<\/div><\/figure>\n\n\n\n
\u8fd9\u79cd\u5c31\u5c5e\u4e8e\u4e00\u4e2a\u7a0d\u5fae\u590d\u6742\u70b9\u7684pop\u94fe\uff0c\u63c9\u5408\u4e86\u4e4b\u524d\u63d0\u5230\u8fc7\u7684\u51e0\u79cd\u9b54\u672f\u65b9\u6cd5\uff0c\u5b83\u7684pop\u94fe\u4e3a\uff1a<\/p>\n\n\n\n
C::__destruct\n\u2193\u2193\u2193\nD::__toString()\n\u2193\u2193\u2193\nA::run()\n\u2193\u2193\u2193\nB::__invoke()<\/code><\/pre>\n\n\n\n\u7406\u89e3\u8d77\u6765\u5e94\u8be5\u633a\u7b80\u5355\u7684\uff0c\u6bd5\u7adf__toString()\u7684\u4f8b\u5b50\u91cc\u6211\u5df2\u7ecf\u89e3\u91ca\u8fc7\u4e86\uff0c\u53ef\u4ee5\u7528echo $this->f1 . ‘xxx’;\u8fd9\u79cd\u5f62\u5f0f\u8c03\u7528__toString()\uff0c\u7136\u540e__toString()\u91cc\u53c8\u76f4\u63a5\u8c03\u7528\u4e86run()\uff0crun()\u91cc\u4ee5($this->m1)();\u8fd9\u79cd\u5f62\u5f0f\u8fdb\u884c\u4e86\u8c03\u7528\uff0c\u901a\u8fc7$a->m1=$b\u6240\u4ee5\u987a\u7406\u6210\u7ae0\u5730\u8c03\u7528\u4e86D\u7c7b\u4e2d\u7684__invoke()\u65b9\u6cd5\u3002<\/p>\n\n\n\n
__call<\/strong><\/h2>\n\n\n\n__call\u7684\u4f5c\u7528\u662f\u8fdb\u884c\u65b9\u6cd5\u91cd\u8f7d\uff0c\u5f53\u5728\u5bf9\u8c61\u4e2d\u8c03\u7528\u4e00\u4e2a\u4e0d\u53ef\u8bbf\u95ee\u65b9\u6cd5\u65f6\uff0c__call() \u4f1a\u88ab\u81ea\u52a8\u8c03\u7528\uff0c\u5b83\u7684\u539f\u578b\u662fpublic __call<\/strong>(string $name<\/code>, array $arguments<\/code>)\uff0c$name<\/var> \u53c2\u6570\u662f\u8981\u8c03\u7528\u7684\u65b9\u6cd5\u540d\u79f0\u3002$arguments<\/var> \u53c2\u6570\u662f\u4e00\u4e2a\u679a\u4e3e\u6570\u7ec4\uff0c\u4e0d\u8fc7\u6211\u4eec\u4e00\u822c\u53ef\u4ee5\u4e0d\u7ba1\u5b83\u3002\u5728ctf\u4e2d\u51fa\u73b0\u5c31\u53ef\u80fd\u662f\u67d0\u4e2a\u65b9\u6cd5\u4e0b\u8c03\u7528\u4e86\u4e2a\u9898\u76ee\u91cc\u4e0d\u5b58\u5728\u7684\u65b9\u6cd5\uff0c\u8fd9\u65f6\u5c31\u8981\u60f3\u5f53\u901a\u8fc7__call()\u6253\u914d\u5408\uff0c\u6bd4\u5982\uff1a<\/p>\n\n\n\n<?php\n class A{\n\tpublic function __call($a,$b)\n {\n echo \"I am __call()!\";\n }\n}\n\n class B{\n \tpublic $v1;\n\tpublic function __invoke()\n {\n $this->v1->world();\n }\n}\n\nclass C{\n\tpublic $m1;\n\tpublic function __destruct()\n {\n ($this->m1)();\n }\n}\n\nif(isset($_GET['pop'])){\n @unserialize($_GET['pop']);\n}\n\n?><\/code><\/pre>\n\n\n\n\u90a3\u6211\u4eec\u7684payload\u5c31\u4e3a\uff1a<\/p>\n\n\n\n
<?php\n class A{\n\tpublic function __call($a,$b)\n {\n\n }\n}\n\n class B{\n \tpublic $v1;\n\tpublic function __invoke()\n {\n\n }\n}\n\nclass C{\n\tpublic $m1;\n\tpublic function __destruct()\n {\n\n }\n}\n\n$c=new C();\n$b=new B();\n$a=new A();\n\n$c->m1=$b;\n$b->v1=$a;\n\necho serialize($c);\n#O:1:\"C\":1:{s:2:\"m1\";O:1:\"B\":1:{s:2:\"v1\";O:1:\"A\":0:{}}}\n?><\/code><\/pre>\n\n\n\n<\/div><\/figure>\n\n\n\n
\u8fd9\u5c31\u662f\u56e0\u4e3aclass B\u4e2d\u7684world()\u5176\u5b9e\u5e76\u4e0d\u5b58\u5728\uff0c\u6240\u4ee5\u5f53\u6211\u4eec\u4f7f$b->v1=$a;\u5c31\u53ef\u4ee5\u8c03\u7528A\u4e2d\u7684__call($a,$b)\u4e86\u3002<\/p>\n\n\n\n
__get()<\/h2>\n\n\n\n \u8bfb\u53d6\u4e0d\u53ef\u8bbf\u95ee\uff08protected \u6216 private\uff09\u6216\u4e0d\u5b58\u5728\u7684\u5c5e\u6027\u7684\u503c\u65f6\uff0c__get() \u4f1a\u88ab\u8c03\u7528\uff0c\u539f\u578b\u4e3apublic __get<\/strong>(string $name<\/code>)\uff0c\u53c2\u6570 $name<\/var> \u662f\u6307\u8981\u64cd\u4f5c\u7684\u53d8\u91cf\u540d\u79f0\uff0c\u4e00\u822c\u53ef\u4ee5\u4e0d\u7ba1\u3002\u6bd4\u5982\uff1a<\/p>\n\n\n\n<?php\nclass A{\n\tpublic function __get($key)\n {\n echo \"I am __get()!\";\n }\n}\n\n class B{\n \tpublic $source;\n public $str;\n\tpublic function flag()\n {\n $this->source->str;\n }\n}\n\nclass C{\n\tpublic $m1;\n\tpublic function __destruct()\n {\n $this->m1->flag();\n }\n}\n\n\nif(isset($_GET['pop'])){\n @unserialize($_GET['pop']);\n}\n\n?><\/code><\/pre>\n\n\n\npayload:<\/p>\n\n\n\n
<?php\n class A{\n\tpublic function __get($key)\n {\n }\n}\n\n class B{\n \tpublic $source;\n public $str;\n\tpublic function flag()\n {\n }\n}\n\nclass C{\n\tpublic $m1;\n\tpublic function __destruct()\n {\n }\n}\n\n$c=new C();\n$b=new B();\n$a=new A();\n\n$c->m1=$b;\n$b->source=$a;\n\necho serialize($c);\n#O:1:\"C\":1:{s:2:\"m1\";O:1:\"B\":2:{s:6:\"source\";O:1:\"A\":0:{}s:3:\"str\";N;}}\n?><\/code><\/pre>\n\n\n\n<\/div><\/figure>\n\n\n\n
\u8fd9\u91cc\u6211\u4eec$b->source\u4e2d\u7684source\u88ab\u8d4b\u4e3a\u4e86A\u7c7b\uff0cA\u4e2d\u6ca1\u6709str\u8fd9\u4e2a\u5c5e\u6027\uff0c\u6240\u4ee5\u5f53\u8c03\u7528$this->source->str;\u65f6\u4f1a\u8c03\u7528__get()\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
\u600e\u4e48\u505aPOP\u9898 \u505actf\u7684web\u65b9\u5411\u603b\u662f\u4e0d\u53ef\u907f\u514d\u7684\u9047\u5230\u548cphp\u53cd\u5e8f\u5217\u5316\u6709\u5173\u7684\u9898\uff0c\u800cpop\u5c31\u662f\u5176\u4e2d\u7684\u5957\u5a03\u9898\uff0c\u9700\u8981 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[],"class_list":["post-767","post","type-post","status-publish","format-standard","hentry","category-8"],"_links":{"self":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/767","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/comments?post=767"}],"version-history":[{"count":4,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/767\/revisions"}],"predecessor-version":[{"id":1431,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/767\/revisions\/1431"}],"wp:attachment":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/media?parent=767"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/categories?post=767"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/tags?post=767"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/construct-1024x231.jpg\")
<\/div><\/figure>\n\n\n\n![\"\"](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-8.jpg\")
<\/div><\/figure>\n\n\n\n![\"\"](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-9-1024x261.jpg\")
<\/div><\/figure>\n\n\n\n![\"\"](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-10-1024x624.jpg\")
<\/div><\/figure>\n\n\n\n![\"\"](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-11-1024x274.jpg\")
<\/div><\/figure>\n\n\n\n![\"\"](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-12-1024x394.jpg\")
<\/div><\/figure>\n\n\n\n![\"\"](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-13-1024x376.jpg\")
<\/div><\/figure>\n\n\n\n![\"\"](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-16.jpg\")
<\/div><\/figure>\n\n\n\n![\"\"](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-17-1024x623.jpg\")
<\/div><\/figure>\n\n\n\n![\"\"](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-18-1024x592.jpg\")
<\/div><\/figure>\n\n\n\n![\"\"](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-14-1024x609.jpg\")
<\/div><\/figure>\n\n\n\n![\"\"](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-19-1024x635.jpg\")
<\/div><\/figure>\n\n\n\n![\"\"](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-20.jpg\")
<\/div><\/figure>\n\n\n\n![\"\"](\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2023\/01\/1-21-1024x668.jpg\")
<\/div><\/figure>\n\n\n\n