title: CTF pop chain structure of the Web directions issues
body: <p>The directory also has a flag.php file, but is not visible php
  How to Use the Get parameters pop, through the unserialize the class function call to get the flag?
  The createput function of Commen class is an injection of class point, but I don't know how to call it, __destruct functions of the Middle class, and I didn't understand</p>
  <pre><code>&lt;?php
  
  class Setting
  {
      public $find;
      function __construct($b) {
          $this-&gt;find = $b;
      }
      function __call($name,$arguments)
      {
          echo &quot;WWW&quot;.PHP_EOL;
          ($this-&gt;find)();
      }
  }
  
  class Middle
  {
      public $follow;
      function __destruct()
      {
          echo $this-&gt;follow.&quot;Hello World\n&quot;;
          if(preg_match(&quot;/cat|nl|tac|system|passthru|flag|\\|\`|bin|sh|\.\./i&quot;, $this-&gt;follow)) {
              echo &quot;hacker&quot;.PHP_EOL;
              $this-&gt;follow = &quot;index.php&quot;;
          }
      }
      function __invoke()
      {
          $this-&gt;follow-&gt;hackme();
      }
  }
  
  class Code {
      public $ClassObj;
      function __construct($m) {
          $this-&gt;ClassObj = $m;
      }
  
      function __toString()
      {
          $this-&gt;ClassObj-&gt;action1();
      }
  }
  
  class Common {
  
      public function createPut($file = null,$tpl=null){
          $file = $this-&gt;cacheFile;
          $tpl = $this-&gt;temp;
          file_put_contents($file,$tpl);
      }
      function action() {
          echo &quot;just pop&quot;;
      }
  }
  
  class Flag
  {
      public function output()
      {
          $this-&gt;tilte = 'ComeOn';
          $this-&gt;content = 'Cat the Flag!!!'.PHP_EOL;
          echo $this-&gt;tilte.&quot; &quot;.$this-&gt;content;
      }
      public $a;
      public $b;
      public function hackme()
      {
          $this-&gt;output();
          $a=$this-&gt;b;
          $a('', $this-&gt;a);
      }
  }
  
  if(isset($_GET['pop'])) {
      unserialize($_GET['pop']);
  } else {
      highlight_file(__FILE__);
  }
  ?&gt;
  </code></pre>