- unserialize: documentation ( source)
- phpinfo: documentation ( source)
<?php
class A {
public $key;
public $link;
function __destruct() {
global $flag;
global $permit;
if($permit==1)
echo $flag;
}
function __wakeup() {
exit("nonono");
}
}
class B {
public $key;
public $link;
function __destruct() {
global $file;
global $flag;
$flag="get_flag_contents";
}
function __wakeup() {
global $file;
$this->key=1;
$file='index.php';
}
function __toString() {
if($link->key==0){
global $file;
$file='flag.php';
return "WOW!!!";
}
}
}
class C {
public $key;
public $link;
function __destruct() {
if($this->link->key==1)
echo $this->link;
}
function __wakeup() {
exit("nonono");
}
}
class D {
public $key;
public $link;
function __destruct() {
global $permit;
$permit=1;
$this->key=0;
echo "OK!YOU CAN PASS";
}
function __wakeup() {
exit("nonono");
}
}
class E {
public $key;
public $link;
function __destruct() {
global $permit;
$permit=0;
}
function __wakeup() {
$this->key=0;
phpinfo();
}
}
$ser = 'O:1:"C":2:{s:3:"key";N;s:4:"link";O:1:"B":2:{s:3:"key";i:1;s:4:"link";N;}}';
unserialize($ser);