POP Restaurant

hackthebox

Task: Achieve RCE on a PHP food ordering application. Solution: Exploit unserialize() on user-controlled POST data by crafting a POP chain: Pizza.__destruct() triggers Spaghetti.__get() triggers IceCream.__invoke() triggers ArrayHelpers.current() which calls call_user_func("system", command) for arbitrary command execution.