$ cat writeup.md…
$ cat writeup.md…
bug-makers
Task: PHP web app passes user POST data directly to unserialize(), source contains FileReader class with __destruct() reading files. Solution: craft serialized FileReader object with private filename property set to flag.txt, null bytes required for private property serialization.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar