1. swoole

题目链接：

Make unserialize great again
https://swoole.rctf2020.rois.io

hint：https://github.com/swoole/library/issues/34

参考资料：

1、 Swoole4 https://wiki.swoole.com/#/start/coroutine?id=%e4%bd%bf%e7%94%a8%e5%8d%8f%e7%a8%8b%e4%bd%a0%e5%8f%af%e4%bb%a5%e5%9c%a8%e4%b8%80%e7%a7%92%e9%92%9f%e9%87%8c%e5%81%9a%e5%a4%9a%e5%b0%91%e4%ba%8b

#!/usr/bin/env php
<?php
Swoole\Runtime::enableCoroutine($flags = SWOOLE_HOOK_ALL);
$http = new Swoole\Http\Server("0.0.0.0", 9501);
$http->on("request",
    function (Swoole\Http\Request $request, Swoole\Http\Response $response) {
        Swoole\Runtime::enableCoroutine();
        $response->header('Content-Type', 'text/plain');
        // $response->sendfile('/flag');
        if (isset($request->get['phpinfo'])) {
            // Prevent racing condition
            // ob_start();phpinfo();
            // return $response->end(ob_get_clean());
            return $response->sendfile('phpinfo.txt');
        }
        if (isset($request->get['code'])) {
            try {
                $code = $request->get['code'];
                if (!preg_match('/\x00/', $code)) {
                    $a = unserialize($code);
                    $a();
                    $a = null;
                }
            } catch (\Throwable $e) {
                var_dump($code);
                var_dump($e->getMessage());
                // do nothing
            }
            return $response->end('Done');
        }
        $response->sendfile(__FILE__);
    }
);
$http->start();