
    }
​
    public function isVIP(){
        return $this->vip?TRUE:FALSE;
        }
    }
​
    function __autoload($class){
        if(isset($class)){
            $class();
    }
}
​
#过滤字符
$key = $_SERVER['QUERY_STRING'];
if(preg_match('/\_| |\[|\]|\?/', $key)){
    die("error");
}
$ctf = $_POST['ctf'];
extract($_GET);
if(class_exists($__CTFSHOW__)){
    echo "class is exists!";
}
​
if($isVIP && strrpos($ctf, ":")===FALSE && strrpos($ctf,"log")===FALSE){
    include($ctf);
}

这次把log给ban了，但i