ISCTF 2025 WP

Thu, 11 Dec 2025 23:09:02 +0800

web
#

Bypass
#

src：

<?php
class FLAG
{
 private $a;
 protected $b;
 public function __construct($a, $b)
 {
 $this->a = $a;
 $this->b = $b;
 $this->check($a,$b);
 eval($a.$b);
 }
 public function __destruct(){
 $a = (string)$this->a;
 $b = (string)$this->b;
 if ($this->check($a,$b)){
 $a("", $b);
 }
 else{
 echo "Try again!";
 }
 }
 private function check($a, $b) {
 $blocked_a = ['eval', 'dl', 'ls', 'p', 'escape', 'er', 'str', 'cat', 'flag', 'file', 'ay', 'or', 'ftp', 'dict', '\.\.', 'h', 'w', 'exec', 's', 'open'];
 $blocked_b = ['find', 'filter', 'c', 'pa', 'proc', 'dir', 'regexp', 'n', 'alter', 'load', 'grep', 'o', 'file', 't', 'w', 'insert', 'sort', 'h', 'sy', '\.\.', 'array', 'sh', 'touch', 'e', 'php', 'f'];

 $pattern_a = '/' . implode('|', array_map('preg_quote', $blocked_a, ['/'])) . '/i';
 $pattern_b = '/' . implode('|', array_map('preg_quote', $blocked_b, ['/'])) . '/i';

 if (preg_match($pattern_a, $a) || preg_match($pattern_b, $b)) {
 return false;
 }
 return true;
 } 
}


if (isset($_GET['exp'])) {
 $p = unserialize($_GET['exp']);
 var_dump($p);
}else{
 highlight_file("index.php");
}

注意 __construct 不可以直接引用因此无法让&a = __construct 来调用此外 $a("", $b); 的形式无法通过 &a =FLAG 类来新建对象触发魔术方法因此 __construct function 是干扰项只需专注 __destruct() 由$a("", $b); 想到create_function ()函数

PHP反序列化 on Link's Blog

ISCTF 2025 WP

web #

Bypass #

web
#

Bypass
#